Re: watch structure
On Monday 04 April 2005 17:36, Timothy R. Chavez wrote:
However, I do not plan on passing them to and from the kernel as
structures,
but as a serialized strings.
Its in the kernel as pieces, why not just fill in the structure and send it to
user space? That has to be simpler to code (3 assignments & 2 strcpy's). Why
invent yet another way to pass data?
Also, I wouldn't recommend wasting so much space by statically
allocating
4096 (or whatever MAX_PATH happens to be) for each name... considering any
file we're interested in auditing is unlikely to be MAX_PATH or even close
to MAX_PATH. Space is more valuable in the kernel, both on the stack and
in memory, then it is in user space.
Right, but this is just for transit. Once inside the kernel it can be put into
a memory area that is as long as strlen - which is what's done currently.
And the memory should already be copied into the kernel by the time
the
process ends.
What guarantees that? netlink receive is asynchronous.
-Steve