Re: kauth FILEOP_CLOSE_MODIFIED semantics for unexpectedly terminated processes.
Re: kauth FILEOP_CLOSE_MODIFIED semantics for unexpectedly terminated processes.
- Subject: Re: kauth FILEOP_CLOSE_MODIFIED semantics for unexpectedly terminated processes.
- From: Quinn <email@hidden>
- Date: Fri, 11 Jul 2008 10:20:22 +0100
At 12:13 +0400 11/7/08, Maxim Zhuravlev wrote:
I've been explorering the kauth FILEOP scope and found out, that for
unexpectedly terminated or exit()'d process, which hadn't explicitly
closed a file handle it was writing to, a KAUTH_FILEOP_CLOSE
notification with KAUTH_FILEOP_CLOSE_MODIFIED flag set isn't issued.
This happens, cause exit() closes all handles bypassing close()
syscall, which actually checks flags and issues that kind of
notifications.
I would classify that as a bug. I encourage you to file it. Please
post the bug number so that I can keep an eye on it.
<http://developer.apple.com/bugreporter/>
Are there any over documented means to get the same semantics for
that kind of processes?
The only thing that springs to mind is to hook into
KAUTH_SCOPE_VNODE. That's less than ideal (the vnode scope has lots
of gotchas and is really intended for authorization rather than
monitoring), but I can't think of anything better.
S+E
--
Quinn "The Eskimo!" <http://www.apple.com/developer/>
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden