From mboxrd@z Thu Jan 1 00:00:00 1970 From: Christoph Hellwig Subject: Re: Task watchers v2 Date: Fri, 15 Dec 2006 09:34:14 +0100 Message-ID: <20061215083414.GA13884@lst.de> References: <20061215000754.764718000@us.ibm.com> <20061215000817.771088000@us.ibm.com> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <20061215000817.771088000@us.ibm.com> Sender: linux-kernel-owner@vger.kernel.org To: Matt Helsley Cc: Andrew Morton , Linux-Kernel , Jes Sorensen , Christoph Hellwig , Al Viro , Steve Grubb , linux-audit@redhat.com, Paul Jackson List-Id: linux-audit@redhat.com On Thu, Dec 14, 2006 at 04:07:55PM -0800, Matt Helsley wrote: > Associate function calls with significant events in a task's lifetime much like > we handle kernel and module init/exit functions. This creates a table for each > of the following events in the task_watchers_table ELF section: > > WATCH_TASK_INIT at the beginning of a fork/clone system call when the > new task struct first becomes available. > > WATCH_TASK_CLONE just before returning successfully from a fork/clone. > > WATCH_TASK_EXEC just before successfully returning from the exec > system call. > > WATCH_TASK_UID every time a task's real or effective user id changes. > > WATCH_TASK_GID every time a task's real or effective group id changes. > > WATCH_TASK_EXIT at the beginning of do_exit when a task is exiting > for any reason. > > WATCH_TASK_FREE is called before critical task structures like > the mm_struct become inaccessible and the task is subsequently freed. > > The next patch will add a debugfs interface for measuring fork and exit rates > which can be used to calculate the overhead of the task watcher infrastructure. What's the point of the ELF hackery? This code would be a lot simpler and more understandable if you simply had task_watcher_ops and a register / unregister function for it.