Re: [ANNOUNCE] Kernel Generalized Event Management

[Bob Bennett <Robert.Bennett2@ca.com>]

On Mon, 2004-08-30 at 18:39, Chris Wright wrote:

> So, why so much patch to do what's already available in the kernel?  With
> LSM, plus audit, you can generate events that userspace can consume via
> netlink w/out this /proc stuff, and sys_call_table symbol lookup stuff,
> the kernel hooks, etc.
> 
I am looking into netlink implementation.  If it performs better, there
is no reason not to use it.  My intention is to provide a method for
handling _synchronous_ event notification, in a general enough way so
that it can be useful to a variety of userspace applications, and be
reasonably simple for an app to use.  The /proc implementation filled
that need.  Additionally, with netlink, it looks like I will need a
dedicated kernel thread that receives responses on the socket and wakes
up waiting tasks.  

It appears that Robert Love's Kernel Events Layer project is attempting
to address a lot of these event management issues.  An alternative is to
build upon this project to support synchronous event handling as well as
the event broadcasting that it performs now. 

As for hooks, LSM and audit do provide all the callouts I need for
generating events in 2.6.  The module that did sys_call_table lookup was
developed for working with 2.4 kernels that don't have LSM patch
applied, and should not have been included in the 2.6 patch.   

thanks,
	Bob

> How about starting by showing exactly what pieces are missing in the
> kernel?  This looks like things that can easily be done using existing
> infrastructure.
> 
> thanks,
> -chris