June 2007 - Darwin-kernel - lists.apple.com

Re: Using KAuth for Monitoring File Operations
by Amanda Walker 15 Jun '07

15 Jun '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com --Amanda _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Jun 15, 2007, at 9:45 AM, Michael Smith wrote: If your product's aim is to have a complete backup copy of everything, then you are better off waiting in the FILEOP scope for last-close notifications with the modified flag set. This gives you both the indication that the file is not being modified, and an indication that it previously has been. Right--but this is doing the copy after each modification (so you'll have it already saved away when the next modification happens), not on-demand just before the change, which is what Yogesh was asking for. But you're quite right--if you're willing to do "backup just after each change" instead of "backup just before each change", hooking FILEOP scope in a Kauth module works very well. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Using KAuth for Monitoring File Operations
by Michael Smith 15 Jun '07

15 Jun '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jun 15, 2007, at 6:59 AM, Amanda Walker wrote: Hang a sec there, Amanda. That being said, let's try to set you on a right path. What do you define as "modified"? You have a couple of problems here; = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Jun 15, 2007, at 4:05 AM, Yogesh Kulkarni wrote: The application i am currently working on needs to do simple Copy- On-Write mechanism by which i will be able to take the backup of those files which are going to be modified. So, i am more interested in getting the event before the read/write operation on particular file or before the data gets modified for the file. But currently KAuth is giving event to my user space application after the file data gets modified because of this i am not able to get the previous state of that file for achieving Copy-On- Write mechanism. My main aim is to keep the previous state of the file to some other location before modified data gets written to that file. This is not going to be possible with Kauth, since a Kauth module gets notified after the I/O operation is already underway. You can deny the operation, but you can't interpose user space processing in between seeing the request and either denying it or letting it proceed. Firstly Yogesh, you should check with your co-workers, or perhaps whoever had this project last; I think we were last talking about this late in April with Shailesh Parulekar, and I'm sure I've answered these questions at least once before that. In the most simplistic case, you can hook the VNODE scope, and any time an operation goes past that looks like it might be requesting the right to alter a file, consider the file to be potentially about to be modified. - You have no idea whether the file will actually be modified, or whether permission will even be granted to modify the file, just because you have seen a request to be granted permission to modify go past. - The file may already be open, meaning that if you back it up and overwrite a previous version, you may end up saving a version with partial changes. If your product's aim is to have a complete backup copy of everything, then you are better off waiting in the FILEOP scope for last-close notifications with the modified flag set. This gives you both the indication that the file is not being modified, and an indication that it previously has been. All of this leaves the issue of metadata changes completely up in the air. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Using KAuth for Monitoring File Operations
by Amanda Walker 15 Jun '07

15 Jun '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Amanda Walker _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Jun 15, 2007, at 4:05 AM, Yogesh Kulkarni wrote: The application i am currently working on needs to do simple Copy- On-Write mechanism by which i will be able to take the backup of those files which are going to be modified. So, i am more interested in getting the event before the read/write operation on particular file or before the data gets modified for the file. But currently KAuth is giving event to my user space application after the file data gets modified because of this i am not able to get the previous state of that file for achieving Copy-On- Write mechanism. My main aim is to keep the previous state of the file to some other location before modified data gets written to that file. This is not going to be possible with Kauth, since a Kauth module gets notified after the I/O operation is already underway. You can deny the operation, but you can't interpose user space processing in between seeing the request and either denying it or letting it proceed. This email sent to site_archiver(a)lists.apple.com

1 0

RE: Using KAuth for Monitoring File Operations
by Yogesh Kulkarni 15 Jun '07

15 Jun '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Using KAuth for Monitoring File Operations
by Michael Smith 15 Jun '07

15 Jun '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jun 15, 2007, at 2:59 AM, Yogesh Kulkarni wrote: This is the behaviour as defined for the KAUTH_FILEOP scope. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… I am writing a kext module which monitors file system activities and generates events, by taking help of 'Sample Code Project KauthOrRama' in Technical Note 2127 for Kernel Authorization. But KAuth is generating event after the action (e.g. READ / WRITE) takes place on the file. In our Application, we require that event should be generated before the actual action on the file is performed. Your KAUTH plugin can elect to participate in the authorisation phase by registering in the KAUTH_VNODE scope, however it is important to note that you may see operations that are not performed (due to another participant refusing the operation). There are also operations which are not authorised, in which case you won't see them at all. Is it possible with Kauth ? If not, what are the other ways of doing the same ? The fact that you care about being notified before the operation suggests that you have some desire to refuse, modify or defer some operations. Is this the case? If you can explain some more about your Application, we may be able to help you further. This email sent to site_archiver(a)lists.apple.com

1 0

Using KAuth for Monitoring File Operations
by Yogesh Kulkarni 15 Jun '07

15 Jun '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Won't Load If Start Code Tries to Attach and Register?
by Michael Smith 13 Jun '07

13 Jun '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Jun 12, 2007, at 7:14 PM, Godfrey van der Linden wrote: = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… As Mike surmised you may be tripping over a recursive match. You are probably going to match on your self as you are publishing an IOMedia object and matching on them too, I can't see anyway of breaking out of the recursion (except for the Physical.* tags in the matching dictionary, but I'm not familiar with IOMedia matching so an expert will need to comment). For a trivial model like this one, the easiest thing to do is simply walk the parent chain looking for previous instances of your class; you can just brute-force it with OSDynamicCast. This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Won't Load If Start Code Tries to Attach and Register?
by Chase Colman 13 Jun '07

13 Jun '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; b=hz0GidvcLomAWwU+seszjnO8KaSXdusoXAvW0eie2VaLgFI3hhGe5nynzlUnyID6Gh1+n7NRuDAVHYGFAJ46tSKMxoF1pskfkb0xY9hJKzpj75FdYaLiUhHUIz//E0gQMXgdZR2F6Nk1G0KWQYTDSERWrMD63WaiqRb2FHGF1ac= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:in-reply-to:mime-version:content-type:references; b=JRNHW+X3OP2F+H4hdjodgHE3CoUGCROP9Va7Rhr+TlOUtVT09MHlLV2lIgPMlRqmE7Bst7c6a/EURle0aQsWntNg9hqkT2FDhf1Wg/F1t4hgxICpgzldZOWYIUNtR2l/lDRZ2K+UzBYHn/Us42og1WLGUimh756fKEIqpCcYLKI= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Won't Load If Start Code Tries to Attach and Register?
by Chase Colman 13 Jun '07

13 Jun '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=UHuZK9KgFKW5bfPFi3qL9COeLlPkhrlGBF1uFFwoeMyWpObiJZ9M/q0aVHUUFAEG67Ti/9G8MijFv6qQiZnDNNcbdM6w9Pg1VH1humjKXir1aVGsFRSvohbkioIC9/URs4Px6LESX0f0I3VpDhvKyG8KkQgST/hX2oz0icToA3I= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=jYVtJQ6mJqMsDROa6YWXvBqYry02I1G1C/srIHFOnFpnA3hIx8mkurfbm0gobWY5YNHTT7D+kTRgmntGY/wcTS4vnxFOko4KPm6I7rUZal/CS3yK6/t5oob0y+ozVI5hapdW+26G7qQOrrPG5jbrI1T/nExK5aBKQwqXRrW9m88= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: IOKit KEXT Won't Load If Start Code Tries to Attach and Register?
by Chase Colman 13 Jun '07

13 Jun '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=J4qQQ0V/vg5+watrxMiaAxLachRm+1vLUgMjkdrPES1VjVsElCiCbm5dbNIkxlxlblPtXTBKvz8eghaxclAwMZP6uXsOO59WD/oUExoRwmaYpOvRgV32plXDplgnmk2G7FVa8NC7im/aYtVZdf2wreW/AVMhQ9kp+8C3DoyVOgc= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references; b=CdczUUconxA/NyzMGzJnRi9xZI29jsnLuJ2htRyN83z74shypXzBEKmcdLgkwKUcOcx8OvwCZalBnqZO1fl7TYPDh7tYC6/mZn7HpcjQ1JcNkYagNGqGSKbjKBXlxhPe7uen+72+MzcpUsv2gu1xxtsGiPG3tAYiMdxBlzKuqTo= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0