October 2008 - Darwin-kernel

Re: Executing an application
by Todd Heberlein 12 Oct '08

12 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Todd _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Double-clicking an app will cause lauchd to fork and start the process. One Leopard posix_spawn is used to start the new process. E.g. Looking at the launchd source code, it looks like it sets the appropriate audit mask *before* calling posix_spawn(). So is it possible that posix_spawn() doesn't create an audit record? This seems challenging... there may be no way to identify in the audit trail the name of a program started with launchd (?). This will make security auditing difficult. This email sent to site_archiver(a)lists.apple.com

1 0

Re: Executing an application
by Greg Miller 10 Oct '08

10 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=google.com; s=beta; t=1223680286; bh=C4M1HXC09ny30quHA2frHnRmlW4=; h=DomainKey-Signature:Message-ID:Date:From:To:Subject:Cc: In-Reply-To:MIME-Version:Content-Type:References; b=IB66urR06M0J0t ZagXm9W7QR5CTT2upnkXvizBEhrhjhhNHly+LNY9Wdh072fxAuGtGEDGXnwgC6E1nmW 2BQJw== Domainkey-signature: a=rsa-sha1; s=beta; d=google.com; c=nofws; q=dns; h=message-id:date:from:to:subject:cc:in-reply-to: mime-version:content-type:references; b=r7hyLala54HRdGOG1ggLItsr8UlBVG2GGLmx31W5iVNjbqSOorsd533hqg3xaVdeF 8YgAc2cz4CGGJn4YMThcw== _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Executing an application
by mm w 10 Oct '08

10 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=puEdXtn716PBgsY3dPJnTDyDUKphsLgmBGGXFzRSFwE=; b=jAG616hMYnC/agMms8bEkETqRrXaDHe1vR6/MEeoE4QcL2mYP26KlkbUDAxqBYO14I TUCd9UDo3Z0H0ssdNttn3ajDm/N6GKt1l/EN/4qsrfIRtD2utVwkQ4gUxB2hq5d78YvZ XgkVXSHiKTmX/PNkMVQO12Ex7B6rNqd/UMbvI= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=NvJt0uJBUIwKAAEiUv73YwcS6seMOvA+oW1hgxjR9niHao1YMqEL3PK7vgt6PpsiPT xixioW5pTOV3F3iszO6h91BKs3Kb8Risjv9/nZZybgQU5bjItWGJz8TxrhaAFFSG3ypu GXjBePtvKFmwTKiY9IPXR/numfgtBb7XWX+VI= take a look unto launchd On Fri, Oct 10, 2008 at 2:24 PM, Todd Heberlein <todd_heberlein(a)mac.com> wrote: > Apple recently updated its BSM audit trail for Leopard (i.e., made it work), > but there is one thing that I find strange that maybe someone can help me > with: When launching an application from the dock (or finder), there is no > exec() system call. Does Apple launch its application by some other means? > > For example, clicking on Safari on the dock (and with all audit records > turned on), there is no exec() or equivalent system call in the audit trail. > However, the binary file is read() in. For example, there is a > > stat() /Applications/Safari.app/Contents/MacOS/Safari > open() /Applications/Safari.app/Contents/MacOS/Safari > close() /Applications/Safari.app/Contents/MacOS/Safari > > but no exec() type operation on the file. > > Is this because, despite the "all" flag set for audit, the appropriate > exec() actually is *not* audited? > Can the open() for reading somehow be doing the exec()? > > If I launch the application in a shell by typing in the full path above in > the , I do see an exec system call. Anyone know what the story is? Should I > file a bug report with Apple? > > Thanks, > > Todd > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/openspecies%40gmail.com > > This email sent to openspecies(a)gmail.com > -- -mmw _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Executing an application
by Todd Heberlein 10 Oct '08

10 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com stat() /Applications/Safari.app/Contents/MacOS/Safari open() /Applications/Safari.app/Contents/MacOS/Safari close() /Applications/Safari.app/Contents/MacOS/Safari but no exec() type operation on the file. Thanks, Todd _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Apple recently updated its BSM audit trail for Leopard (i.e., made it work), but there is one thing that I find strange that maybe someone can help me with: When launching an application from the dock (or finder), there is no exec() system call. Does Apple launch its application by some other means? For example, clicking on Safari on the dock (and with all audit records turned on), there is no exec() or equivalent system call in the audit trail. However, the binary file is read() in. For example, there is a Is this because, despite the "all" flag set for audit, the appropriate exec() actually is *not* audited? Can the open() for reading somehow be doing the exec()? If I launch the application in a shell by typing in the full path above in the , I do see an exec system call. Anyone know what the story is? Should I file a bug report with Apple? This email sent to site_archiver(a)lists.apple.com

1 0

Re: New to kernel programming... Hope to see something from the console
by mm w 10 Oct '08

10 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=d1q1/baJIux/YSeKckSygZ/5iviyW1QoycMuTccWnCs=; b=na27NMB7iq5+X8tBtDLVlHmnrkbtMeoKSeoDencsI4eGG/jQF8SUqaFr40X+PZ+Nht EJJUKLnyIF+ZKjZzDNRiXD6gbLeBJmiN+aXIMBUnfAFPPcdwydji9+ictxvR4BFdDexi lyPOKxoznrWCInMtB3fbO8n//gzR/yUQiaXlg= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=fdTVd0pSw+p0f+9+BDiL4uR29W+H+G8+k9B6pA/EW6ZrI6aiyBxPZYHMG6Z9Db6qvr PHjEqtlnDT9C6+M1hktQm/6oWqZLOcYjNPTjCQPL9f0Q9klOiKEfgasxEbJYzOzxI9zE E+FGQC/+uzWlXJqfEuqUaYrn6m11tKklGpITU= "buffered output versus unbuffered output" in a middle of many things but not really lost Cheers! On Thu, Oct 9, 2008 at 8:43 AM, Herb Petschauer <bogvardi(a)gmail.com> wrote: > 2008/10/9 Cloud Strife <geforce8800(a)gmail.com>: >> Hi everyone. >> I am new to Mach kernel programming. Currently I am writing a dummy driver >> from the following guidance: >> http://developer.apple.com/documentation/Darwin/Conceptual/KEXTConcept/KEXT… >> >> After wrote the code and compiled them, I set the owner and the privilege of >> the kext, and loaded it by >> "kextload -t myIOKitDriver.kext". >> The terminal prompted I had successfully loaded the kext. I am expecting to >> see some information come out from the console. However, the expected >> message: >> " IOLog("Initializing\n");" does not appear. >> Can anyone tell me why the IOLog don't show up? And is there any way to >> correct this? >> Thank you very much for any help. >> Have a good day. :-) >> -- >> Best regards. > > Use kextstat to see if your kext was loaded > > kextstat | grep com.whatever.bundleinfo.youused > > Sometimes IOLog() gets lost in the works... > > I usually have a second window open with a "tail -f /var/log" command > running to capture an logging (that or the Console.app) or system > messages. I've switched to FireWire and kprintf (much nicer but it > requires two machines, search the archives). > > Does kextunload complain that there is nothing to unload? > > Good luck! > -H. > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/openspecies%40gmail.com > > This email sent to openspecies(a)gmail.com > -- -mmw _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Sample project for Network Kernel Extensions programming
by Quinn 10 Oct '08

10 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com <http://developer.apple.com/samplecode/enetlognke/index.html> <http://developer.apple.com/samplecode/tcplognke/index.html> <http://www.lists.apple.com/macnetworkprog> S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… At 16:53 +0800 10/10/08, Cloud Strife wrote: Can anyone here point out whether there are some samples to start with the network kernel extensions programming? It really depends on what level within the networking stack you plan to operate at. In general I tell folks to start with either the "enetlognke" or "tcplognke" samples. Also, if you have follow-up questions you might want to post over on the MacNetworkProg mailing list; a number of NKE developers hang out there. This email sent to site_archiver(a)lists.apple.com

1 0

Sample project for Network Kernel Extensions programming
by Cloud Strife 10 Oct '08

10 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:mime-version:content-type; bh=247UalFbeJ+edUcPFsdGjrTZwzHYj2bWlSGTE0nBNKU=; b=CPbEBS+3zjUmGquhwKurbkMw9KAz99OJ7xdA2K+RbnGU0LhmHIl71M7ooJ79BUkvdG VgdXakid4LSiULoTJQMw7zhlsG/CnJsMTJYFt0pv+EcpWQsUM+2iuW74KVKEBoNwlotW XWXSigEIpWR6U8yDSd5GPKqHNH6eODWy8WdBs= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:mime-version:content-type; b=W9olg80du+0pw6Ohapdz6oufsSqk+nB3yJwJn2tWNtBCo0/LVtkvqLwMtfAl1X4Ypt GrYSMsTXb/j3EKEr/oXI6HSUWfP9KUc2liU3VYBp7fTD0xLE1LphlMurv0lqrK/GSuCB vH3GzxUyrL7IB1yQVrpS6w1lMADGBxYyEZ0yU= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Including kern clock.h from a non-kext application
by André Berg 09 Oct '08

09 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 2.0.0.17 (Macintosh/20080914) Hi, Again, thanks for your help! André --- Original Nachricht --- Absender: Herb Petschauer Datum: 09.10.2008 22:45 Uhr Hi, So what's the secret to be able to include /Developer/SDKs/MacOSX10.5.sdk/System/Library/Frameworks/Kernel.framework/Versions/A/Headers/kern/clock.h ? {Snip} Err... you don't. Are you writing a kernel extension? No? Then stick to the userland frameworks :-) Try: #include <mach/mach.h> #include <mach/mach_time.h> That will give you mach_absolute_time() (search the archives). UpTime() is also an option (search the archives). Good luck. Cheers, -H. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… Thanks for replying. I already include those in my example code. Normally I only include files when I know what they are there for. Do you know why they are not supposed to be callable any longer from userland apps? In my searches I found some old mailing list messages (around 2001) mentioning those functions for game timings. That together with the Kernel Programming Guide also mentioning those functions brought me on this track. I am just trying to find a relatively save and easy way to do high-resolution performance counting on Intel/PPC archs, preferably using system provided functions which already cover a larger armount of hardware/software configurations. So, far I know about UpTime (Unfortunately, there might be times where I can't link to CoreServices), RDTSC in all it's flavors, and mach_absolute_time. I guess I will combine mach_absolute_time with AbsoluteToNanoseconds or fiddle with with mach_timebase_info 2008/10/9 André Berg <andre.berg(a)email.de>: This email sent to site_archiver(a)lists.apple.com

1 0

Re: Including kern clock.h from a non-kext application
by Herb Petschauer 09 Oct '08

09 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:cc:in-reply-to:mime-version:content-type :content-transfer-encoding:content-disposition:references; bh=fnG7yK4QgAwwsVeq+dWGuFPvt+Fpm6OWfdqxJlgkR1E=; b=wR7zVbx99tiGfsZw0B6IhHNzI3YTbPQ24kaRlfe9azff+sBGAadKS2yFsLVsyB6Usi s+R609kFY2lqFPj3rC7MaqgVvdC3nYZ5i5sZbPRRWzdmHtakB7OTOYcCLQEPNYIgSGh/ n+F3wYPiBGRth9PLm1PGWvfLv+QWpjcjjFrj4= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:cc:in-reply-to:mime-version :content-type:content-transfer-encoding:content-disposition :references; b=kUneXNelB0vzv9nTJYKIER9HOKxwIzR3hHntwUZAEgNaGQSjtj7SSTsXACsEfXk42y nee2zboUjHor+lDEACzklnMGjDBHZxVyed1pVw4HQpX7idaEeiIpy7MMkiNcrXPeKeDJ O+L3ePnUUoboa6NCJMkJ4SaJ40kHBEN07sIGU= 2008/10/9 André Berg <andre.berg(a)email.de>: > Hi, > > So what's the secret to be able to include > /Developer/SDKs/MacOSX10.5.sdk/System/Library/Frameworks/Kernel.framework/Versions/A/Headers/kern/clock.h > ? {Snip} Err... you don't. Are you writing a kernel extension? No? Then stick to the userland frameworks :-) Try: #include <mach/mach.h> #include <mach/mach_time.h> That will give you mach_absolute_time() (search the archives). UpTime() is also an option (search the archives). Good luck. Cheers, -H. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Including kern clock.h from a non-kext application
by André Berg 09 Oct '08

09 Oct '08

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com User-agent: Thunderbird 2.0.0.17 (Macintosh/20080914) Hi, ----------------------------------------- #include <stdio.h> #include <stdlib.h> #include <stdint.h> #include <string.h> #include <sys/errno.h> #include <sys/sysctl.h> #include <mach/mach_time.h> #include <mach/mach_types.h> #include <CoreServices/CoreServices.h> // #include <kern/clock.h> <-- If I include it like this, it gives (1 // #include <Kernel/kern/clock.h> <-- gives (2 int main (int argc, const char * argv[]) { struct mach_timebase_info timebase; clock_timebase_info(&timebase); uint64_t nanoseconds = 0ULL; absolutetime_to_nanoseconds(mach_absolute_time(), &nanoseconds); return EXIT_SUCCESS; } ----------------------------------------- Error Messages: Tried: Thanks for reading! André _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… So what's the secret to be able to include /Developer/SDKs/MacOSX10.5.sdk/System/Library/Frameworks/Kernel.framework/Versions/A/Headers/kern/clock.h ? Specifically I am trying to do the following from a standard tool project's main.c: 1) /Users/andre/Documents/Xcode/Command Line Utility/StandardTool/mach_abstime/main.c:10:24: error: kern/clock.h: No such file or directory 2) In file included from /Users/andre/Documents/Xcode/Command Line Utility/StandardTool/mach_abstime/main.c:10: /Developer/SDKs/MacOSX10.5.sdk/System/Library/Frameworks/Kernel.framework/Headers/kern/clock.h:43:29: error: kern/kern_types.h: No such file or directory - Dozens of combos for the usual suspects when linking, like "Other LDFlags", -I, -L ... - Making an empty General Kernel Extension project and comparing the build settings one-on-one with the build settings of mach_abstime for both Target and Project Build Settings. Or is the saddening truth that one cannot call kern/clock.h interface functions from a userland app? This email sent to site_archiver(a)lists.apple.com

1 0