April 2012 - Darwin-kernel - lists.apple.com

is mach_vm_region confused or am I?
by Gerriet M. Denkmann 14 Apr '12

14 Apr '12

Doing: pid_t pid = ... (of any 64-Bit process) vm_map_t target_task = task_for_pid( pid ...) mach_vm_address_t address = ... mach_vm_size_t size mach_vm_region( target_task, &address, &size, VM_REGION_TOP_INFO ...) I get: size = 0x1000 (i.e. one page) top.shared_pages_resident = 2 When I do proc_regionfilename( pid, address, ... ) I get: "/usr/lib/dyld". Is mach_vm_region not to be trusted? Am I misunderstanding something? Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

task_for_pid safely
by José Cornado 13 Apr '12

13 Apr '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Weird system freeze
by Antoine Missout 13 Apr '12

13 Apr '12

Hi, I've encountered an issue with our product Hands Off!. We intercept the mac_socket_check_bind call, send a mach msg to our daemon to check if it's allowed. But for some reason, the daemon never wakes up to process it (why?). In the stackshot I was able to get, the only thread we're interfering with is the bind system call made by launchctl (when enabling the Apple File Server). Below are the relevant logs. A complete zip of the stackshot logs is available here: http://www.metakine.com/files/ho_freeze12avr2012.zip Looking at the bind source code, it's not clear to me what could lock everything else when blocking in it. This bug is hard to reproduce, doesn't always happen, and seems to be dependant on the network environment. Any help would be greatly appreciated. Thanks, Antoine ------------------------------------------------- PID: 328 Process: launchctl Kernel stack: machine_switch_context (in mach_kernel) + 383 (0xffffff800022c888) thread_dispatch (in mach_kernel) + 1894 (0xffffff800020990e) thread_block_reason (in mach_kernel) + 289 (0xffffff8000209acb) ipc_mqueue_receive (in mach_kernel) + 65 (0xffffff8000203622) mach_msg_rpc_from_kernel_body (in mach_kernel) + 338 (0xffffff800020589f) 0xffffff7f8099a72c (0xffffff7f8099a72c) 0xffffff7f8099ebb0 (0xffffff7f8099ebb0) 0xffffff7f809a7681 (0xffffff7f809a7681) bind (in mach_kernel) + 318 (0xffffff80004b45ea) unix_syscall64 (in mach_kernel) + 544 (0xffffff80004e8168) hndl_unix_scall64 (in mach_kernel) + 20 (0xffffff80002e4874) PID: 67 Process: HandsOffDaemon Continuation: ipc_mqueue_receive_continue (in mach_kernel) + 0 (0xffffff800026f302) Continuation: kevent (in mach_kernel) + 62 (0xffffff80004786e4) Continuation: semaphore_wait_continue (in mach_kernel) + 0 (0xffffff80002815d9) Continuation: ipc_mqueue_receive_continue (in mach_kernel) + 0 (0xffffff800026f302) Continuation: ipc_mqueue_receive_continue (in mach_kernel) + 0 (0xffffff800026f302) Kernel stack: machine_idle (in mach_kernel) + 210 (0xffffff800022e461) thread_setrun (in mach_kernel) + 1344 (0xffffff80002083a4) thread_go (in mach_kernel) + 2145 (0xffffff8000208fec) thread_block_reason (in mach_kernel) + 264 (0xffffff8000209ab2) ipc_mqueue_receive (in mach_kernel) + 58 (0xffffff800020361b) mach_msg_overwrite_trap (in mach_kernel) + 468 (0xffffff800027426a) get_user_regs (in mach_kernel) + 545 (0xffffff80002c2daa) hndl_mach_scall (in mach_kernel) + 230 (0xffffff80002e4536) Continuation: ipc_mqueue_receive_continue (in mach_kernel) + 0 (0xffffff800026f302) Continuation: semaphore_wait_continue (in mach_kernel) + 0 (0xffffff80002815d9) Continuation: ipc_mqueue_receive_continue (in mach_kernel) + 0 (0xffffff800026f302) _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

mach_vm_region vs. vm_region_64
by Gerriet M. Denkmann 13 Apr '12

13 Apr '12

What is the difference between mach_vm_region() and. vm_region_64() ? Which one if more future-proof? Kind regards, Gerriet. _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: task_for_pid question
by José Cornado 12 Apr '12

12 Apr '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

task_for_pid question
by José Cornado 12 Apr '12

12 Apr '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

monitoring syscalls
by me 10 Apr '12

10 Apr '12

Can anyone point me to documentation for observing syscalls from the kernel? I am currently using a KAUTH VNODE listener scope to look for file opens, but I would like to be able to know which files are being read from as they are read. I could use dtrace, but I would prefer to use system calls as opposed to another process. thanks, Trip _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Deleting a file in KEXT
by Anatol Pomozov 10 Apr '12

10 Apr '12

Hi On Mon, Apr 9, 2012 at 6:38 AM, Rupesh Khetawat <Rupesh_Khetawat(a)symantec.com> wrote: > Is there anyway a file can be deleted in KEXT? > > > > I have written KEXT where file scope listener is registered with kauth. I am > trying to delete certain files when the action is close with modified flag. > I looked at the documentation, but did not find anything deleting file in > kernel mode. > > Can someone throw some light on this? In kernel you do not have access to POSIX functions such as unlink(). I believe the only way to achieve the goal is to use VNOP operations directly. In your case this will be VNOP_REMOVE. Here is an example from XNU that removes a file https://github.com/anatol/xnu/blob/master/bsd/vfs/vfs_xattr.c#L529 _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Re: Permission level required for injecting in another task
by José Cornado 10 Apr '12

10 Apr '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0

Permission level required for injecting in another task
by José Cornado 09 Apr '12

09 Apr '12

_______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel(a)lists.apple.com) Help/Unsubscribe/Update your Subscription: https://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists… This email sent to site_archiver(a)lists.apple.com

1 0