July 2005 - Darwin-kernel - lists.apple.com

Re: User-Client for KAuth
by Jerry Cottingham 06 Jul '05

06 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

User-Client for KAuth
by kaushik 06 Jul '05

06 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: File level action protocol
by Quinn 06 Jul '05

06 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com <http://developer.apple.com/qa/qa2001/qa1242.html> Are you implying that there's no way to identify a directory entry by the handle that gets passed to a FS write call? <http://www.apple.com/support/downloads/commoncriteriatools.html> <http://www.apple.com/support/downloads/commoncriteriatoolsfor104.html> Alternatively, in kernel, you can look at the service's provided by Kauth. <http://developer.apple.com/technotes/tn2004/tn2127.html> <http://developer.apple.com/samplecode/KauthORama/KauthORama.html> S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Technical Support * Networking, Communications, Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 9:26 +0200 6/7/05, Thomas Tempelmann wrote: I've heard several times the term "stackable file system". Stackability in Mac OS X is a myth. It was part of 4.4 BSD, but it has never been properly supported in Mac OS X. There is (via the F_GETPATH selector to fcntl <x-man-page://2/fcntl>), but it's not 100% reliable. We keep track of the path that was traversed to open the file system object (including ongoing tracking of any renames along that path), but there are situations where this doesn't work. The most common one is a file that's created, opened, and then deleted. In traditional Mac OS you can't delete a file that's open, but in UNIX this is a common programming paradigm for temporary files. It's self evident that you can't get a valid path to a file descriptor (or vnode, if you're in the kernel) for a deleted file. If you just want to log file system activities, you should look at the audit support that was introduced in Mac OS X 10.3.x. Intercepting (and potentially changing) file system operations isn't something that we have a general solution for. This email sent to site_archiver(a)lists.apple.com

1 0

Re: File level action protocol
by Thomas Tempelmann 06 Jul '05

06 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Mike, thanks for your comments. >You can't "write a kext that hooks into the file system stack". The >VFS KPI >is a one-to-one contract between the kernel and a filesystem; it does >not support interposition by a third party. I've heard several times the term "stackable file system". I assumed this meant that file system calls get passed in a way that provides for filtering of them before they reach the final FS handler? >What do you mean by "got written"? Created? Modfied? >Do you want one log entry for each operation, or just a summary? One entry for each operation so that I know whenever a file gets modified. > What do you plan to do about files that move after they are opened? > Deleted after they are opened? I like to be able to record these events in my log as well. >Opened twice via different paths? Not opened by path at all? Opened >on remote filesystems without persistent IDs? Opened via context- >sensitive I only care for user-accessible files on local disks, no need for monitoring remote FSs or device drivers. >if you plan to write something that >works this closely with the system, you must understand how files >actually work. You mean, how they work in Unix. I've once written something like this for Mac OS 9. There, this was relatively easy: I would, for instance, filter the "Write" calls. Such calls would get a file handle passed, of course. I could then look up the file handler and find out which file record this write belongs to. This information was readily available thru system-provided FS-level calls. The file record would contain the name and directory node ID, which would allow me later to identify the file again. Are you implying that there's no way to identify a directory entry by the handle that gets passed to a FS write call? Probably because you can have multiple hard links to a file and thus there's no way telling which open() call (for which dir entry) did create the handle? In that case, I'd have to monitor open calls myself and build my own table to identify the handles of write calls, right? Thomas _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

File Close event - hooks
by kaushik 06 Jul '05

06 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: File level action protocol
by Mike Smith 06 Jul '05

06 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jul 5, 2005, at 1:17 PM, Thomas Tempelmann wrote: Since there seem to be a few people here knowing enough about file systems and BSD, I like to ask this rather general question: I don't have plans to work on this right now but would rather know if this is feasible at all in Tiger, and how difficult it would be. Depending on what your answers to the above were, it might be fairly easy, or quite hard. Not generally, no. It's fairly straightforward to have your non-kernel service waiting for data all the time, so you won't have to buffer all that much in-kernel (although be aware of the possibilities for endless recursion implicit in this model). = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Consider I'd want to write a service that logs the time and path (or node ID) of any file that got written. Does Tiger now provide some API that I can use from outside the kernel or would I still have to write a kext that hooks into the file system stack? You can't "write a kext that hooks into the file system stack". The VFS KPI is a one-to-one contract between the kernel and a filesystem; it does not support interposition by a third party. What do you mean by "got written"? Created? Modfied? Do you want one log entry for each operation, or just a summary? What do you plan to do about files that move after they are opened? Deleted after they are opened? Opened twice via different paths? Not opened by path at all? Opened on remote filesystems without persistent IDs? Opened via context- sensitive paths? What about device nodes? Symbolic links that change after the file is opened? Opened via relative paths? You can't approach this by halves; if you plan to write something that works this closely with the system, you must understand how files actually work. For said logging service, I'd have to have some way to store the information, i.e. eventually writing it to a file. If I'd have to write a kext - would I then be able to call the file systems below me to write to a file? If not, do I have at least virtual, dynamic, memory (i.e. a memory mapped file) so that I can at least save the data to "RAM" until a non-kernel service can pull the data out and save it "properly"? This email sent to site_archiver(a)lists.apple.com

1 0

Problem with "multiple definitions of symbol" while loading Kernel Extension
by Andrei Tchijov 05 Jul '05

05 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

File level action protocol
by Thomas Tempelmann 05 Jul '05

05 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Since there seem to be a few people here knowing enough about file systems and BSD, I like to ask this rather general question: Consider I'd want to write a service that logs the time and path (or node ID) of any file that got written. Does Tiger now provide some API that I can use from outside the kernel or would I still have to write a kext that hooks into the file system stack? I have experience writing file system level software, though (been writing DirectCD/Mac and a Joliet File System as well, both for Mac OS 9), just don't know much about the BSD stuff yet. I don't have plans to work on this right now but would rather know if this is feasible at all in Tiger, and how difficult it would be. For said logging service, I'd have to have some way to store the information, i.e. eventually writing it to a file. If I'd have to write a kext - would I then be able to call the file systems below me to write to a file? If not, do I have at least virtual, dynamic, memory (i.e. a memory mapped file) so that I can at least save the data to "RAM" until a non-kernel service can pull the data out and save it "properly"? Thomas _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: File Close Event on Mac OS X
by Mike Smith 05 Jul '05

05 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: File Close Event on Mac OS X
by Jerry Cottingham 05 Jul '05

05 Jul '05

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0