August 2007 - Darwin-kernel

Re: virus scan application
by Terry Lambert 07 Aug '07

07 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On Aug 6, 2007, at 2:39 PM, Terry Lambert wrote: In order: KAUTH_FILEOP_OPEN KAUTH_VNODE_READ_DATA KAUTH_FILEOP_CLOSE Hang a sec here Terry. You won't see those in that order. You really need to read the documentation. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Aug 6, 2007, at 7:40 PM, Michael Smith wrote: On Aug 4, 2007, at 6:57 AM, Vishal Shetye wrote: Actually I intend to hook open system call and scope suitable for me is VNODE. Although KAUTH_VNODE_READ_DATA suffice the purpose, how would I differentiate between open and read. And what about close()? What notification should I receive? ...in other words, you will need to listen in more than one scope. VNODE_READ_DATA will show up in the VNODE scope first, as authorisation is sought for the operation. This may show up any number of times; it may or may not be associated with an open; there is no way to know which open, if any, is associated with a given authorisation. There is no guarantee that an open will even require authorisation (there are various reasons why this is the case). Once the file has actually been opened successfully, but before any I/O is performed on its contents, you will see FILEOP_OPEN in the FILEOP scope. You may see this multiple times for a given file. It is possible in some cases (e.g. fork, descriptor passing) for processes to have a file open without an associated FILEOP_OPEN event. When the file is closed for the last time, you will see FILEOP_CLOSE in the FILEOP scope. There is no notification for closes prior to the last. There is no notification for read/write operations against a file (and for practical reasons in the general case, cannot be). I meant "in order you asked", not "in the order you'll see these"; sorry if that wasn't clear. Vishal: the documentation is very clear on the fact that you will not get notification on individual reads or writes, only that you will get notification of a request for read access, notification of the open, notification of the close, and, if it was written while it was open, notification of that fact at the time it is closed. This email sent to site_archiver(a)lists.apple.com

1 0

Re: virus scan application
by Terry Lambert 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com In order: KAUTH_FILEOP_OPEN KAUTH_VNODE_READ_DATA KAUTH_FILEOP_CLOSE ...in other words, you will need to listen in more than one scope. -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Aug 4, 2007, at 6:57 AM, Vishal Shetye wrote: Actually I intend to hook open system call and scope suitable for me is VNODE. Although KAUTH_VNODE_READ_DATA suffice the purpose, how would I differentiate between open and read. And what about close()? What notification should I receive? This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Debugging Help
by Terry Lambert 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Hello, p *(task_t)0x....... -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Aug 6, 2007, at 1:04 AM, Arvind Dalvi wrote: After getting on with kernel debugging as documented, i am little surprised by the amount of information provided by the kgmacros in the kernel debug kit. showtask, does the job of showing basic task information, but how about dumping detailed task info ?. ( although, showtaskvm or showtaskvme and the rest should help, but i would like the data structure to be dumped...... ) This is a really basic gdb question, and I highly recommend you buy the O'Reilly manual for gdb. For future reference, if all you have is a hex address of a task, rather than a task pointer, the command is: This email sent to site_archiver(a)lists.apple.com

1 0

Re: Kernel Panics
by Terry Lambert 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Here's what the panic log indicates: - -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Aug 5, 2007, at 11:40 AM, Frederick Pearce wrote: I'm hoping that someone can shed some light on the almost daily panics I've been getting on my X-Serve Dual G4. Sun Aug 5 07:56:34 2007 panic(cpu 1 caller 0x0003FFE8): zalloc: "kalloc.64" (3860160 elements) retry fail 3 Latest stack backtrace for cpu 1: Backtrace: 0x000952D8 0x000957F0 0x00026898 0x0003FFE8 0x0002BC34 0x0007C284 0x0007C4AC 0x0028B114 0x002A5B18 0x00089D0C 0x00061340 0x00063258 0x000A84F0 0x000AB980 Proceeding back via exception chain: Exception state (sv=0x2D3F4000) PC=0x0005B134; MSR=0x4000D030; DAR=0xED2B7000; DSISR=0x40000000; LR=0x0004F5FC; R1=0xBFFFECF0; XCP=0x00000010 (0x400 - Inst access) Kernel version: Darwin Kernel Version 8.10.0: Wed May 23 16:50:59 PDT 2007; root:xnu-792.21.3~1/RELEASE_PPC You should report this via bugreporter, ather than to this list. However... There are no kernel extension address spaces listed in the backtrace, so this is not a crash in a kernel extension. However, this specific error generally indicates a problem in a kernel extension; it's saying that the 64 byte zone has been exhausted by someone, and the most likely cause is some kernel extension doing 64 byte allocations and never freeing the memory back to the system for reuse. Looking at the specific addresses involved, this is an attempt to create a upl in the page in path for a cluster read as a result of a page fault. You will need to take a core of this and file a bug report, or you will need to engage in two machine debugging. Again, the most probable cause of this is a third party kext that is leaking memory. The second most probably cause of this is running a heavy load on an unsupported memory configuration; this could either be a machine with less than the supported amount of RAM for the version of the OS you are running, or this could be a desktop system that has been manually tuned toward a server configuration by removal of administrative limits via sysctl. Note that the primary reasons for the default desktop limitations are that desktop systems typically ship configured with far fewer resources than XServe systems. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Darwin-kernel Digest, Vol 4, Issue 155
by Terry Lambert 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com If in doubt, use Google: === Google: [ site:apple.com dtrace leopard ] ... ... ... ... ... === -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Jul 19, 2007, at 12:20 PM, BEURET Stéphane wrote: About DTrace in Leopard, Sun tells me there is a GUI version of DTrace in Lepoard. I suppose if there is a GUI version, there is a CLI version:) BUT It's just a rumor, as zfs for the root disk and so on. Normally you can trust me, but things mau be change since Leopard comes... Apple - Mac OS X Leopard - Developer Tools - Xray DTrace, the systemwide analysis tool in Leopard, provides full access to system activity — from high-level application behavior to the operating system ... www.apple.com/macosx/leopard/developer/xray.html - 14k - Cached - Similar pages Apple - Mac OS X Leopard - Technology - UNIX Introducing the fully UNIX-compliant Mac OS X Leopard. ... DTrace is a low-level debugging and profiling facility for detailed monitoring of virtually any ... www.apple.com/macosx/leopard/technology/unix.html - 18k - Cached - Similar pages Worldwide Developers Conference 2007 - Tracks - Developer Tools Mac OS X provides a comprehensive set of developer tools, with Leopard ... for and integrated into Mac OS X. DTrace is embedded in the core of Leopard, ... developer.apple.com/wwdc/tracks/devtools.html - 23k - Cached - Similar pages Leopard Tech Talks - Session Descriptions Xray, a new development tool for Leopard, integrates many of today’s familiar performance tools with a Mac OS X version of DTrace to provide unparalleled ... developer.apple.com/events/techtalks/descriptions.html - 16k - Cached - Similar pages Leopard Technology Series for Developers Leopard is the sixth major version of Mac OS X and it will be the most advanced and powerful .... Xray builds on top of the open source DTrace utility. ... developer.apple.com/leopard/overview/ - 25k - Cached - Similar pages This email sent to site_archiver(a)lists.apple.com

1 0

Re: virus scan application
by Terry Lambert 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com All, I'd appreciate a little bit more information about some points in this thread, specifically what Terry said in points (3) and (4). I'd like to implement a technique that's very similar to Time Machine. Basically, a userland process would register with the kernel extension and provide a pid. The kernel extension would call the userland application whenever a vnode scope operation is performed by the pid. The userland app would then create a backup of the file that's being accessed. In this case I want to have blocking communication between the kernel and the userland application so that I can create the backup before the application can access the file. This is very similar to a hypothetical virus scanner so many of the techniques should apply. I've read TN2127 and the list archives about implementing a virus scanner and one question that's never been definitively answered is how the kernel can block and then call out to a user level application. In fact TN2127 says in the Listener Gotchas section that the only foolproof method is the implement the scanner completely in the kernel. Is this still the recommended approach? If it is will I be able to implement my version of Time Machine? The statement: For example, an anti-virus scanner would particularly want to scan files being opened by a thread running with elevated privileges. In this case the only correct solution is for the scanner to operate entirely within the kernel. The correct method involves my item (1): (1) Exempting your virus scan daemon from such checks when it makes requests, by having it register its process with your KEXT -- Terry _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Aug 5, 2007, at 7:07 PM, Jim Clause wrote: Any such operation would need to be blocking, in fact, or you would be giving them the answer before you had it yourself (assuming a user space daemon is involved), which is impossible. is incorrect; there is no reasonable way to do low level file I/O from within a KEXT. This is an intentional design decision, and it's unlikely to ever change. Since a virus scanner will, by necessity, need to look at the contents of the files it is scanning, the statement can't be correct, for obvious reasons. The caveat here is that you may not rely on other system services, other than very simple system calls, if you want to avoid the possibility of deadlock. So, for example, a virus scanner would not want to link against Core Foundation, nor would it want to make name resolution requests for network host names, etc.. In other words, you limit yourself to functions in man(2) (system calls) and avoid those in man(3) (library routines). However, for the most part, the daemons in question that are contacted by library routines behind your back run as "root", so the chance of deadlock from that is more or less minimal, if you also follow the recommendation that you exempt not only your virus scanner, but also applications running as "root". My personal opinion in this case is that you should limit your APIs rather than doing this, as the threat to the system of a root process triggering virus code is much higher than that for a non-root process triggering the same code at a lower privilege level. What this really boils down to is that I think that your daemon should be in a state where it has all the information it needs in order to make the decision in hand, rather than needing to go elsewhere to obtain it; this also avoids the possibility of a deadlock, and is a much more elegant approach to the deadlock problem. This email sent to site_archiver(a)lists.apple.com

1 0

Re: File Access with VFS
by Garth Cummings 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

RE: File Access with VFS
by Vishal Shetye 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:from:to:subject:date:message-id:mime-version:content-type:x-mailer:thread-index:x-mimeole; b=hkAPGf63bdxRCw0dbH/6mv6XRPCxtvrH31/0bnyHz1RDN5aMpBWV6ipsjoZwO4fWhVdpCAwejNvQcdo/WVT246z4Pc9uMiU5Y5mMVuR8pbTVRy3F/r5YHcHXJBSFmaJcz6y4tLlMWbxmZTPHZV7Kc5oEOJ3XBJKmWvNXyFDhTZU= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:from:to:subject:date:message-id:mime-version:content-type:x-mailer:thread-index:x-mimeole; b=LRF7S15zq8XP0cs56wzrqr+7dfsLMRQiDRM7rbtW2XizXgahHhWmJ3iiS4iAxER1S7gmWUnBSK1PZABwZahLk2+X3pQaBgBvmFOIfzMOMAgAyYONoPfRlr43WAVGs8BXo0QQ7Kxy//8P976yb4e1/AIJuSDXHz8lvnfi8HO3mH4= Thread-index: AcfYVmBGJsEG0ZwOQpONiq0bgLAUNQ== _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

RE: virus scan application
by Vishal Shetye 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: a=rsa-sha1; c=relaxed/relaxed; d=gmail.com; s=beta; h=domainkey-signature:received:received:from:to:cc:references:subject:date:message-id:mime-version:content-type:x-mailer:thread-index:x-mimeole:in-reply-to; b=gpQLb/PE67HcQGT+lJYWmrngCRgDzJN2+t2l8ydEBSVNgGosvwOCkKWTmLyv57ecaQIceMwkq7etWbVnfyuq3RVSdt0FzUbh7PKienZhLcA3vAnC5Rvl7bAbYrgEzEnQNIXAYLTtB17IlToSAVGPQqi+UxP5CtRl4b067C40wck= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=beta; h=received:from:to:cc:references:subject:date:message-id:mime-version:content-type:x-mailer:thread-index:x-mimeole:in-reply-to; b=JDMAB8MvI9i0OEsYeXyG9UiqKuLRsGW6HZmp4iwLEYLH0L8ZHlD6JN5c7abspTEUPUKthKQ1hDfSA7AkASU+xFllKrt1RrgPF0Mvx0TPRf4ixCV7wjptkwzEpaMEvaBe+KMLoLnLwZx4fKNjugUf2LiWJuk2oxCxeTC2fpakbs4= Thread-index: AcfWyVZrcAD5PhmaRM+meJyEcQlRyABHfljQ _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Finding symbols in loaded kexts
by Michael Smith 06 Aug '07

06 Aug '07

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com If the symbol you want is not global (lower-case type specifier in the nm output), or has been stripped out of the target kext entirely, then there isn't really anything you can do. If the symbol is not global, but still present, would it work to call it via a function pointer initialized to the correct address? Eg, does the "global" property mean anything once the module is relocated? I vaguely remember a trick somebody here used to play with Linux. There was some function that wasn't exported that his module needed to call. So he had a wrapper script for his module that groveled around in kernel memory to find the function, then passed its address to his module, which used it in a function pointer. I don't remember if it was global or non global though.. = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… On Aug 6, 2007, at 9:58 AM, Andrew Gallatin wrote: Dean Reece writes: All that "global" means is that it's available to modules linking with it, in this context. Yes, lots of people have done lots of bad and ugly things. Not a good reason to emulate them... 8) This email sent to site_archiver(a)lists.apple.com

1 0