On Thu, 2005-02-17 at 18:50 +0300, Evgeniy Polyakov wrote: > On Thu, 2005-02-17 at 15:55 +0100, Guillaume Thouvenin wrote: > > It's a new patch that implements a fork connector in the > > kernel/fork.c:do_fork() routine. The connector sends information about > > parent PID and child PID over a netlink interface. It allows to several > > user space applications to be alerted when a fork occurs in the kernel. > > The main drawback is that even if nobody listens, a message is send. I > > don't know how to avoid that. I added an option (FORK_CONNECTOR) to > > enable the fork connector (or disable) when compiling the kernel. To > > work, connector must be compiled as built-in (CONFIG_CONNECTOR=y). It > > has been tested on a 2.6.11-rc3-mm2 kernel with two user space > > applications connected. > > > > It is used by ELSA to manage group of processes in user space. In > > conjunction with a per-process accounting information, like BSD or CSA, > > ELSA provides a per-group of processes accounting. > > I think people will complain here... > ... [cut here] ... > I still think that lsm with all calls logging is the best way to > achieve this goal.
I agree with you. My first implementation was with LSM but Chris Wright (I think it was him) notice that it's not the right framework (and it seems true). So I looked for another solution. I though about kobject but it was too "big" and finally, Greg KH spoke about connectors. It's small and efficient. > from the other side why only fork is monitored in this way? The problem is the following: I have a user space daemon that manages group of processes. The main idea is, if a parent belongs to a group then its child belongs to the same group. To achieve this I need to know when a fork occurs and which processes are involved. I don't see how to do this without a hook in the do_fork() routine... Any ideas are welcome. Thank you Evgeniy for all your comments about the code, it helps and I will modify the patch. Regards, Guillaume - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to [EMAIL PROTECTED] More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/