Question

我开发了一个用Qt（C ++）和Objective-C编写的OSX守护程序应用程序。我使用内核扩展监视其他应用程序和进程何时启动，但需要知道它们何时被终止。

有没有办法收到终止其他流程的通知，而不必经常轮询目标流程的pid或mach任务？

Answer 1

你可以用kqueue / kevent做到这一点。我修改了一个控制台应用程序，然后对它进行了一些重构，以便稍微明白发生了什么，并添加了一个辅助函数来更轻松地调用它。只是勉强测试，但希望它能给你一个前进的方法......

哦，是的，请注意，此代码假设主运行循环正在应用程序中运行...并且它将从该runloop中调用该块...简单到足以用另一个运行循环替换它...或者，如果您没有使用任何CF运行循环，则必须将kq文件描述符添加到您正在使用的任何通知机制中。

修改

修复了重新启用回调的错误，因为每次触发后必须重新启用文件描述符回调。此外，make args采用多个PID来演示监控多个PID。

当然，您可以轻松地使用调用委托方法而不是使用块，但这不是真正的重点......

Argh ....修复资源泄漏...我可能无法修复更多...因为它是一个被黑客攻击的例子，但每次我回去阅读它，我发现有些不对劲......也许我和＃39;我只是停止阅读： - ）

// main.c #include <CoreFoundation/CoreFoundation.h> #include <sys/types.h> #include <sys/event.h> #include <sys/time.h> static void kqueueCallbackOnExit(CFFileDescriptorRef fileDescriptor, CFOptionFlags flags, void *info) { int fd = CFFileDescriptorGetNativeDescriptor(fileDescriptor); struct kevent event; if (kevent(fd, NULL, 0, &event, 1, NULL) == 1 && event.udata) { void (^cb)(pid_t) = event.udata; cb((pid_t)event.ident); Block_release(cb); } CFFileDescriptorEnableCallBacks( fileDescriptor, kCFFileDescriptorReadCallBack); } static int createOnProcessExitQueue() { int kq = kqueue(); if (kq < 0) return -1; CFFileDescriptorContext context = { .version = 0, .info = NULL, .retain = NULL, .release = NULL, .copyDescription = NULL }; CFFileDescriptorRef kqFileDescriptor = CFFileDescriptorCreate( NULL, kq, true, kqueueCallbackOnExit, &context); if (kqFileDescriptor == NULL) { close(kq); kq = -1; return -1; } CFRunLoopSourceRef runLoopSource = CFFileDescriptorCreateRunLoopSource( NULL, kqFileDescriptor, 0); CFRunLoopAddSource(CFRunLoopGetMain(), runLoopSource, kCFRunLoopDefaultMode); CFRelease(runLoopSource); CFFileDescriptorEnableCallBacks( kqFileDescriptor, kCFFileDescriptorReadCallBack); CFRelease(kqFileDescriptor); return kq; } static int onProcessExit(pid_t pid, void (^callback)(pid_t pid)) { static int kq; static dispatch_once_t onceToken; dispatch_once(&onceToken, ^{ kq = createOnProcessExitQueue(); }); void (^cb)(pid_t) = Block_copy(callback); struct kevent event = { .ident = pid, .filter = EVFILT_PROC, .flags = EV_ADD | EV_ONESHOT, .fflags = NOTE_EXIT, .data = 0, .udata = (void*)cb }; if (kevent(kq, &event, 1, NULL, 0, NULL) != 1) { Block_release(cb); return -1; } return 0; } int main(int argc, const char * argv[]) { for (int i = 0; i < argc; ++i) { pid_t pid = atoi(argv[i]); printf("watching pid: %d\n", pid); fflush(stdout); onProcessExit(pid, ^(pid_t pid) { printf("process %d just died\n", (int)pid); fflush(stdout); }); } CFRunLoopRun(); return 0; }

Answer 2

感谢@JodyHagins，我在kqueue和kevent上所做的研究让我看到了this blog，它展示了如何使用GCD来监控文件和an example by Apple here。以此为模板，我想出了这个： -

struct ProcessInfo
{
    int pid;
    dispatch_source_t source;
};

// function called back on event
void pid_event(struct ProcessInfo* procinfo)
{
    printf("****** Application exited: %d ******\n", procinfo->pid);
    dispatch_source_cancel(procinfo->source);
}

// function called back when the dispatch source is cancelled
void pid_finalize(struct ProcessInfo* procinfo)
{
    dispatch_release(procinfo->source);
    printf(">>>> Finished with %d <<<<\n", procinfo->pid);
    delete procinfo;
}

// Monitor a process by pid, for termination
void DispatchMonitorProcess(int pid, ProcessInfo* procinfo)
{
    procinfo->pid = pid;

    dispatch_queue_t queue = dispatch_get_global_queue(DISPATCH_QUEUE_PRIORITY_DEFAULT, 0);
    dispatch_source_t dsp = dispatch_source_create(DISPATCH_SOURCE_TYPE_PROC, pid, DISPATCH_PROC_EXIT, queue);

    dispatch_source_set_event_handler_f(dsp, (dispatch_function_t)pid_event);
    dispatch_source_set_cancel_handler_f(dsp,  (dispatch_function_t)pid_finalize);

    procinfo->source = dsp;
    dispatch_set_context(dsp, procinfo);

    dispatch_resume(dsp);
}

// Monitors the termination of a process with the given pid
void MonitorTermination(int pid)
{           
   DispatchMonitorProcess(pid, new ProcessInfo);
}

Answer 3

The following example takes a UNIX process ID as argument, and watches up to 20 seconds, and reports if the process terminates in that time

// cc test.c -framework CoreFoundation -O
#include <CoreFoundation/CoreFoundation.h>
#include <unistd.h>
#include <sys/event.h>
static void noteProcDeath(CFFileDescriptorRef fdref, CFOptionFlags callBackTypes, void *info) {
    struct kevent kev;
    int fd = CFFileDescriptorGetNativeDescriptor(fdref);
    kevent(fd, NULL, 0, &kev, 1, NULL);
    // take action on death of process here
    printf("process with pid '%u' died\n", (unsigned int)kev.ident);
    CFFileDescriptorInvalidate(fdref);
    CFRelease(fdref); // the CFFileDescriptorRef is no longer of any use in this example
}
// one argument, an integer pid to watch, required
int main(int argc, char *argv[]) {
    if (argc < 2) exit(1);
    int fd = kqueue();
    struct kevent kev;
    EV_SET(&kev, atoi(argv[1]), EVFILT_PROC, EV_ADD|EV_ENABLE, NOTE_EXIT, 0, NULL);
    kevent(fd, &kev, 1, NULL, 0, NULL);
    CFFileDescriptorRef fdref = CFFileDescriptorCreate(kCFAllocatorDefault, fd, true, noteProcDeath, NULL);
    CFFileDescriptorEnableCallBacks(fdref, kCFFileDescriptorReadCallBack);
    CFRunLoopSourceRef source = CFFileDescriptorCreateRunLoopSource(kCFAllocatorDefault, fdref, 0);
    CFRunLoopAddSource(CFRunLoopGetMain(), source, kCFRunLoopDefaultMode);
    CFRelease(source);
    // run the run loop for 20 seconds
    CFRunLoopRunInMode(kCFRunLoopDefaultMode, 20.0, false);
    return 0;
}

对于那些几乎不了解C的人：
版本：cc test.c -framework CoreFoundation -O
运行：./a.out 57168
57168是正在监视的进程的pid。杀死它进行测试！

当然，您可以延长20秒以使其持续尽可能长的时间。

进程退出时收到通知

3 个答案: