On Wednesday, October 16, 2002, at 06:29 AM, Peter Lovell wrote: On Wednesday, October 16, 2002, at 07:23 AM, ollie@mac.com wrote: Hi fokes, I have a socket filter and I'm trying to get the pid that created or currently "ownes" the socket. I'd like to be able to get this info from the kernel without having to go out to user space... Any suggestions appreciated !!! -Ollie. It's ugly and not part of the sanctioned kext interface, but sometimes you just have to ... struct proc* p; p = current_proc(); now look at p->p_cred->p_ruid and p->p_ucred->cr_uid To get the creator you have to get the proc pointer at socreate time. The current owner might be different. Whether or not that matters to you depends on what you're doing, of course. Keep in mind that socket descriptors, like file descriptors, can be passed around from process to process, either with fork or explicitly, so as Peter says, you can't be sure whether you have the creator. Also, for the same reason, there is no "owner", since multiple processes can have valid access to that "socket". To make your life even more complicated, there's no guarantee, in general, that when your piece of the kernel is active, any of the processes that have access to that socket are actually active, or that you are executing in one of their threads. If the activity is, for example, transmission of TCP datagrams (segments), this could be triggered by incoming TCP ACK's, so that your extension might be running in a "kernel thread". Exercise caution :-}. Regards, Justin -- Justin C. Walker, Curmudgeon-At-Large * Institute for General Semantics | It's not whether you win or lose... | It's whether *I* win or lose. *--------------------------------------*-------------------------------* _______________________________________________ darwin-kernel mailing list | darwin-kernel@lists.apple.com Help/Unsubscribe/Archives: http://www.lists.apple.com/mailman/listinfo/darwin-kernel Do not post admin requests to the list. They will be ignored.