Re: Extending LOG target to display pid

[Tobias DiPasquale <codeslinger@gmail.com>]

On 7/5/05, Nick Hay <nickjhay@hotmail.com> wrote:
> 2. Any ideas on how I can get the pid of a local packet's creator in the
> log module?  I couldn't find any structures connected to the sk_buff
> that might contain it, and couldn't think of where the data would
> originally come from.

A security framework, with the proper auditing and accounting
mechanisms in place in the network stack could make this possible (any
it may already be). But in general, it would be quite a lot of work to
add the necessary code to the stack to account for the
sending/receiving PID at the correct stage. Unless you're doing MAC,
its probably not worth it.

> Actually... would current->pid work?

No, because there's no guarantee that the same process is on the CPU
by the time the packet hits your rule.

Can't check on #1 right now, but I believe that its filled in by the
module itself in whatever way it chooses.

-- 
[ Tobias DiPasquale ]
0x636f6465736c696e67657240676d61696c2e636f6d