November 2003 - Darwin-kernel

Virtual memory weirdness?
by Alex Reynolds 12 Nov '03

12 Nov '03

Begin forwarded message: From: Don Berry <berry(a)sas.upenn.edu> Date: November 12, 2003 3:30:29 PM EST Subject: Virtual memory weirdness? I've been evaluating a dual processor G5, working it pretty hard for several weeks (2 x ~100% CPU jobs running all the time.) I just noticed the following virtual memory statistics: dberry% vm_stat Mach Virtual Memory Statistics: (page size of 4096 bytes) Pages free: 4799. Pages active: 140469. Pages inactive: 90789. Pages wired down: 26087. "Translation faults": -1283718751. Pages copy-on-write: 599196. Pages zero filled: -1293420378. Pages reactivated: 1004467. Pageins: 29024. Pageouts: 2675. Object cache: 325107 hits of 618313 lookups (52% hit rate) dberry% I usually only focus on the Pageouts, where are not a problem here, but notice the large negative numbers! I saw the same thing happen about 3 weeks ago, and shortly thereafter the machine began to act flaky. Rebooting removed all flakiness, but I certainly can't attribute the problem to the negative values appearing in vm_stat. It could just be the values exceeded the range expected by the vm_stat code itself and they roll over negative, but if the system itself is generating impossible numbers, it could be a sign of a deeper problem. Any thoughts? Don Berry Donald H. Berry, Professor and Undergraduate Chair Department of Chemistry University of Pennsylvania Philadelphia, PA 19104-6323 ------------------------------------------------------------------------ Alex Reynolds V: +1 215 573.2818 Senior IT Specialist F: +1 215 898.8780 15 Mudd Building / 6013 E: mailto:reynolda@sas.upenn.edu Department of Biology W: http://www.bio.upenn.edu/computing/ University of Pennsylvania Philadelphia, PA 19104 _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Kernel Extension
by Shawn Erickson 12 Nov '03

12 Nov '03

On Nov 11, 2003, at 10:04 PM, Matt Jaffa wrote: The Problem with a web proxy is all you have to change the web proxy settings around and disable the blocks on the other ips and ports. Yes the people who use these computers will have sudo access, but if I design my app, then it will be able to have a non-sudo password associated with it, that they will create when installing my app. I think you missed my point... you only allow web access out of your company via the web proxy. You configure nothing other then on the client computers other then the proxy. If they screw with that they simply cannot get out because you have firewall things off at your network edge. -Shawn _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Kernel Extension
by Matt Jaffa 12 Nov '03

12 Nov '03

And another thing, I want the users of the computer to be able to still use the Apple built in firewall, but if my program messes around with the ipfw command, it makes it so that the apple's built in firewall wont work. the way little snitch does it is perfect, somehow they accomplish this without messing with ipfw I think then I must do a KEXt that wraps around the IONetworkFamily.kext, or something to that affect Matt On Nov 11, 2003, at 9:40 PM, Shawn Erickson wrote: On Nov 11, 2003, at 7:05 PM, Matt Jaffa wrote: Do I really need to use Sockets and everything, All I want to do is have it where someone types in an internet address in any web browser on the computer, my app that is running behind the scenes will intercept any of those requests, and then if that address is in this database we have it will allow them to go there. At work we are just making this app to restrict others only to work related sites, so I quickly just want to make this thing. I just need to know how little snitch, intercepts the http(port 80) request and then after allowing it, the web browser shows it. What you want can more easily and reliably done by using a web proxy with filter abilities and blocking all http ports in and out except for the web proxy. This is normal way this type of thing is done. Dropping an KEXT is really the wrong way to go about this... -Shawn _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored. _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Kernel Extension
by Matt Jaffa 12 Nov '03

12 Nov '03

The Problem with a web proxy is all you have to change the web proxy settings around and disable the blocks on the other ips and ports. Yes the people who use these computers will have sudo access, but if I design my app, then it will be able to have a non-sudo password associated with it, that they will create when installing my app. - Matt On Nov 11, 2003, at 9:40 PM, Shawn Erickson wrote: On Nov 11, 2003, at 7:05 PM, Matt Jaffa wrote: Do I really need to use Sockets and everything, All I want to do is have it where someone types in an internet address in any web browser on the computer, my app that is running behind the scenes will intercept any of those requests, and then if that address is in this database we have it will allow them to go there. At work we are just making this app to restrict others only to work related sites, so I quickly just want to make this thing. I just need to know how little snitch, intercepts the http(port 80) request and then after allowing it, the web browser shows it. What you want can more easily and reliably done by using a web proxy with filter abilities and blocking all http ports in and out except for the web proxy. This is normal way this type of thing is done. Dropping an KEXT is really the wrong way to go about this... -Shawn _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored. _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Kernel Extension
by Shawn Erickson 12 Nov '03

12 Nov '03

On Nov 11, 2003, at 7:05 PM, Matt Jaffa wrote: Do I really need to use Sockets and everything, All I want to do is have it where someone types in an internet address in any web browser on the computer, my app that is running behind the scenes will intercept any of those requests, and then if that address is in this database we have it will allow them to go there. At work we are just making this app to restrict others only to work related sites, so I quickly just want to make this thing. I just need to know how little snitch, intercepts the http(port 80) request and then after allowing it, the web browser shows it. What you want can more easily and reliably done by using a web proxy with filter abilities and blocking all http ports in and out except for the web proxy. This is normal way this type of thing is done. Dropping an KEXT is really the wrong way to go about this... -Shawn _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Kernel Extension
by Matt Jaffa 12 Nov '03

12 Nov '03

Do I really need to use Sockets and everything, All I want to do is have it where someone types in an internet address in any web browser on the computer, my app that is running behind the scenes will intercept any of those requests, and then if that address is in this database we have it will allow them to go there. At work we are just making this app to restrict others only to work related sites, so I quickly just want to make this thing. I just need to know how little snitch, intercepts the http(port 80) request and then after allowing it, the web browser shows it. Matt On Nov 11, 2003, at 4:56 PM, Koryn Grant wrote: If you're reasonably comfortable with sockets programming then what you describe can be done using a divert socket and the ipfw firewall (with no need for a kernel extension). Read 'man divert' and 'man ipfw' for more information. As an added bonus you should be able to put much of the packet selection logic into an ipfw rule and only receive packets that your application is likely to find interesting. Koryn On Tue, 11 Nov 2003, Matt Jaffa wrote: Hello, I am very interested in writing this application that intercepts all packets sent and receive from an apple machine. I am sure you have heard of an App called, Little Snitch, well I want to write something similar but totally different. I want to intercept all but really only going to filter one type. So how would I get started on this, Im sure i need to use .kext s but dont know where to start. thanks, Matt _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored. _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Re: Kernel Extension
by Koryn Grant 11 Nov '03

11 Nov '03

If you're reasonably comfortable with sockets programming then what you describe can be done using a divert socket and the ipfw firewall (with no need for a kernel extension). Read 'man divert' and 'man ipfw' for more information. As an added bonus you should be able to put much of the packet selection logic into an ipfw rule and only receive packets that your application is likely to find interesting. Koryn On Tue, 11 Nov 2003, Matt Jaffa wrote: > Hello, > > I am very interested in writing this application that intercepts all > packets sent and receive from an apple machine. I am sure you have > heard of an App called, Little Snitch, well I want to write something > similar but totally different. I want to intercept all but really only > going to filter one type. > So how would I get started on this, Im sure i need to use .kext s but > dont know where to start. > > thanks, > Matt _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Kernel Extension
by Matt Jaffa 11 Nov '03

11 Nov '03

Hello, I am very interested in writing this application that intercepts all packets sent and receive from an apple machine. I am sure you have heard of an App called, Little Snitch, well I want to write something similar but totally different. I want to intercept all but really only going to filter one type. So how would I get started on this, Im sure i need to use .kext s but dont know where to start. thanks, Matt _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

Operating Systems Research Engineers
by George Lindner 11 Nov '03

11 Nov '03

The Most Prestigious Communications Lab in Silicon Valley, CA currently has tremendous employment opportunities available. They are currently looking for individuals to join their Operating Systems Group. Please review the description and if you are interested in exploring these opportunities further please forward me a copy of your resume in Microsoft Word format and provide me with a convenient time to follow up with you or if you may know of any individuals who may be in the market for a similar opportunity please feel free to forward them my contact information. My firm does offer referral bonuses for any assistance in locating qualified individuals for our client's needs that are hired. I would much rather work with an individual with industry experience and knowledge then rely on a job posting and I thought that with you may have industry connections or associates that may be exploring opportunities at this time. The opportunities below are immediate needs so your timely response is necessary and would be greatly appreciated. I would like to thank you in advance for any assistance you may be able to provide me with and I look forward to speaking with you or any referral you may have soon. 1. Operating system Researcher (Scheduling and Process Management) The Communications Laboratory is searching for a researcher with expertise in operating system process management and scheduling. The qualified individual should have a PhD in computer science or engineering, should have at least 3 years experience as a researcher in industry. Experience with aspects of mobile computing and concepts such as operating system extensibility an added plus. The individual will part of a larger operating systems team and will lead research in the area of scheduling, process management, and network communications. Experience with Linux an added plus. 2. Operating System Researcher (Kernel Design and Implementation) The Communications Laboratory is searching for a researcher with expertise in operating system kernels. The qualified individual should have a PhD in computer science or engineering, should have at least 3 years experience as a researcher in industry. Experience with aspects of mobile computing and concepts such as operating system extensibility an added plus. The individual will part of a larger operating systems team and will lead research in the area of kernel design. Experience with Linux an added plus. 3. Operating System Researcher (File Systems and Storage Management) The Communications Laboratory is searching for a researcher with expertise in operating system with particular focus on file systems and storage management. The qualified individual should have a PhD in computer science or engineering, should have at least 3 years experience as a researcher in industry. Experience with aspects of mobile computing and concepts such as operating system extensibility an added plus. The individual will part of a larger operating systems team and will lead research in the area of file systems and storage management. Experience with Linux an added plus. George Lindner Valoure Staffing Specialists Sr. Recruitment Coordinator Direct: 818.784.8302 Main: 818.784.8635 Fax: 818.784.9011 glindner(a)valoure.com <http://www.valoure.com/> www.valoure.com ************************************************************************ Please Note The information in this E-mail message is legally privileged and confidential information intended only for the use of the individual(s) named above. If you, the reader of this message, are not the intended recipient, you are hereby notified that you should not further disseminate, distribute, or forward this E-mail message. If you have received this E-mail in error, please notify the sender. Thank you ************************************************************************ _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0

exporting multiple directories on the same filesystem
by Robert Minsk 10 Nov '03

10 Nov '03

Sorry for cross posting this on drawinos-users. I was not on the darwin-kernel list as of yet. I'm running Mac OS X 10.3. My /etc/exports looks like: /Users -maproot=nobody /Library/NetBoot/NetBootSP0 -ro When I restart mountd I get: Nov 7 19:45:08 ignatz mountd[3426]: Can't change attributes for /Library/NetBoot/NetBootSP0. See 'exports' man page. Nov 7 19:45:08 ignatz mountd[3426]: Bad exports list line /Library/NetBoot/NetBootSP0 -ro If I change the order of the lines in the exports file then /Users has a problem. If /Library/NetBoot/NetBootSP0 is on a different filesystem I have no problem. The man page for exports has the following bug: The export options are tied to the local mount points in the kernel and must be non-contradictory for any exported subdirectory of the local server mount point. It is recommended that all exported directories within the same server filesystem be specified on adjacent lines going down the tree. I'm not quite sure how to interpret this bug. Does it say I can not use different options for directories exported from the same filesystem? How can I solve this export problem? This seems like a serious limitation, is this being addressed anytime soon? _______________________________________________ darwin-kernel mailing list | darwin-kernel(a)lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.

1 0