ptrace

Documentation

Index

• func PtraceEvenEnum(data int) string
• func SigTrapCauseInfo(cause int) string
• func SignalEnum(sigNum int) string
• func StopSignalInfo(sig syscall.Signal) string
• type App
  • func Run(ctx context.Context, del mondel.Publisher, runOpt AppRunOpt, includeNew bool, ...) (*App, error)
  • func (app *App) FileActivity() map[string]*report.FSActivityInfo
  • func (a *App) MainPID() int
  • func (a *App) PGID() int
• type AppRunOpt
• type AppState
• type StringParamPos
• type SyscallProcessor
• type SyscallTypeName

Functions

func PtraceEvenEnum

func PtraceEvenEnum(data int) string

func SigTrapCauseInfo

func SigTrapCauseInfo(cause int) string

func SignalEnum

func SignalEnum(sigNum int) string

func StopSignalInfo

func StopSignalInfo(sig syscall.Signal) string

Types

type App

type App struct {
	Cmd       string
	Args      []string
	WorkDir   string
	User      string
	RunAsUser bool

	RTASourcePT bool

	StateCh  chan AppState
	ReportCh chan *report.PtMonitorReport

	Report report.PtMonitorReport
	// contains filtered or unexported fields
}

func Run

func Run(
	ctx context.Context,
	del mondel.Publisher,
	runOpt AppRunOpt,

	includeNew bool,
	origPaths map[string]struct{},
	signalCh <-chan os.Signal,
	errorCh chan<- error,
) (*App, error)

func (*App) FileActivity

func (app *App) FileActivity() map[string]*report.FSActivityInfo

func (*App) MainPID

func (a *App) MainPID() int

func (*App) PGID

func (a *App) PGID() int

type AppRunOpt

type AppRunOpt struct {
	Cmd                 string
	Args                []string
	AppStdout           io.Writer
	AppStderr           io.Writer
	WorkDir             string
	User                string
	RunAsUser           bool
	RTASourcePT         bool
	ReportOnMainPidExit bool
}

type AppState

type AppState string

const (
	AppStarted AppState = "app.started"
	AppFailed  AppState = "app.failed"
	AppDone    AppState = "app.done"
)

type StringParamPos

type StringParamPos int

const (
	SPPNo  StringParamPos = 0
	SPPOne StringParamPos = 1
	SPPTwo StringParamPos = 2
)

type SyscallProcessor

type SyscallProcessor interface {
	SyscallNumber() uint64
	SetSyscallNumber(uint64)
	SyscallType() SyscallTypeName
	SyscallName() string
	EventOnCall() bool
	OnCall(pid int, regs syscall.PtraceRegs, cstate *syscallState)
	OnReturn(pid int, regs syscall.PtraceRegs, cstate *syscallState)
	FailedCall(cstate *syscallState) bool
	FailedReturnStatus(retVal uint64) bool
}

type SyscallTypeName

type SyscallTypeName string

const (
	CheckFileType SyscallTypeName = "type.checkfile"
	OpenFileType  SyscallTypeName = "type.openfile"
	ExecType      SyscallTypeName = "type.exec"
)