Re: Accessing process information from inside a LKM?

• Previous message: Security Alert: "SSRT4878 rev.2 Ignite-UX failed to save /etc/passwd for trusted systems"
• In reply to: Shaun Clowes: "Re: Accessing process information from inside a LKM?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

Date: Fri, 03 Dec 2004 15:16:50 GMT

On Fri, 3 Dec 2004 09:58:55 +1100, Shaun Clowes
<delius@no.spam.for.me.progsoc.org> wrote:
>
> As far as I'm aware, you will need to traverse the structures manually, I'm
> not aware of a kernel interface to lock the list and iterate across it.
> However, when accessing the entries themselves you should always try to use
> the interfaces defined in /usr/include/sys/proc_iface.h. The proc struct has
> definitely changed a number of times in annoying ways during the 11 series.

Hi. Thanks for the fast response. I was indeed afraid that the private part
of the proc struct changes frequently. Something I (and my customer) will
have to live with since they're fairly insistant on doing this from within
the LKM rather than from userspace.

You mentioned locking the list...I'm glad you brought this up because I
forgot to ask about it in my original post. Looking at the q4-generated
proc structure, I see "lock_t *p_lock" which presumably serializes access
to the individual proc entries but I didn't see anything in
/usr/include/sys/spinlock.h that suggests that the system process list
itself is protected by a lock. This bothers me.

One other question: ignoring the potential locking issue above, I'm curious
about actually walking the process list. I understand that HP-UX 11i uses
a linked list of proc structures rather than a static array? In the proc
structure, I see reference to 6 pointers:
   p_cache_next and p_cache_prev
   p_pptr, p_cptr, p_osptr and p_ysptr, p_dptr

I assume the last 4 are parent, youngest child, and oldest/youngest sibling.
I'm not sure what p_cache_* are used for (possibly analogous to cached
threads?). I'm also not sure what p_dptr refers to (orphaned descendants?).
Does one navigate the process list using the five child/sibling pointers or by
some other pointer that I've missed (or even possibly by using the p_cache_*
pointers)?

Thanks again for your help.

>
> Cheers,
> Shaun
>

Jimmie

-- 
Jimmie Mayfield  
http://www.sackheads.org/mayfield    email: mayfield+usenet@sackheads.org
My mail provider does not welcome UCE -- http://www.sackheads.org/uce

• Previous message: Security Alert: "SSRT4878 rev.2 Ignite-UX failed to save /etc/passwd for trusted systems"
• In reply to: Shaun Clowes: "Re: Accessing process information from inside a LKM?"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]