October 2006 - Darwin-kernel

Re: Getting the current PID inside kext?
by Terry Lambert 31 Oct '06

31 Oct '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Oct 31, 2006, at 2:08 AM, Quinn wrote: -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 21:00 -0800 30/10/06, Rick Mann wrote: Can I use <sys/proc.h> and extern_proc with current_proc() to get at the pid? You can use a variety of different routines from <sys/proc.h> in the Kernel framework. For example proc_selfpid() or proc_pid(proc_self ()). I should caution you that there are circumstances when this won't yield the results you're expecting. For example [2], if you did this on the read/write path of an asynchronous I/O, you might find that proc_self() isn't the process that originally issued the I/O (it's the process that happened to be around when the I/O started). That's the reason why the VFS KPI has a separate vfs_context_t parameter, from which you can derive the original process. For the most part, the interesting thing is the blocking context, which is the kernel thread, rather than the proc (see bsd/kern/ kern_synch.c). Other than using the proc data for informational purposes (e.g. for displaying debugging information, such as the name or pid of a process that's calling your code), the proc is generally not as useful as you might think. Some parts can only be safely accessed under the proc_lock, proc_fdlock, or the kernel funnel (like everything to do with signals, creation, and deletion), or by taking a reference on it (which you'd need to later drop), so you need to be careful when referencing its contents to avoid it exiting out from under you. If *that* happens, you are a pointer dereference away from a kernel panic. This email sent to site_archiver(a)lists.apple.com

1 0

.dmg mounting and unmounting and kauth FILEOP actions
by Rick Mann 31 Oct '06

31 Oct '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Can anyone shed some light on this? Thanks! -- Rick _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Not sure if this is the right list for this question, but I couldn't think of a better one. I have a kauth listener listening for FILEOP open and close actions. If I UNmount a disk image (.dmg file), I get a CLOSE action from diskimages-helper, but no corresponding OPEN action from any process. Obviously I don't understand everything that's going on when an image gets mounted. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Determining volume for a vnode inside a kauth listener?
by Michael Smith 31 Oct '06

31 Oct '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Rick, Please do us all a favour and look at the headers/source. Really. 8) On Oct 31, 2006, at 10:30 AM, Rick Mann wrote: = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Is there a way to quickly determine the volume for a given vnode inside a kauth listener? I'm about to look at the source, but maybe someone can point me in the right direction (or confirm what I find). I'm hoping to find some kind of integer ID value, representing the volume for a particular vnode, that I can squirrel away whenever a FILEOP kauth request comes in. In order to keep my kauth listener as fast as possible, I'd like to avoid string operations, including comparisons, as much as possible. vnode_mount() will give you the mount_t representing the mounted filesystem that the vnode is a member of. This isn't directly useful other than in grouping vnode_t's together. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Any way to get PID of kauth FILEOP auth requestor?
by Rick Mann 31 Oct '06

31 Oct '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Oct 31, 2006, at 02:11 , Quinn wrote: -- Rick _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… For the fileop scope, you are guaranteed that the current process is valid. Thus, you can get this using proc_selfpid. To understand this better, you might want to read the "Context" section of Technote 2127 "Kernel Authorization". <http://developer.apple.com/technotes/tn2005/tn2127.html> Thank you, Quinn. This was exactly what I was looking for. And thanks for the other email with the excellent description of the very confusing multitude of headers. That cleared things up nicely. I'm only using the process name info I get for debugging purposes. The PID is really what I wanted. This email sent to site_archiver(a)lists.apple.com

1 0

Determining volume for a vnode inside a kauth listener?
by Rick Mann 31 Oct '06

31 Oct '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com TIA, -- Rick _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Is there a way to quickly determine the volume for a given vnode inside a kauth listener? I'm about to look at the source, but maybe someone can point me in the right direction (or confirm what I find). I'm hoping to find some kind of integer ID value, representing the volume for a particular vnode, that I can squirrel away whenever a FILEOP kauth request comes in. In order to keep my kauth listener as fast as possible, I'd like to avoid string operations, including comparisons, as much as possible. All I need to do is determine which volume holds a vnode, and then store off a little data in a private data structure for it. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Process name from PID inside kernel?
by Andrew Gallatin 31 Oct '06

31 Oct '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Rick Mann writes: > I found a hacked way to get the PID inside my kext, which is fragile, > but works for now. Now I'd like to get the name of that process. I've You want proc_selfname() if it is the current process, otherwise proc_name().. Drew _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Getting the current PID inside kext?
by Andrew Gallatin 31 Oct '06

31 Oct '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Rick Mann writes: > getpid() doesn't seem to be available to a kext (I try to include > <unistd.h> but it fails). > > Can I use <sys/proc.h> and extern_proc with current_proc() to get at > the pid? Close. Use proc_selfpid() from sys/proc.h, there is no need to look at the proc struct. The proc_* KPI accessors access the proc structure for you, so that the kernel developers are free to change its layout without breaking kernel extensions. Drew _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Any way to get PID of kauth FILEOP auth requestor?
by Quinn 31 Oct '06

31 Oct '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com <http://developer.apple.com/technotes/tn2005/tn2127.html> S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 19:59 -0800 30/10/06, Rick Mann wrote: Is there any way to get the process ID of of the process attempting to conduct a FILEOP from within the kauth listener? For the fileop scope, you are guaranteed that the current process is valid. Thus, you can get this using proc_selfpid. To understand this better, you might want to read the "Context" section of Technote 2127 "Kernel Authorization". This email sent to site_archiver(a)lists.apple.com

1 0

Re: Getting the current PID inside kext?
by Quinn 31 Oct '06

31 Oct '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Indeed. There are *three* versions of each of the kernel-level headers: * * * * * * And back to your original question... S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware At 21:19 -0800 30/10/06, Rick Mann wrote: This document seems to indicate that sys is available, but when I include <sys/proc.h>, struct extern_proc does not get declared. I can't seem to figure out why not, except perhaps the compiler is including a different file than Command-D is opening up for me. 1. There's the original version in the kernel source code. You can get this from Darwin. This is the version from which the others are derived. 2. There's a user space version in "/usr/include". This has all of the kernel-only stuff preprocessed out. 3. There's a version for third party kernel development in the Kernel framework ("/System/Library/Frameworks/Kernel.framework/Headers"). This has all of the user space stuff preprocessed out. Both 2 and 3 also have all of the implementation details preprocessed out. So, for example, within the kernel we want you to treat the process object as opaque, and thus the <sys/proc.h> in the Kernel framework doesn't have the definition for (struct proc) [1]. The key point here is that, if you're writing code that you want to be binary compatible with future systems, you should only use declarations from 2 or 3 (for user space and kernel code, respectively). These are the things that Apple considers to be API/KPI. When you create a KEXT project in Xcode, Xcode passes magic options to GCC to disable the automatic search of "/usr/include" and to instead search the Kernel framework. And yes, Xcode does have a habit of showing you the wrong file when you use Open Quickly. When doing kernel development, I generally add the Kernel framework to my project, disclose the header list, and type select the relevant header. At 21:00 -0800 30/10/06, Rick Mann wrote: Can I use <sys/proc.h> and extern_proc with current_proc() to get at the pid? You can use a variety of different routines from <sys/proc.h> in the Kernel framework. For example proc_selfpid() or proc_pid(proc_self()). I should caution you that there are circumstances when this won't yield the results you're expecting. For example [2], if you did this on the read/write path of an asynchronous I/O, you might find that proc_self() isn't the process that originally issued the I/O (it's the process that happened to be around when the I/O started). That's the reason why the VFS KPI has a separate vfs_context_t parameter, from which you can derive the original process. [1] This is a simplification. In fact, most of the truly internal stuff has moved to a parallel header. So (struct proc) is actually defined in <sys/proc_internal.h>. [2] With apologies to the /real/ kernel engineers on the list, who know how this stuff actually works. I'm trying to make a pedagogic point here (-: _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Process name from PID inside kernel?
by Quinn 31 Oct '06

31 Oct '06

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com <http://developer.apple.com/technotes/tn2005/tn2083.html> S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 0:52 -0800 31/10/06, Rick Mann wrote: I've been looking through the KPI, and I'm not having a lot of luck. This is the subject of a long-standing enhancement request <rdar://problem/4488658>. You're unlikely to get this as a KPI, however. In general I recommend that you bounce this sort of activity out to user space. I found a hacked way to get the PID inside my kext, which is fragile, but works for now. Now I'd like to get the name of that process. I've actually got access to the executable's vnode, but I can't figure out how to get the filename from the vnode from within the kernel. This would be sufficient for now. If you have the executable's vnode (which is a feat in itself), you can get the path using vn_getpath. >From here it all depends on what you mean by "process name". Mac OS X has at least two "process name" concepts. o At the BSD level, there is the name shown by "ps". This is simply the last component of the executable's path. o At the GUI framework level, there is the name shown in the menu bar (and by the Dock). This is only available via Process Manager (and stuff, like NSWorkspace, layered on top of the Process Manager). If you have a PID, you can map it to a PSN (using GetProcessForPID) and then get the name from the PSN (using CopyProcessName). The gotcha is the Process Manager is part of ApplicationServices layer, so you can only call it from within a GUI context. The implications of this are covered by DTS Technote 2083 "Daemons and Agents". There is another long-standing enhancement request for pushing Process Manager (well, an API like Process Manager) down to the CoreServices level. This email sent to site_archiver(a)lists.apple.com

1 0