site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com <http://developer.apple.com/bugreporter/> S+E -- Quinn "The Eskimo!" <http://www.apple.com/developer/> Apple Developer Relations, Developer Technical Support, Core OS/Hardware _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... At 12:13 +0400 11/7/08, Maxim Zhuravlev wrote: I've been explorering the kauth FILEOP scope and found out, that for unexpectedly terminated or exit()'d process, which hadn't explicitly closed a file handle it was writing to, a KAUTH_FILEOP_CLOSE notification with KAUTH_FILEOP_CLOSE_MODIFIED flag set isn't issued. This happens, cause exit() closes all handles bypassing close() syscall, which actually checks flags and issues that kind of notifications. I would classify that as a bug. I encourage you to file it. Please post the bug number so that I can keep an eye on it. Are there any over documented means to get the same semantics for that kind of processes? The only thing that springs to mind is to hook into KAUTH_SCOPE_VNODE. That's less than ideal (the vnode scope has lots of gotchas and is really intended for authorization rather than monitoring), but I can't think of anything better. This email sent to site_archiver@lists.apple.com