Re: Is fork() hook ever possible?

On Tue, 16 Sep 2008, Andrey Chernov wrote:

> On Tue, Sep 16, 2008 at 04:53:54PM +0200, Attilio Rao wrote:
>> 2008/9/16, Andrey Chernov <ache_at_nagual.pp.ru>:
>>> On Tue, Sep 16, 2008 at 03:38:16PM +0100, Bob Bishop wrote:
>>> > Hi,
>>>
>>>>
>>> > On 16 Sep 2008, at 15:03, Andrey Chernov wrote:
>>> >
>>> >> I need some sort of fork() hook to detect that pid is changed to re-
>>> >> stir
>>> >> ar4random() after that (in the child), simple flag variable with
>>> >> child's pid is needed.
>>> >>
>>> >> Currently OpenBSD does almost that checking getpid() every time
>>> >> arc4random() called, but it is very slow way to use getpid() syscall
>>> >> repeatedly, about 12-15 times slower than just arc4random() without
>>> >> getpid().
>>> >>
>>> >> Any ideas?
>>> >
>>>
>>>> How about something hacky using mmap()/minherit()?
>>>
>>>  Could you please provide working low cost example to detect that we are in
>>>  the child (pid changed or something else)? Calling getpid() as OpenBSD
>>>  does definitely is very high cost. :(
>>
>> An idea would be to implement a shared page between process and system
>> which exports such informations.
>> I'm sure we have a SoC project (2007) implementing this and perforce
>> branches for it, I'm just not sure how far it did end.
>
> Please keep in mind that the hook itself must be invisible to user
> application, we have standard API only - fork() and arc4random() family,
> no additional setup or functions are possible outside of existen API. I.e.
> the low cost hack must be completely inside ether the fork() wrapper or
> arc4random().

Well, you could speed up getpid() by having libc wrap all fork()
variants.  The idea is that getpid() would only call __sys_getpid()
the first time it was called and then only after a fork().  It
would return the saved process id for all other cases.

This wouldn't work if the application made its own syscall
without going through libc.

The shared page between process and system has been tossed around
before and would probably be more benficial.  Having access to
time without making a syscall would be nice.

-- 
DE