osx内核如何获得如此多的文件操作 [英] how come osx kernel get so many times of file operations

问题描述

我在用户空间中创建了一个文件(使用touch命令)，我预计只会看到一个OPEN和一个CLOSE文件操作，但是，我从内核通知中得到了2个OPEN和3个CLOSE操作.操作顺序如下: 打开->关闭->打开->关闭--->关闭... 有人可以给我一些提示吗? 提前致谢.

I create a file in userspace(using touch command), I am expecting to see only one OPEN and one CLOSE file operations, however, I get 2 OPEN and 3 CLOSE operations from kernel notification. the operations sequence is like this: open --> close --> open --> close ---> close.... can anybody give me some hints about this? thanks in advance.

推荐答案

Kauth vnode和fileop侦听器一直对我有效.如果您收到对您没有意义的事件通知，建议您使用内核调试器在kauth侦听器回调中放置一个断点，然后查看回溯. xnu源代码是可用的，因此您应该能够从中弄清楚并回溯为什么收到有问题的通知.

Kauth vnode and fileop listeners have been working well for me. If you are receiving event notifications that don't make sense to you, I suggest placing a breakpoint in your kauth listener callback using the kernel debugger and looking at the backtrace. The xnu source code is available, so you should be able to work out from that and the backtrace why you are receiving the notification in question.

我知道，如果一个文件有多个句柄，您将获得额外的关闭通知.因此，如果您打开文件dup()文件描述符，然后关闭两个句柄，则将打开一次，然后关闭2次.恐怕就是这样.没有公共内核API来确定进程在特定文件上是否还有剩余句柄.

I know that you can get extra close notifications if there are multiple handles to a file. So if you open the file, dup() the file descriptor, then close both handles, you'll get one open and 2 closes. That's just how it is, I'm afraid. There's no public kernel API for determining if a process has a remaining handle on a particular file.

至于为什么您会收到2条打开的通知-可能与touch的编写方式有关，或者与shell有关.通常，打开的通知确实确实与open() syscall相对应.如有疑问，请编写自己的触摸"工具，该工具仅调用一次打开和关闭操作，以测试您是否获得了正确的事件.如果需要，也可以使用Apple的touch命令的源代码.

As for why you are receiving 2 open notifications - it could be to do with the way touch is written, or something to do with the shell. Normally an open notification really does correspond to an open() syscall. If in doubt, write your own "touch" tool that only calls open and close once to test that you're getting the correct events. The source for Apple's touch command is available too if you need it.

这篇关于osx内核如何获得如此多的文件操作的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！