at_fork & at_exit

at_fork & at_exit

[Arun C Murthy]

Hi,

Im looking for linux equivalent of the FreeBSD calls:

1. at_fork

     typedef void
     (*forklist_fn)(struct proc *, struct proc *, int);

     int at_fork(forklist_fn func);

     The at_fork facility allows a kernel module to ensure that it is 
notified at any process fork.  The function func is called with the a 
pointer to the forking process's proc structure, a pointer to the 
child's process structure and a flag word, as used in rfork(2) to 
indicate the type of fork.

     If the requirement for notification is removed, then the function 
rm_at_fork() must be called with the exact func argument as the 
corresponding call to at_fork().

2. at_exit

     typedef void (exitlist_fn) (struct proc *);

     int at_exit(exitlist_fn func);

     The at_exit facility allows a kernel module to ensure that it is 
notified at any process exit.  The function func is called with the a 
pointer to the exiting process's proc structure.



  Specifically im on RHEL3... any pointers are appreciated...

thanks,
Arun

Re: at_fork & at_exit

[Jan Engelhardt]

> Hi,
>
> Im looking for linux equivalent of the FreeBSD calls:
>
> 1. at_fork
>
> typedef void
> (*forklist_fn)(struct proc *, struct proc *, int);
>
>    int at_fork(forklist_fn func);

I do not see such a hook in the kernel source tree, so adding your own seems 
to only way.

The places are in kernel/fork.c:copy_process() and 
kernel/exit.c:__unhash_process



Jan Engelhardt
-- 
ENOSPC

Re: at_fork & at_exit

[Rik van Riel]

On Tue, 21 Dec 2004, Arun C Murthy wrote:

> Im looking for linux equivalent of the FreeBSD calls:
>
> 1. at_fork
> 2. at_exit

> Specifically im on RHEL3... any pointers are appreciated...

What do you want to use them for ?

If it is for security logging, it may be an option to use
the syscall auditing code ...

-- 
"Debugging is twice as hard as writing the code in the first place.
Therefore, if you write the code as cleverly as possible, you are,
by definition, not smart enough to debug it." - Brian W. Kernighan

Re: at_fork & at_exit

[Shankar Unni]

Arun C Murthy wrote:

> Im looking for linux equivalent of the FreeBSD calls:
> 1. at_fork
> 2. at_exit

There is an ANSI C equivalent of at_exit: it's called atexit(). Use that 
  instead of OS-specific hacks like at_exit.

No direct analog to at_fork() that I know of, but there's a "sort of" 
equivalent thing you can use: pthread_atfork(). No reason why you can't 
use it, even if your program is not multi-threaded..

Re: at_fork & at_exit

[Arun C Murthy]

[-- Attachment #1: Type: text/plain, Size: 426 bytes --]

Jan Engelhardt wrote:

>>Hi,
>>
>>Im looking for linux equivalent of the FreeBSD calls:
>>
>>1. at_fork
>>2. at_exit
>>    
>>
>I do not see such a hook in the kernel source tree, so adding your own seems 
>to only way.
>The places are in kernel/fork.c:copy_process() and 
>kernel/exit.c:__unhash_process
>  
>
  here's patches if someone else is interested... pls let me know if 
there are any improvements possible...

Arun

[-- Attachment #2: atforkexit.patch.tar.gz --]
[-- Type: application/gzip, Size: 1937 bytes --]