Re: Notification of fork()
Re: Notification of fork()
- Subject: Re: Notification of fork()
- From: Michael Smith <email@hidden>
- Date: Tue, 26 Dec 2006 01:34:55 -0800
On Dec 25, 2006, at 9:26 PM, Curtis Jones wrote:
Any chance that there is a way in which my kext can be made aware when
a fork() occurs? I'm using kauth for purposes of exec() ... but it
definitely doesn't appear to be applicable to simply fork()'ing. More
generally, I would be content with simply knowing when a new process
started.
My real purpose: I'm trying to associate a process id and/or
path-to-executable with incoming socket connections in my socket
filter - as early in the process (ideally in the connect callback
performed in the context of the listener) as possible.
I use kauth so that I can (in limited but sufficient circumstances)
know the path-to-executable for various processes. When one of those
processes creates a listener, I can associate the two together. When
that listener gets an incoming connection and the connect() callback
is called in the context of that listener, I can then associate that
incoming connection with a particular process ... until the annoyance
of fork()'ing enters the picture.
If I knew when fork() was called and the new pid, I could associate
that new process with its parent process, and all would be well.
Anyway ... I'm open to suggestions. Obviously if this were all working
out the way I wanted it to, I wouldn't be posting this.
It sounds to me like you might want to try locating an unknown
process' parent at listen time; typically if someone forks and
attempts to do real work in the forkee, they aren't going to reparent
since they are working closely coupled.
This might still break in the case where the listener is created in a
parent but the accept happens in the child, but that depends on what
other assumptions you're making.
= Mike
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden