As far as I could understand from your mail, you want to inform your user space progam with some information, whenever the specified program acreates any child. If I am write in understanding your problem, the following think can give you a hint to implement the solution for it. For doing this, you need to implement you kernel module, which can work in kernel space, can intercept the fork system call and collect relevent information from kernel. You also need to implement and register a signal handler in your user space program. One more thing, you also might need to implement your own system call which can colect the relevemt information you need from yur kernel module. Lets start, you need to write your kernel module, which will actually intercept the fork system call (sys_fork) by manupulating the kernel system call table (sys_call_table, for information on system call interception read the doc at http://www.faqs.org/docs/kernel/x931.html). Once you have intercepted the fork system call, whenever the any process will make a fork system call, control will first come to your module function. Now what you need to do in your module function (which actually intercepts the fork system call), you need to check the name of the process which made that fork system call (you can check it by current->comm). If this is the name of the one of the programs you are spying on, you can collect the required information from current process, by reffering the elements of current process (in your case its mozilla or anything you are spying on). You collect all the information and save that in your kernel module specific data structure and also do set the signal bit in your user process task_struct, so that next time your user process makes any system call, your registered signal handler can be executed. Now in that signal handler, you need to talk to the kernel again by means of some system call (standard or your own implemented) and then fetch the stored information from your kernel module to user space and print that on console. Hope it makes sense. Anyway, it's a good idea and in case I get some free time, I too would like to implement it. Inc ase I implement it, I will share the code with you .... :) Cheers !! Gaurav -----Original Message----- From: aki ra [mailto:hioyjp@xxxxxxxx] Sent: Thursday, September 16, 2004 6:22 PM To: Dhiman, Gaurav Cc: kernelnewbies@xxxxxxxxxxxx Subject: RE: Send information from kernel to user --- "Dhiman, Gaurav" <Gaurav.Dhiman@xxxxxx> wrote : > > If you are trying to just write some specific data > to log file at each fork() and exit() system call, > it would be better that you register some type of > signal to the kernel first (using sigaction() system > call) and then do fork () and exit(). I'm trying to apply kind of user space filters. Here is what I'd like to do. A user space application will control the behaviour of some programs. For example, the user can add a program to be under control, let's say mozilla, and I want to display information about mozilla and all its children with my user space application and apply some filters (things like renice or anything else). That's why I need to know when mozilla calls sys_fork. The problem with the signal is that it will be send to mozilla but not to my user space application right? So, is it possible to send from the do_fork() routine a signal to my user space application (that is not the current one when forking)? Otherwise, I was thinking to use the kernel event notification patch but I think that using the routine send_kevent() when forking will slow down my system. Thank you for your help Regards, Patrick Vous manquez d'espace pour stocker vos mails ? Yahoo! Mail vous offre GRATUITEMENT 100 Mo ! Créez votre Yahoo! Mail sur http://fr.benefits.yahoo.com/ Le nouveau Yahoo! Messenger est arrivé ! Découvrez toutes les nouveautés pour dialoguer instantanément avec vos amis. A télécharger gratuitement sur http://fr.messenger.yahoo.com -- Kernelnewbies: Help each other learn about the Linux kernel. Archive: http://mail.nl.linux.org/kernelnewbies/ FAQ: http://kernelnewbies.org/faq/
