Re: Re: kprobes & task_struct

[Frank Beckmann <rootman@xxxxxx>]

Hi Mulyadi

the problem with the freezed kernel is solved in kernel 2.6.15.
at home i have a bookmark, someone fix it in release candidate.

my kprobe runs fine, the parent is in the log and the command (uid too).

i hope i found time to wrote some code... but my free time is limited :-(
(evening school.. business economist)

relayfs... is it in the kernel or a patch ? 

my idea with the proc, has the proc system a ring-buffer ?

if nobody read from proc, the module can overwrite the old data...

Frank


mulyadi.santosa@xxxxxxxxx schrieb am 01.01.06 09:22:23:
> 
> Hi Frank...
> 
> > bash-> do_fork-> bash(available the environment for ls) -> execve ->
> > ls
> >
> > #strace -aef ls
> > execve("/bin/ls", ["ls"], [/* 22 vars */]) = 0
> >
> > I set the Return Probes  with do_execve as trigger
> >
> > Dec 31 22:39:11 fedorasys kernel: fc_pid = 3151 fc_command = rmmod 
> > parent_pid = 3040  parent_command = bash Dec 31 22:39:11 fedorasys
> > kernel:
> 
> 
> Ahh...:) Maybe something during do_fork() hasn't set the 
> task_struct->comm properly according the new ELF binary loaded.
> 
> But anyway, as you know, putting kprobe's hook on do_execve only catch 
> new binary invocation, is it really what you want? Previously I thought 
> you wanted to catch general fork scenario...CMIIW
> 
> Maybe what you need is putting the probe into multiple place e.g 
> sys_fork and sys_execve and so on.
> 
> > Now i search a way to export the data into the user pace. over the
> > standard syslog it goes account of system performance.
> > My module runs under 2.6.15-rc7 in older kernel versions my module
> > freeze the system
> 
> Try relayfs? Anyway, you said "freeze", during which event?
> 
> regards
> 
> Mulyadi
> 
> 
> --
> Kernelnewbies: Help each other learn about the Linux kernel.
> Archive:       http://mail.nl.linux.org/kernelnewbies/
> FAQ:           http://kernelnewbies.org/faq/
> 


______________________________________________________________________
XXL-Speicher, PC-Virenschutz, Spartarife & mehr: Nur im WEB.DE Club!		
Jetzt gratis testen! http://freemail.web.de/home/landingpad/?mc=021130


--
Kernelnewbies: Help each other learn about the Linux kernel.
Archive:       http://mail.nl.linux.org/kernelnewbies/
FAQ:           http://kernelnewbies.org/faq/