February 2005 - Darwin-kernel

Re: Get socket creator (ie: PID & UID)
by Peter Lovell 20 Feb '05

20 Feb '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com You'll find the definition of struct proc in <sys/proc.h> You code for pid will be something like the_pid = current_proc()->p_pid; On Feb 20, 2005, at 7:38 AM, Vincent Pottier wrote: On 19 févr. 05, at 18:38, Peter Lovell wrote: On Feb 19, 2005, at 12:15 PM, Vincent Pottier wrote: Hi folks, Does someone can explain me how to use it? Thanks in advance, Hi Vincent, the definition is in <sys/vm.h> (in Kernel.framework) ... struct proc *current_proc(void); _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Thanks a lot Peter, it work just fine, but I can't find the struct architecture, I've search through the web and in the Header file, but can't find the struct references, I've try with p_pid for the PID (and other few things) , but I always get an error. Can someone tell me where to find this struct references (or find documentation about current_proc)? Thanks in advance, Vincent I've the tcplogger sample code and I would like to get the socket creator PID and UID. After a few search, It looks that I can get it via current_proc() called on socreate time. But this feature is disable in the sample I have and I get an error when using it. (warning: implicit declaration of function 'current_proc'). I've already try to #include some object but can't make it work. Vincent The struct is subject to change of course, but if you're working with tcplogger then you already know that. Regards.....Peter This email sent to site_archiver(a)lists.apple.com

1 0

Re: Get socket creator (ie: PID & UID)
by Vincent Pottier 20 Feb '05

20 Feb '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 19 févr. 05, at 18:38, Peter Lovell wrote: On Feb 19, 2005, at 12:15 PM, Vincent Pottier wrote: Hi folks, Does someone can explain me how to use it? Thanks in advance, Hi Vincent, the definition is in <sys/vm.h> (in Kernel.framework) ... struct proc *current_proc(void); _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Thanks a lot Peter, it work just fine, but I can't find the struct architecture, I've search through the web and in the Header file, but can't find the struct references, I've try with p_pid for the PID (and other few things) , but I always get an error. Can someone tell me where to find this struct references (or find documentation about current_proc)? Thanks in advance, Vincent I've the tcplogger sample code and I would like to get the socket creator PID and UID. After a few search, It looks that I can get it via current_proc() called on socreate time. But this feature is disable in the sample I have and I get an error when using it. (warning: implicit declaration of function 'current_proc'). I've already try to #include some object but can't make it work. Vincent The struct is subject to change of course, but if you're working with tcplogger then you already know that. Regards.....Peter This email sent to site_archiver(a)lists.apple.com

1 0

Re: Get socket creator (ie: PID & UID)
by Peter Lovell 19 Feb '05

19 Feb '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Feb 19, 2005, at 12:15 PM, Vincent Pottier wrote: Hi folks, Does someone can explain me how to use it? Thanks in advance, Hi Vincent, the definition is in <sys/vm.h> (in Kernel.framework) ... struct proc *current_proc(void); Regards.....Peter _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I've the tcplogger sample code and I would like to get the socket creator PID and UID. After a few search, It looks that I can get it via current_proc() called on socreate time. But this feature is disable in the sample I have and I get an error when using it. (warning: implicit declaration of function 'current_proc'). I've already try to #include some object but can't make it work. Vincent The struct is subject to change of course, but if you're working with tcplogger then you already know that. This email sent to site_archiver(a)lists.apple.com

1 0

Get socket creator (ie: PID & UID)
by Vincent Pottier 19 Feb '05

19 Feb '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: AppleLMUController & powerbook keyboard illumination in 10.3.8
by Rohan Lloyd 18 Feb '05

18 Feb '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 18 Feb 2005, at 2:19 PM, Emory Smith wrote: hello, Probably not, but here goes... Yep, I've seen that too. -- Rohan Lloyd _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… not sure if this is the right place to ask about this ... Note: Cross posting to darwin-drivers removed since I don't subscribe to it. since installing os 10.3.8 on my powerbook (17in g4), ive been getting hundreds of lines in my /var/log/system.log file that look like the following snippet: Feb 17 19:29:34 localhost kernel: AppleLMUController: setLEDFade - Fade to brightness level: 0x00000000. Feb 17 19:29:34 localhost kernel: AppleLMUController: setLEDFade - Fade to brightness level: 0x000001B1. Feb 17 19:29:34 localhost kernel: AppleLMUController: kbdFadeTimerAction. I raised a bug (#4002245) about it the day after 10.3.8 was released, and it was closed as a duplicate. So Apple knows about it! Since then I have also noticed that the light sensors seems to be much more sensitive, and have less hysteresis. This means that sometimes just by moving my hands over the keyboard as I type can be enough to trigger changes in the brightness of the screen. This gets VERY annoying. This email sent to site_archiver(a)lists.apple.com

1 0

AppleLMUController & powerbook keyboard illumination in 10.3.8
by Emory Smith 18 Feb '05

18 Feb '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=beta; d=gmail.com; h=received:mime-version:content-transfer-encoding:message-id:content-type:to:from:subject:date:x-mailer; b=IN+kP0viX02fB15hv4lHoM9Ht9HeIqSirO1YKEoIs/GtVHlBzH8T5uVm81TUsyqPx6AqoL7ENiCBzXg46QHPxM1QX3MkIXoQHeqJrHfMrRjHaDp/H7h7OruIdthfvb2fWEF1JscIwWAHhbgGrhgql6plx2Glmmf6huRPuASmIug= hello, not sure if this is the right place to ask about this ... this happens over and over but stops instantly if i thanks, emory _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… since installing os 10.3.8 on my powerbook (17in g4), ive been getting hundreds of lines in my /var/log/system.log file that look like the following snippet: Feb 17 19:29:34 localhost kernel: AppleLMUController: setLEDFade - Fade to brightness level: 0x00000000. Feb 17 19:29:34 localhost kernel: AppleLMUController: setLEDFade - Fade to brightness level: 0x000001B1. Feb 17 19:29:34 localhost kernel: AppleLMUController: kbdFadeTimerAction. Feb 17 19:29:34 localhost kernel: AppleLMUController: setLEDBrightness - Brightness level requested at: 0x00000056. Feb 17 19:29:34 localhost kernel: AppleLMUController: kbdFadeTimerAction. Feb 17 19:29:34 localhost kernel: AppleLMUController: setLEDBrightness - Brightness level requested at: 0x00000081. Feb 17 19:29:34 localhost kernel: AppleLMUController: kbdFadeTimerAction. Feb 17 19:29:34 localhost kernel: AppleLMUController: setLEDBrightness - Brightness level requested at: 0x000000AC. Feb 17 19:29:34 localhost kernel: AppleLMUController: kbdFadeTimerAction. Feb 17 19:29:34 localhost kernel: AppleLMUController: setLEDBrightness - Brightness level requested at: 0x000000D7. Feb 17 19:29:34 localhost kernel: AppleLMUController: kbdFadeTimerAction. Feb 17 19:29:34 localhost kernel: AppleLMUController: setLEDBrightness - Brightness level requested at: 0x00000102. Feb 17 19:29:34 localhost kernel: AppleLMUController: kbdFadeTimerAction. Feb 17 19:29:34 localhost kernel: AppleLMUController: setLEDBrightness - Brightness level requested at: 0x0000012D. Feb 17 19:29:34 localhost kernel: AppleLMUController: kbdFadeTimerAction. Feb 17 19:29:34 localhost kernel: AppleLMUController: setLEDBrightness - Brightness level requested at: 0x00000158. Feb 17 19:29:34 localhost kernel: AppleLMUController: kbdFadeTimerAction. 1. disable keyboard illumination in system preferences, or 2. cover up the powerbook speakers/light sensors (or just maintain steady light level in the room) just wondering if anyone knew anything about this, and whether it might be an indication of a problem with my computer ... This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel extensions and code injection?
by Brian Kendall 17 Feb '05

17 Feb '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Organization: Qrrbrbirlbel User-agent: Opera M2(BETA1)/8.0 (MacPPC, build 1945) - Brian My $0.02. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… As I understand it, the only thing that comes close in userland (meaning you wouldn't need to be root or admin to do it) is you can install an event handler on the event monitor target, which was new to Panther. However, it only lets you receive and monitor events (and not intercept events), and in the case of privacy concerns, any key event typed in a password text field is not sent to the event monitor, so it's more or less useless for spyware stuff. (Although, now that I think about it, being able to intercept mouse events wouldn't that useful for spyware either. If the idea is to take control of the mouse, there's ways to do that already incidentally. Fortunately no one has written anything malicious using it that I know of.) I don't have a solution or even any real data for TOP, but I would like to inject a comment into the discussion. I certainly hope that if there is a way to do this _without_ installing a kernel extension that it operates in a secure manner. I should have to authenticate as an admin on the system to get such a thing installed even when running under and admin account. Otherwise this would be an obvious path to bring all manner of spyware to the platform. -Mike This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel extensions and code injection?
by Michael Cashwell 17 Feb '05

17 Feb '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Feb 16, 2005, at 11:06 PM, bjk02(a)hampshire.edu wrote: My $0.02. -Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I've been working on a kernel extension that adds functionality to the IOHIDSystem class. Specifically, I want to be able to intercept mouse and keyboard events, manipulate specific events, and then pass them along. The point of doing this in a kernel extension is so that I can do this before the events arrive at the target application. (Incidentally, if there is a way to do this without writing a kernel extension, perhaps at the point where the window server receives the events, please do tell! AFAIK, though, there isn't.) I don't have a solution or even any real data for TOP, but I would like to inject a comment into the discussion. I certainly hope that if there is a way to do this _without_ installing a kernel extension that it operates in a secure manner. I should have to authenticate as an admin on the system to get such a thing installed even when running under and admin account. Otherwise this would be an obvious path to bring all manner of spyware to the platform. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Callback from NKE
by Peter Lovell 17 Feb '05

17 Feb '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Feb 17, 2005, at 12:38 PM, Justin Walker wrote: Hi justin, thanks for the update -- it is there, as you said. Cheers.....Peter _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… The www.kohala.com website is no longer active; the example code is now available at www.unpbook.com Stevens's website is still there, and still provides code and errata that goes with the appropriate versions of his books. The 'unpbook' site is solely for the "V13e" book. I mention this for the benefit of the odd member of posterity who happens by. I did look for it several weeks ago (being at home with only 2nd edition, and memory having given out on the website address for 3rd edition) and it was not there at that time. A brief outage, I would have to surmise. The third edition, to my mind, retains the Stevens "essence" and is a worthy revision. The changes in the core/traditional area are not extensive, but there's a lot of coverage of new things too such as IPv6 etc. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Callback from NKE
by Justin Walker 17 Feb '05

17 Feb '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hi, Peter, On Feb 17, 2005, at 9:25, Peter Lovell wrote: That's good to know; I have not looked at it at all. Cheers, Justin _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Feb 17, 2005, at 12:08 PM, Justin Walker wrote: Notable among them is W. Richard Stevens's "Unix Network Programming" (v. 1, 2nd ed). There is a third edition by a different author, and I'm not familiar with that. The third edition (Stevens/Fenner/Rodoff) continues the same high standard. The www.kohala.com website is no longer active; the example code is now available at www.unpbook.com Stevens's website is still there, and still provides code and errata that goes with the appropriate versions of his books. The 'unpbook' site is solely for the "V13e" book. I mention this for the benefit of the odd member of posterity who happens by. -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | It's not whether you win or lose... | It's whether *I* win or lose. *--------------------------------------*-------------------------------* This email sent to site_archiver(a)lists.apple.com

1 0