Re: Process ID inside a socket filter NKE
Re: Process ID inside a socket filter NKE
- Subject: Re: Process ID inside a socket filter NKE
- From: Quinn <email@hidden>
- Date: Tue, 30 Aug 2005 13:27:28 +0100
At 16:49 -0400 26/8/05, Russell Seehafer (RIT Student) wrote:
If it is true, is there anyway that I can be notified or find out
when a process has gone away?
You can do this from user space using kqueues. See NOTE_EXIT in
<sys/event.h>. I don't know of a good [1] way to do this from kernel
space.
[1] And by "good", I mean "supported by the Tiger sustainable kernel
programming interfaces (KPIs)".
Another option is to store ancillary information about the PID, and
then reconfirm that information before you use your cached
information. The best information to use is the process start time,
but again that's only available from user space. There is
KPI-accessible information that you could use, but we're starting to
fall into the realm of heuristics.
btw Remember that the process that opened the socket is not
necessarily the same as the process that's using it. Sockets can be
passed between processes using a variety of mechanisms. They can
also be shared between processes (think what happens after a fork).
Thus, there is no clear concept of the owning process of a socket.
The best you can do is the process that created it. And even that
might not be correct because a socket can be created by kernel code.
S+E
--
Quinn "The Eskimo!" <http://www.apple.com/developer/>
Apple Developer Technical Support * Networking, Communications, Hardware
[DTS is hiring support engineers. Contact me for details.]
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden