mjhjmtu

In order to make it easier to develop a kernel module, I am considering Loadable kernel modules (LKMs) on MacOS. This way you have a base kernel module and your main kernel module which is an LKM which you can somehow load into the base one without having to rebuild and redeploy the kernel module every change (which sounds cumbersome and time consuming).

But first, LKM seems to be a Linux concept, and it seems KEXT (Kernel Extensions) are the Mac equivalent ("Dynamically loadable modules for extending the kernel"). So it sounds like you get the benefit of dynamically loading kernel modules by default on MacOS.

I would then like to visualize some of the data retrieved from the KEXT. An example might be like LittleSnitch visualizing the processes and their properties, or GDB visualizing the current snapshot of a process' evaluation. I am wondering if I could do this in HTML/JavaScript. This would mean I am communicating between kernel space and user land I'd imagine. So it would work something like this:

// (X)
KEXT 
 fetch_processes()

 pause_process()


Userland browser stuff 
 <button onclick="pauseProcess()">Pause Process</button>

 function pauseProcess() 
 // http request to node.js
 


Userland node.js stuff 
 /process/:id/pause (req) -> 
 KEXT.pauseProcess(req.params.id)
 

 KEXT = 
 pauseProcess: function(id)
 // (Y)
 // Somehow make call to native KEXT
 
 

The spots marked X and Y are where I'm wondering. The Y spot is in a Node.js/JavaScript server. From my understanding this is in "userland". The X is kernel space.

There are a few ways to access the "kernel-land" space from userland:

1. Custom syscalls.


2. netlink (don't know anything about yet)


3. Virtual file systems


4. polling

I am not sure how to do any of these yet, and am wondering what the best approach is here to maintain the security imposed by the kernel/user separation. Maybe I move more kernel code to the userspace and keep the kernel space thin as well.

I am aware of the potential use of C bindings in node. However, for the moment only considering perhaps connecting to the kernel module through command-line invocation like my_kext_project pause 123.

Mainly I am wondering the best way to communicate between these two layers and still maintain security (and have good performance if possible).