site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com On Jun 17, 2005, at 4:35 PM, matt jaffa wrote: Well basically I am trying to associate outgoing traffic with the process that is sending it using a socket filter. It works great, and right now I have my kext sending the pid to a super user process in user space that gets the process path and sends it back. This is less than ideal, I would rather have the kext be able to get this info. I assume you want the path because you use the path to the application to associate the application with some rules regarding the traffic it can send. This isn't very robust though; what if someone moves the application? I just don't want my application to have all these processes have to be running for it to work. Being afraid of dividing responsibility along architectural lines loses you most of these benefits; you should design your application to work with the system, not try to bend the system to suit your prejudices. 8) = Mike _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... I would be much more inclined to use the proc_name KPI; in most cases this will remain unique. It's still not such a great idea to depend on the application name, but this is at least resistant to the application moving. I'm a little puzzled by this. The kernel makes it easy to run processes, it provides good mechanisms for communicating between them, and it makes them safe from one another. Having a bunch of processes cooperating can be a neat, tidy and robust way to architect a solution. This email sent to site_archiver@lists.apple.com