Module hookd 

One admission point for ljos hook. Every tool call on a host used to start a full hook process at once, so a burst of thirty calls from six seats was thirty processes contending for the same CPUs and memory. ljos hookd, one per user, hands out a fixed number of slots over a unix socket, in the order the calls asked. A gate that gets no slot is judged in this process: the queue allows, it does not deny.

The judging stays in the calling process. The guard reads that process’s parent, session and cgroup to tell the runner’s call from a tool’s, and a server judging on its behalf would have to take the caller’s word for all of them.

When no server answers, the first call starts one, and the calls that meet no server take one host-wide lock in turn. A missing server costs throughput, never the cap.

Structs

Timings

Hook latency and lock waits from the timing log, for ljos doctor.

Constants

ADMIT_MS

The longest a call waits for a slot. The runner’s gate deadline counts from the call’s start, so the wait and the work share that budget.

QUEUE_CAP

Calls waiting at once before the next one is judged here instead.

Functions

admit

Wait for this hook call’s turn before any heavy start-up. Returns at once for anything but a plain ljos hook. A gate that gets no turn within ADMIT_MS, or finds no server, is judged in this process. That path calls policyd directly. It does not deny for the queue.

left_of

What is left of budget_ms, counted from started.

note_time

Append one timing row: kind, the unix time, the call’s duration and the time it waited on a lock, in milliseconds. kind is hook for an answered call, refused for one the queue turned away and book for a bookkeeping job.

release

Give this call’s turn to the next one and log how long the call took. The gate’s answer calls this once it is written.

serve

ljos hookd: hand out hook slots on hookd.sock in the runtime directory until idle. A second server finds the lock taken and exits 0, so starting one is safe at any time. The server also exits when its socket is removed or replaced.

started

When this process started its hook call. Deadlines count from here, so time spent in the queue is spent from the same budget.

take_stdin

The stdin admit read to learn the call’s event, for the hook to judge. None when admission did not read it.

timings_line

The doctor’s line for hook latency and lock waits.

timings_of

Timings from the log text.