用户空间进程上的Linux内核模块信号被杀死 [英] Linux kernel module signal on userspace process killed

问题描述

我想知道是否有一个钩子可以在Linux内核模块中使用，而当用户空间应用程序/进程被杀死时，该钩子会被触发?

I'm wondering if there is a hook that could be used in a Linux Kernel Module that is fired when a user space application/process is killed ?

推荐答案

您可以先在内核模块中注册通知程序链.

You could first register for a notifier chain within your kernel module.

在get_signal_to_deliver( kernel/signal.c )内，杀死了 just (这是IMHO的相对术语)的任何进程都有其 PF_SIGNALED 标志已设置.在这里，您可以使用它的tcomm字段检查 current 进程的名称，如下所示:

Inside get_signal_to_deliver(kernel/signal.c), any process which has just (this being a relative term IMHO) been killed has its PF_SIGNALED flag being set. Here you could check for the name of the current process using its tcomm field like so:

char tcomm[sizeof(current->comm)];
get_task_comm(tcomm, current);

如果确实存在问题，您可以触发通知链，这将唤醒正在该链上等待的模块.

If it is indeed the process under question, you could just fire the notification chain which will awaken your module which has been waiting on that chain.

这篇关于用户空间进程上的Linux内核模块信号被杀死的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！