Tag Info

Hot answers tagged

21

As a result of the pipe in x | y, a subshell is created to contain the pipeline as part of the foreground process group. This continues to create subshells (via fork()) indefinitely, thus creating a fork bomb. $ for (( i=0; i<3; i++ )); do > echo "$BASHPID" > done 16907 16907 16907 $ for (( i=0; i<3; i++ )); do > echo "$BASHPID" | cat ...


18

The last bit of the code, ;: is running the function :(){ ... }. This is where the fork is occurring. The semicolon terminates the first command, and we're starting another one, i.e. invoking the function :. The definition of this function includes a call to itself (:) and the output of this call is piped to a backgrounded version :. This props up the ...


14

System calls per se are a concept. They represent actions that processes can ask the kernel to perform. Those system calls are implemented in the kernel of the UNIX-like system. This implementation (written in C, and in asm for small parts) actually performs the action in the system. Then, processes use an interface to ask the system for the execution of ...


7

The fork() and vfork() wrappers in glibc are implemented via the clone() system call. To better understand the relationship between fork() and clone(), we must consider the relationship between processes and threads in Linux. Traditionally, fork() would dublicate all the resources owned by the parent process and assign the copy to the child process. This ...


6

I don't have that book to check, but I assuming its using the normal meaning of system calls, then a system call is a call into the kernel to perform some operation the hardware considers privileged, or is unaware of. This is used to enforce permissions, etc. on the system. So you need to make a system call to (among many other things): read from a file ...


6

No. Trivial counter example, this will interact with the kernel: int main() { volatile char *silly = 0; *silly = 'a'; } That'll call the kernel's page fault handler, ultimately resulting in your process getting a SIGSEGV (presuming the compiler doesn't "optimize" that code to do something other than the obvious, since that's undefined behavior by ...


5

The Linux kernel syscall API is the the primary API (though hidden under libc, and rarely used directly by programmers), and most standard IPC mechanisms are heavily biased toward the everything is a file approach, which eliminates them here as they ultimately require read/write (and more) calls. However, on most platforms (if you exclude all the system ...


5

A system call is a way to ask your operating system (kernel) to do some operation on behalf of your program, that the program can't do by itself (or is just inconvenient). The reason for not being able to do some operation is normally that allowing a random program to do them might compromise the integrity of the system, like doing I/O (directly to RAM, ...


4

In recent versions of Linux, you can unshare the mount namespace. That is, you can start processes that view the virtual file system differently (with file systems mounted differently). That can also be done with chroot, but unshare is more adapted to your case. Like chroot, you need superuser priviledged to unshare the mount namespace. So, say you have ...


4

Sure, let's do the how-many-directions-can-we-look-at-this-elephant-from? thing. The actual system call is, in your built program, the machine instruction that triggers the privilege escalation into kernel mode, and in the kernel itself it's the code that instruction invokes. The libc code (and every language runtime) sets up the machine registers and ...


3

In Linux at least the system call mechanism works under most architectures by placing some specifically formatted data (usually some kind of c struct) in either some registers or predefined memory addresses. The issue comes however in actually forcing the CPU to do the switch into kernel space so it can run the privileged kernel code to service the call. ...


3

NOTE: ALL THE BELOW INFORMATION IS FROM THE REFERENCED SITE From this link, I found the below information. A system call is an interface between a user-space application and a service that the kernel provides. Because the service is provided in the kernel, a direct call cannot be performed; instead, you must use a process of crossing the ...


3

Executing a process executes CPU instructions by definition. There are a few CPU instructions that can only be executed in a privileged mode, mostly instructions related to accessing hardware outside the CPU including the RAM or to modifying some configurations. The kernel is executed in privileged mode, ordinary processes are executed in unprivileged mode. ...


3

The raw system calls, like read(2), are defined in the C library (usually glibc under Linux). But what the definition in the library does is just to collect arguments, set them up for the special way in which they are passed to the kernel, and use a special mechanism to ask the kernel to do the job. It collects the results (including possible error ...


3

A "system call" is a call to a kernel function. This is needed for functionality managed by the kernel, like accessing devices. For "normal" operation like adding numbers no help from the kernel is needed. Therefore calling a library which is only computing stuff, no call to kernel space is needed, too. You can use strace to show all the system calls of a ...


3

Soft links. Create two config files, and point to one of them with a soft link most of the time, but change the soft link to point to the other one when the special app is running. (I know this is a horrible hack, but it's slightly more reliable than changing file contents). Or, manipulate $HOME. In the script which starts the annoying process, set $HOME ...


3

As derobert already indicated, probably the easiest way to get a different name in the process table is by renaming the 'private' python executable from python to wing_ide. The startup command, /usr/bin/wing4.1, is actually a minimal shell script calling a second script /usr/lib/wingide4.1/run-wing.sh this I patched as follows: @@ -66,7 +66,9 @@ # ...


3

A process can only write to its own /proc/pid/comm. So since it sounds like you can modify the IDE's code, you can just have it write to /proc/self/comm. Another option would be to change the name of its Python executable, and then change all the #! lines, but that may be a PITA. Other—more painful—options would be writing some C code and using LD_PRELOAD ...


2

You can see the entire command used to invoke a process using top, but it doesn't show it by default. Toggle that with lower case c. This should enable you to distinguish one python app from another. The difference between the command line invocation and the process name shows up in proc too, as cmdline and comm.


2

Systemtap should be able to do what you are looking for, that's a nice guide for it: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Linux/5/html/SystemTap_Beginners_Guide/


2

To the best of my knowledge this can't be done with strace, the ptrace function which is used internally does SIGSTOP or SIGINT on calls. EDIT: I inserted this simple solution in ministrace, so no coding is required. My proposed solution, if the not all the functionality of strace is required, would be to modify ministrace - which I found here Write ...


2

Check that you're using the latest version of bash. If you are, report a bug; be sure to indicate exactly where you obtained the bash binary if you installed an existing binary, or what compiler and compile-time configuration you used and where you obtained the source if you compiled bash by yourself. Also mention your exact version of AIX and your hardware ...


2

What is a kernel? In the sense of your question, it is a single large program that runs at a special privilege level on the processor. It provides all of the core operating system facilities: multitasking, IPC, file systems, etc. It is also the process that runs the device drivers, which in turn control the computer's hardware on behalf of the kernel. ...


2

The meaning of the term channel is explained earlier on the same page under the heading "File Structure Related System Calls": A channel is a connection between a process and a file that appears to the process as an unformatted stream of bytes As in Unix "Everything is a file", this includes file descriptors to regular files, but also different kinds ...


2

Devices are usually represented as device files in Linux - they can be read from and written to just like any other file. For example, the first hard disk in the system is usually represented as /dev/sda - you directly read from it, and you can also directly write to it (for example with dd to create or restore a disk image). For other purposes that can't ...


2

The time in poll is not wasted - it is the time the process waits for input data to "arrive" or for output buffers to be ready for new output data. You can use lsof to list the open descriptors (including sockets). How many CPU cores do you have in the system? How many cores can ccsm use? Your top listing shows around 100% CPU usage for ccsm.exe ...


2

The read() function is implemented in a shared library (libc) which makes available wrapped functions into userspace. This exposes "access" to these functions which physically reside within the kernel. You can convince yourself of this by taking a look at this diagram and noting that there are 2 tools for tracing these types of calls (system vs. shared ...


1

System calls are implemented in the kernel — that's why they're called "system" calls — but the mechanism for invoking a system call in the kernel is platform-specific and may involve special assembly instructions, so programs typically don't do this directly. The system's C library (libc) provides wrapper functions for system calls. These are ordinary ...


1

Yes, there are several ways to do it. I often use iwatch. $ touch yourfile $ iwatch -e all_events yourfile after another touch you'll get [26/Feb/2014 17:02:39] IN_OPEN yourfile [26/Feb/2014 17:02:39] IN_ATTRIB yourfile [26/Feb/2014 17:02:39] IN_CLOSE_WRITE yourfile [26/Feb/2014 17:02:39] * yourfile is closed [26/Feb/2014 17:02:40] IN_OPEN yourfile ...


1

These are the two scenarios where a block of sufficient size has been found. Notice in the first case, we are removing an entire node (fits) from memlist by linking the previous node's next pointer to the next pointer of this node. This block is then used in the return value, so I presume from that and the comments, etc. that the intent here is to find ...



Only top voted, non community-wiki answers of a minimum length are eligible