cukinia_kprocess

[P-D-G]

As explained in issue #59, cukinia_process allows checking that a user process is running, however it explicitly doesn't allow testing kernel processes:

        # skip kernel threads
        [ -x $procdir/exe ] || continue

It can be legitimate to verify that some key kernel threads are running, for instance [watchdogd].

This pull-request implements the suggested cukinia_kprocess command.

[deribaucourt]

LGTM

[joufellasfl]

Some userspace processes rewrite their cmdline (by changing their argv[0]) which could result in passing this test. What about testing that readlink proc/$pid/exe is empty, a userspace process will always be started from a non-null executable

[P-D-G]

I'm not sure which is better. I just tried with readlink and systemd looks has a bit of a weird behavior:

• its cmdline in /sbin/initsplash and detected as a user process
• its exe is empty and detected as a kernel thread

ps looks like it detects it as a user process too. Which one is correct ?

[joufellasfl]

This is not ideal as non-determinstic (sometimes we'll grab false-positive user processes, sometimes not). Maybe a few other deterministic differentiators in /proc/${pid} ? eg. "maps" will be empty for kernel threads, but shall not be for user processes (whether static or dynamic).

[P-D-G]

"maps" is only readable by root or in sudo, so would break some tests.
I'll be looking at alternatives and update this PR when I find something deterministic and correct.

[deribaucourt]

procps-ng uses the cmdline attribute to provide brakcets for kernel threads.

    // This routine reads a 'cmdline' for the designated proc_t, "escapes"
    // the result into a single string while guaranteeing the caller a
    // valid proc_t.cmdline pointer.
static int fill_cmdline_cvt (const char *directory, proc_t *restrict p) {
 #define uFLG ( ESC_BRACKETS | ESC_DEFUNCT )
    if (read_unvectored(src_buffer, MAX_BUFSZ, directory, "cmdline", ' '))
        escape_str(dst_buffer, src_buffer, MAX_BUFSZ);
    else
        escape_command(dst_buffer, p, MAX_BUFSZ, uFLG);
    p->cmdline = strdup(dst_buffer[0] ? dst_buffer : "?");
    if (!p->cmdline)
        return 1;
    return 0;
 #undef uFLG
}

[deribaucourt]

The more accurate alternative that seems the easiest to test from cukinia is the presence of a VmSize attribute in the status file. Kernel threads do not have a VMSize obviously. Pushing a commit for that.

[joufellasfl]

I think the term used by Linux is "kernel thread", started by the kthread API.

[joufellasfl]

(ditto for the test name)

[deribaucourt]

Converted terminology to kernel thread

[joufellasfl]

Adding relevant thread on SO: https://stackoverflow.com/questions/12213445/identifying-kernel-threads

EDIT: important points:

• Some apps like tweaking their cmdline, which could end up empty
• Check the output of readlink(exe) rather than dereferencing. On kernel threads, the link is empty, while user process readlink to a file path (which could be nonexistent and return an error)
• Kernel threads (pid > 1) have a parent process == 0 in /proc/$pid/stat

[deribaucourt]

@P-D-G I implemented the recommendations. Let me know if you have any remarks on my commits. Cheers!

[P-D-G]

@P-D-G I implemented the recommendations. Let me know if you have any remarks on my commits. Cheers!

This looks good to me @deribaucourt. Thanks for this, I wouldn't have had time before end of the week :)

[joufellasfl]

Merged, thanks!