diff --git a/lib/libsys/kqueue.2 b/lib/libsys/kqueue.2 --- a/lib/libsys/kqueue.2 +++ b/lib/libsys/kqueue.2 @@ -592,6 +592,40 @@ The process has exited. The exit status will be stored in .Va data . +.It Dv NOTE_FORK +The process has forked. +The process identifier of the most recently forked child +is returned in the +.Va data +field. +.Pp +The identifier is advisory; +if several children were spawned before the event is returned, +only one of the PIDs is returned. +Other means might provide the reliable reporting of the children. +For instance, debugging the process with subscription for relevant +events would serialize forks. +See +.Xr ptrace 2 +and the description of the +.Dv PT_FOLLOW_FORK +request. +.Pp +Unlike the +.Dv EVFILT_PROC +filter, +the +.Dv NOTE_TRACK +pseudo-event is not supported. +.Pp +If both +.Dv NOTE_EXIT +and +.Dv NOTE_FORK +events are reported, then the +.Va data +field contains the exit status of the process, +the last child's PID is not returned. .It Dv NOTE_PDSIGCHLD Activates on events that are reported through .Xr pdwait 2 diff --git a/sys/kern/kern_fork.c b/sys/kern/kern_fork.c --- a/sys/kern/kern_fork.c +++ b/sys/kern/kern_fork.c @@ -781,6 +781,7 @@ * Tell any interested parties about the new process. */ knote_fork(p1->p_klist, p2->p_pid); + procdesc_fork(p1, p2->p_pid); PROC_UNLOCK(p1); SDT_PROBE3(proc, , , create, p2, p1, fr->fr_flags); diff --git a/sys/kern/sys_procdesc.c b/sys/kern/sys_procdesc.c --- a/sys/kern/sys_procdesc.c +++ b/sys/kern/sys_procdesc.c @@ -335,6 +335,22 @@ wakeup(&p->p_procdesc); } +void +procdesc_fork(struct proc *p, pid_t child_pid) +{ + struct procdesc *pd; + + PROC_LOCK_ASSERT(p, MA_OWNED); + pd = p->p_procdesc; + if (pd == NULL) + return; + + PROCDESC_LOCK(pd); + pd->pd_last_child = child_pid; + KNOTE_LOCKED(&pd->pd_selinfo.si_note, NOTE_FORK); + PROCDESC_UNLOCK(pd); +} + /* * When a process descriptor is reaped, perhaps as a result of close(), release * the process's reference on the process descriptor. @@ -506,6 +522,9 @@ return (1); } + if ((kn->kn_fflags & NOTE_FORK) != 0) + kn->kn_data = pd->pd_last_child; + return (kn->kn_fflags != 0); } diff --git a/sys/sys/event.h b/sys/sys/event.h --- a/sys/sys/event.h +++ b/sys/sys/event.h @@ -204,7 +204,8 @@ */ #define NOTE_EXIT 0x80000000 /* proc/procdesc: process exited */ -#define NOTE_FORK 0x40000000 /* proc: process forked */ +#define NOTE_FORK 0x40000000 /* proc/procdesc: process + forked */ #define NOTE_EXEC 0x20000000 /* proc: process exec'd */ #define NOTE_PDSIGCHLD 0x10000000 /* procdesc: pdwait() info available */ diff --git a/sys/sys/procdesc.h b/sys/sys/procdesc.h --- a/sys/sys/procdesc.h +++ b/sys/sys/procdesc.h @@ -64,6 +64,7 @@ */ struct proc *pd_proc; /* (t) Process. */ pid_t pd_pid; /* (c) Cached pid. */ + pid_t pd_last_child; /* (p) Pid of the last child. */ u_int pd_refcount; /* (r) Reference count. */ u_int pd_fpcount; /* (p|t) files referencing me */ @@ -102,6 +103,7 @@ * In-kernel interfaces to process descriptors. */ bool procdesc_exit(struct proc *); +void procdesc_fork(struct proc *p, pid_t child_pid); void procdesc_jobstate(struct proc *p); int kern_pdgetpid(struct thread *, int fd, const cap_rights_t *, pid_t *pidp);