hooks: do_exit kprobe for authoritative process-exit capture - #95
Open
lacraig2 wants to merge 1 commit into
Open
hooks: do_exit kprobe for authoritative process-exit capture#95lacraig2 wants to merge 1 commit into
lacraig2 wants to merge 1 commit into
Conversation
A kprobe on do_exit fires on every user-process death -- normal
exit/exit_group, fatal signals, OOM, kernel-forced -- which the
exit/exit_group syscall hooks miss (a signal death issues no exit
syscall). Emits struct exit_event {pid,tid,create_time,code,comm} via
IGLOO_HYP_PROC_EXIT with the raw wait(2)-status-encoded code, so the
host decodes WIFSIGNALED/WIFEXITED without heuristics. Reports at
thread-group-leader death (user procs only) to map 1:1 onto the
for_each_process walk.
Enable-gated: the kprobe is armed lazily on the host register op and
removed on unregister (register/unregister_exit_hook portal ops), so an
un-opted-in run pays zero cost. do_exit is NOKPROBE-blacklisted on some
kernels; registration degrades gracefully (logs, no events) rather than
failing module load.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A kprobe on
do_exitfires on every user-process death — normalexit/exit_group, fatal signals, OOM, kernel-forced — which theexit/exit_groupsyscall hooks miss (a signal death issues no exit syscall). It emitsstruct exit_event {pid, tid, create_time, code, comm}via a newIGLOO_HYP_PROC_EXIThypercall, withcodein raw wait(2)-status encoding so the host decodesWIFSIGNALED/WIFEXITEDwithout heuristics. Reported at thread-group-leader death (user procs only) so it maps 1:1 onto thefor_each_processwalk.Enable-gated / zero-cost when off: the kprobe is armed lazily on the host
register_exit_hookportal op and removed onunregister, so an un-opted-in run installs no probe at all.do_exitisNOKPROBE-blacklisted on some kernels; registration degrades gracefully (logs, no events) rather than failing module load. If that ever bites a target, switchsymbol_nameto thesched_process_exittracepoint.Files: new
src/hooks/exit_hc.c/.h; wired viaigloo_hypercall_consts.h(IGLOO_HYP_PROC_EXIT),portal_op_list.h(register/unregister ops, X-macro auto-wires enum+dispatch+prototypes),igloo_hc.c(init),Makefile.Consumed by penguin PR #897 (
exit_monitor+processesuse_do_exit). Builds clean across the arch/version matrix; validated live via the pre-releasev0.0.94-pre.df8576ef7cut from this branch's tag, whose ISF carriesHYPER_OP_REGISTER_EXIT_HOOK/IGLOO_HYP_PROC_EXIT/exit_event(penguin's ABI gate green against it).