August 2010 - Darwin-kernel

Re: How to kill a kqueue camper thread? Was: close() hangs … in 10.5 only
by Jerry Krinock 30 Aug '10

30 Aug '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 2010 Aug 20, at 11:16, Terry Lambert wrote: > On Aug 20, 2010, at 4:35 AM, Jerry Krinock wrote: >> Yes, this is one of your previous suggestions, to have the secondary thread feed back its thread ID. I kind of like your first suggestion better, to get the thread ID from pthread_create(). Warning: I've never done this – just reading docs. But I'll get it one way or the other. > > The suggestion was made on the basis of incomplete information, which is why I gave a shotgun answer to cover all possible bases, given your observed behaviour. I wouldn't suggest throwing out NSThread and object encapsulation over this. OK, I realized after reading this that NSThreads *are* pthreads. So I can create a thread with NSThread, and then when running in Mac OS 10.5, have the secondary thread identify itself using pthread_self(), and feed this back to the main thread. > I can't make forward looking statements about things like that. It works that way by design in 10.6.x. You could always ask for a documentation change to try and tie our hands in future versions. Well, since I've always known you to be a very helpful and technical person, against the advice of my attorneys, I shall just trust you. > I tend to like to keep documented interface contracts to a minimum in man pages I work on, though, so as to not preclude doing something clever in the future; being with the IEEE, you can probably appreciate that, since POSIX says nothing about close(2) triggering cancellation of outstanding I/O operations vs. blocking until those operations complete. Writing code that depends on cancellation is therefore non-POSIX code which depends on implementation-defined behaviour. I see. A little out of my league, but it seems that maybe this pickle is a result of the kqueue being inappropriately built upon a file handle. > I think the benefits of async initialization, no additional fd worries, and the mechanism being orthogonal to interfaces you are probably already using is enough of an argument to sell the signal approach. OK, that's what I did and it works. When my kqueue is no longer needed, in Mac OS 10.5, I send it a pthread_kill() with SIGUSR1. My secondary thread handles SIGUSR1 with a no-op [1]. Then, in both 10.5 and 10.6, I close() the kqueue's file descriptor. In Apple's Threading Programming Guide > Terminating a Thread, killing a thread is "strongly discouraged" because "Memory allocated by the thread could potentially be leaked and any other resources currently in use by the thread might not be cleaned up properly, creating potential problems later." I don't see any other resources, and as far as memory, I've tried to fix that by only accessing Cocoa objects within inner autorelease pools, which are all released before re-camping on kevent(), and enclosing them, as well as my call to pthread_kill() over on the main thread, in @synchronized() blocks. The idea is that death shall not occur whilst any Cocoa objects are alive. Tested on both 10.5 and 10.6, and it all seems to work. Thank you for the help. Jerry [1] Otherwise the whole app gets killed – logical, but not precisely documented as far as I can see. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Synchronous communication for Antivirus application.
by Michael Smith 25 Aug '10

25 Aug '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Synchronous communication for Antivirus application.
by Deena Awate 25 Aug '10

25 Aug '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1282777882; bh=K7cCMIjAhK685zyyGNsdgeGVoGUei12kTXvdTNySEbs=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=Oiy41HXxjYhVWHjssIdhdohMEfXaecG1yRk1f1CnxxTARUYoSSfQuo+YOVgg7IhAZaYWSKVZme3eMoNWfbopF00OND8zrqfSJCfZnsxzlKehiDlVOPor2hhq4s7IPP6vDBwDVlG07f6FzLDd4c2pGWpdJ08V1AWOASK32CswYRI= Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=q4czv73b5UenL8leLhwkKnyF4jgQaDpm7SUDpVP3GrKiVVeuKLVO6dBk+fRs37qnL2LlZB6kyLrtFTUS5ndHKPHqtC4XlCc/1AhphguBthlEZkSB+qk4Lz3R7ZG9NYAS1EahEZNcsWLhgVZowrflTTBgLQfWpyV5CvunVY/DXig=; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: listening KAUTH for move file action
by Chris Gates 25 Aug '10

25 Aug '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:content-type; bh=U1HmLyPYKNRorFBOwCDbjgjvvdOq+YQEwvZ1+4NpFTM=; b=rJ48VTM2eK/pWj6q3PmMDbvC+t8MyqcjYHwrb718cBb6K9v9Hsdo3pSwEmjwtSCTrr FrKF/F6RklGS0W5OfdvRA5nC8g5R3AERwD4h94Wz+YQPR7M/8H+bp8GL3B9T0zCTwdAP IgkX2OOFh5r1sYHCOViYezYzdM9EaCtBaPrlA= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :content-type; b=WMPZrOTPwocraJgrzrSGvX7XkoCd/qorsIniSy9moj1kw6hjpGUkBpQNqppwiVAe0i Z19Kk0cHpMAsiN3zhVRNKOr5y9NXhbsjpHYThvwk6K/0gKhHCp3Vrfac0zA4a4K8w0XS dAIYcJrXhBJE8g/rCTQPI9Qh+EFicXvKDUiXo= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

listening KAUTH for move file action
by Jani Brezavšček 25 Aug '10

25 Aug '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:date:message-id :subject:from:to:content-type; bh=auWtrYdb8CckxC6T406rrn/JZL9KXUEalf5RQXOV280=; b=EMmxhcUjkEma3DnH6HrRZrP3e44W9qh8B+3Y72/2l8yIklLuOiyYJFDlDZP/vCjbB1 Y3J5e2izw9XXod4BmWgPqoJzh/QBtdD76Kv3YciJxkNd03pKYLdNpVlpONEAmIO/dTjF to9f/Sswe4B49Sphbmy6ZqfFfYYNO3cVBcX/c= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:date:message-id:subject:from:to:content-type; b=bkMGUrMdwExbPArV0N1mFy9+2v4g5diIg7wkm1QJXboUMusVUxDXjVtf2nGT0hxNJ/ 1HTrnKP8xbCv1XuVqkPtIaC716IbFdBKa3rrfWJxUO1Faky9lATIeN2CP1LQefCpRI7E sKc8YsslFrARu6PN4Zlck5+ccfFrRNsW3Kv10= _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Synchronous communication for Antivirus application.
by Deena Awate 23 Aug '10

23 Aug '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s1024; t=1282589697; bh=QEcQ1U0WKYeVziJtYg2MS+zIcjMR+6Agywz0PI9yySs=; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=oTkvFgtunls8Zw7wm9GVW8bdRVctSKpqJa4sRbnq8C8njx9WfUEnJn3ulk2nafbb3l1IpNczk1+fEWcFQIZt0vlZMeu37uZD5HgEZxw7wZEs3UIBZqYBgn9pTWrFKkPrLNP+1UnyCggpXxhizLNirQIA5NOeWfJPQVRTjq0Oymg= Domainkey-signature: a=rsa-sha1; q=dns; c=nofws; s=s1024; d=yahoo.com; h=Message-ID:X-YMail-OSG:Received:X-Mailer:Date:From:Subject:To:Cc:In-Reply-To:MIME-Version:Content-Type; b=tNrLfcGkVEiCbyp535H9l+JdBQRMp86ySLyz6PaNuo5v/aAf5JOJmJD0RmIPVsxLDsgnIXLtRq1O9pZrLpSADbehSdzFoBdG11dyM6IQAlRO6/5fkR8PT0k3OvFo2uJdHXKmWugT+wPF1oZ5xpSDOzd2B4LQFbsKtS6H4rDe++g=; _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Current active login session
by Antoine Missout 23 Aug '10

23 Aug '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Nevermind, I'm guessing we could make it so the daemon confirms with the user by using the Authorization Services API. Thanks for all the questions, comments and answers. - Antoine On Aug 23, 2010, at 8:06 AM, Antoine Missout wrote: > What about the status menu item, which in our agent currently allows the user to temporarily disable rules? > > - Antoine > > > > On Aug 23, 2010, at 5:11 AM, Quinn The Eskimo! wrote: > >> >> On 20 Aug 2010, at 14:34, Antoine Missout wrote: >> >>> We police network connection in a similar manner to Little Snitch. Network connections can be either denied, allowed, or up to the user to decide in an interactive manner. >> >> Ultimately this boils down to a question of trust. You want to be able to trust that the actual user, not some bogus software running inside the user's context, is answering your questions. This presents a real difficulty: >> >> o only user-level software is allowed to talk to the GUI >> >> o user-level software can be subverted >> >> You can resolve this paradox using the Authorization Services API. This allows your daemon to request authorisation for some operation ("allow this TCP connection?", for example) and have the UI that asks that question run in a trusted GUI environment that's not under the control of the user (the SecurityAgent process). The mechanics of making this work are going to be a little tricky. You will almost certainly need an authorisation plug-in to run your GUI. You're also going to need something in the user's context that checks in and out with your daemon. >> >> S+E >> -- >> Quinn "The Eskimo!" <http://www.apple.com/developer/> >> Apple Developer Relations, Developer Technical Support, Core OS/Hardware >> >> >> _______________________________________________ >> Do not post admin requests to the list. They will be ignored. >> Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) >> Help/Unsubscribe/Update your Subscription: >> http://lists.apple.com/mailman/options/darwin-kernel/antoine.missout%40meta… >> >> This email sent to antoine.missout(a)metakine.com > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/antoine.missout%40meta… > > This email sent to antoine.missout(a)metakine.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Current active login session
by Antoine Missout 23 Aug '10

23 Aug '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com What about the status menu item, which in our agent currently allows the user to temporarily disable rules? - Antoine On Aug 23, 2010, at 5:11 AM, Quinn The Eskimo! wrote: > > On 20 Aug 2010, at 14:34, Antoine Missout wrote: > >> We police network connection in a similar manner to Little Snitch. Network connections can be either denied, allowed, or up to the user to decide in an interactive manner. > > Ultimately this boils down to a question of trust. You want to be able to trust that the actual user, not some bogus software running inside the user's context, is answering your questions. This presents a real difficulty: > > o only user-level software is allowed to talk to the GUI > > o user-level software can be subverted > > You can resolve this paradox using the Authorization Services API. This allows your daemon to request authorisation for some operation ("allow this TCP connection?", for example) and have the UI that asks that question run in a trusted GUI environment that's not under the control of the user (the SecurityAgent process). The mechanics of making this work are going to be a little tricky. You will almost certainly need an authorisation plug-in to run your GUI. You're also going to need something in the user's context that checks in and out with your daemon. > > S+E > -- > Quinn "The Eskimo!" <http://www.apple.com/developer/> > Apple Developer Relations, Developer Technical Support, Core OS/Hardware > > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/antoine.missout%40meta… > > This email sent to antoine.missout(a)metakine.com _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Current active login session
by Quinn "The Eskimo!" 23 Aug '10

23 Aug '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com On 20 Aug 2010, at 14:34, Antoine Missout wrote: > We police network connection in a similar manner to Little Snitch. Network connections can be either denied, allowed, or up to the user to decide in an interactive manner. Ultimately this boils down to a question of trust. You want to be able to trust that the actual user, not some bogus software running inside the user's context, is answering your questions. This presents a real difficulty: o only user-level software is allowed to talk to the GUI o user-level software can be subverted You can resolve this paradox using the Authorization Services API. This allows your daemon to request authorisation for some operation ("allow this TCP connection?", for example) and have the UI that asks that question run in a trusted GUI environment that's not under the control of the user (the SecurityAgent process). The mechanics of making this work are going to be a little tricky. You will almost certainly need an authorisation plug-in to run your GUI. You're also going to need something in the user's context that checks in and out with your daemon. S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Current active login session
by Dreamcat4 21 Aug '10

21 Aug '10

site_archiver(a)lists.apple.com Delivered-To: darwin-kernel(a)lists.apple.com Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:mime-version:received:in-reply-to :references:from:date:message-id:subject:to:cc:content-type :content-transfer-encoding; bh=YDIT8m2XkI/+zDL/FPF8vpHrjLMbgkiLZ2gNF6eXPTM=; b=cFKlTvmFCQLxzP8cRvxsAudff2Zc/VcvdBCaUYd7zZjQjPTJk1rxkaEt5IUMijxp3H oVhdv44MHZDppwjDxqSDXxsYdlprDa6C9yF1Tks02iCal1xqaDOF6ltv5OuT5OqIXP7g Csy7I3CjAaOCoKNBPZdc4J/Jv7hBXri/QcgDg= Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :cc:content-type:content-transfer-encoding; b=JPb7zvazccuPbOlpjaOLOLlrUOdB06pH3AM1u6P/XaYygtydeE7ekcAz1iebnuG6aK 03rptp8YWf7AUYndJKrtSeHKR4B44W8MAyOr5slL55wpbhTzAGV4DYMTNm2j+dDwNpPK GOXeHmNaq9dznCWj+CFx2kHqxGPcjIGfIwN1U= I wonder what the ownership of /dev/console changes to when there are 0 logged in users? root:wheel ? It definitely works when switching between logged in users: janitors-Mac-mini:~ janitor$ while ls -lsa /dev/console; do sleep 1; done 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 id staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console 0 crw------- 1 janitor staff 0, 0 21 Aug 01:40 /dev/console ^C janitors-Mac-mini:~ janitor$ So a big thumbs up :) On Sat, Aug 21, 2010 at 1:27 PM, Antoine Missout <antoine.missout(a)metakine.com> wrote: > Am I missing something or can't I just check who owns /dev/console ? > > http://developer.apple.com/mac/library/technotes/tn2005/tn2083.html > "The console user is the user whose GUI login session is using the console. The console device, /dev/console, is owned by the console user." > > Seems simple enough... > > - Antoine > > > > > On Aug 20, 2010, at 8:45 AM, Quinn The Eskimo! wrote: > >> >>> If it was possible to get the answer in another manner directly from the daemon without relying on the agents, that'd be much better. >> >> Not in any well supported fashion. > > > > > _______________________________________________ > Do not post admin requests to the list. They will be ignored. > Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) > Help/Unsubscribe/Update your Subscription: > http://lists.apple.com/mailman/options/darwin-kernel/dreamcat4%40gmail.com > > This email sent to dreamcat4(a)gmail.com > _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.… This email sent to site_archiver(a)lists.apple.com

1 0