Apple

Hi All,

I am currently working on Mac Os X 10.4.7.

I m trying to retrieve the list of files opened by a process using sysctl(). The code snippet that I’ve written is :

void* pBuff = NULL ;

mib[0] = CTL_KERN;

mib[1] = KERN_FILE;

size = sizeof(struct filedesc) ; // This is what I tried. This struct is defined in file sys/filedesc.h

pBuff = malloc(size) ;

while (sysctl((int *)mib, 2, pBuff, &size, NULL, 0) < 0)

{

if (errno == ENOMEM)

{

printf("Not sufficient memory allocated\n");

}

size *= 2 ;

if ((arguments = realloc(pBuff, size)) == NULL)

{

printf("Realloc error\n");

}

printf("Error in getting file struct %s\n and error no is %d\n", strerror(errno),errno) ;

}

This code compiles and fills the buffer pBuff.

Now my question is that the buffer pBuff should to mapped to which structure on Mac 10.4.7??

I have found that it fills struct file or struct xfile on Free BSD. But on Mac Os, I’ve tried it with struct extern_file and struct filedesc, but both didn’t work. Why are the two structs ‘file’ and ‘xfile’ not exposed on Mac 10.4.7?

If none of the above, then which struct is getting filled by the above sysctl call?

I know that there is an alternative way to do the same task, i.e., through lsof. But my project constraints don’t let me use that. Also, when I saw the ktrace dump of lsof, I found that it also uses sysctl.

Is there some other way to do the same task?

Thanks in advance,

Princess