site_archiver@lists.apple.com Delivered-To: darwin-dev@lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:date:message-id:subject :from:to:content-type; bh=evXLtzWqNByt6d7rXxzM+KfUH7EyBRI68OcQUNYLdnE=; b=cU5uwc4Hu1U2qNglJJIFEaEGBLJOoRbYqjLzbOqbBZKo5zU3HdSpJUtV2AKxQ49dzi KfH4Y2NaGdNOMqHlOpwPiypeEvXWropZlKy2JpeqoZkySaL+e/ysilitc8ADfi5NWe30 ZNEXKDDHxO1UoD5L8v9uSasGYGgElFNJWbgAM= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=fPKbSrs8JqoGeTQR3tSDxnGa9uVCkLohx1HkO+XfLnOW4TzSrPSSbsd8zScIFopXhD uRcbC863jIciZO4VDiSioMSbpcbpmR68t4WxpzarMqiReREuc35hrXxMlVrII2e8ld0A bvjUD8uqmS9fNAavdXMQHDWvtkfkYekSjipK0= I want to track forked children of a given pid. For the purpose of this discussion, I am userspace code (I could be kernelspace code if it helped) Best bet would seem to be NOTE_FORK kevents. I can't have NOTE_CHILD or use NOTE_TRACK, as I get ENOTSUP. I have no visibility into it, but this list from 2007 suggests that's rdar://problem/3439519 Ok, fine. NOTE_FORK gets OR'd with the child pid, right? kern_exec.c: proc_knote(p->p_pptr, NOTE_FORK | p->p_pid); kern_fork.c: proc_knote(parent_proc, NOTE_FORK | child_proc->p_pid); kern_fork.c: proc_knote(parent_proc, NOTE_FORK | child_proc->p_pid); So I'd expect: event[0].filter = EVFILT_PROC; event[0].flags = EV_ADD | EV_ENABLE; event[0].fflags = NOTE_EXIT | NOTE_FORK | NOTE_EXEC; kevent(kq, NULL, 0, event, 1, NULL); to give me a child in a NOTE_FORK Instead, event[0].data is unset, and event[0].fflags is *solely* NOTE_FORK. I can see nowhere in the kernel where NOTE_PDATAMASK is masked off. If I can really not have this, Launchd seems to use a sysctl to enumerate children on a fork: int mib[] = { CTL_KERN, KERN_PROC, KERN_PROC_ALL, j->p }; (KERN_PROC_PPID seems to not be implemented in xnu-1456.1.26) Am I really reduced to this? It seems very likely to be racy. -- Derrick _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-dev mailing list (Darwin-dev@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-dev/site_archiver%40lists.appl... This email sent to site_archiver@lists.apple.com