Re: Process exit notifcation in a kext
Re: Process exit notifcation in a kext
- Subject: Re: Process exit notifcation in a kext
- From: Bogdan Harjoc <email@hidden>
- Date: Thu, 17 Jun 2010 14:05:21 +0300
On Thu, Jun 17, 2010 at 12:55 AM, Terry Lambert <email@hidden> wrote:
> On Jun 16, 2010, at 2:22 AM, Bogdan Harjoc wrote:
> Generally speaking, the kernel, including any KEXTs you write, exists to
> provide services for processes. Processes do not exist to provide
> notifications or events to the kernel.
Makes sense. Since the KEXT already depends on a daemon to filter the
events, collecting the events using kqueue would require little extra
effort, if it were reliable. But as Wade suggested, I'll just submit
an enhancement request for process startup/exit notifications.
In the mean time, I'd like to ask is this approach is correct: call
proc_find(pid) which takes a reference to the proc_t, and then
proc_rele(pid) when the exit notification from kqueue comes. This
avoids the race, but will the process exit while I am holding a
reference to it ?
> The more correct model you should probably be looking at here is to report
> the activity up to a user space monitoring process, and have user space
> aggregate that activity with the process lifecycle events for the processes
> you are monitoring -- in other words, do your work in user space, and only
> do data gathering in kernel space.
Bogdan
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden