procmon

package

v0.0.0-...-2ec37ed Latest Latest Go to latest Published: Feb 11, 2024 License: GPL-3.0 Imports: 5 Imported by: 0

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/evilsocket/opensnitch

Documentation ¶

Index ¶

Variables
func ProcEventsMonitor(done <-chan struct{})
type ProcEvent
- func NewProcEvent(ev netlink.ProcEvent) ProcEvent

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	// ProcEventsChannel channel of events to read
	ProcEventsChannel = make(chan ProcEvent)
)

Functions ¶

func ProcEventsMonitor ¶

func ProcEventsMonitor(done <-chan struct{})

ProcEventsMonitor listens for process events from kernel. We listen for events via netlink, from the Process Events Conector: https://lwn.net/Articles/157150/ The kernel must have the options CONFIG_CONECTOR and CONFIG_PROC_EVENTS enabled.

Types ¶

type ProcEvent ¶

type ProcEvent struct {
	TimeStamp uint64
	PID       uint32
	PPID      uint32
	TGID      uint32
	PTGID     uint32
	// contains filtered or unexported fields
}

ProcEvent represents the struct returned from kernel

func NewProcEvent ¶

func NewProcEvent(ev netlink.ProcEvent) ProcEvent

NewProcEvent returns a new event received from kernel

func (*ProcEvent) IsComm ¶

func (pe *ProcEvent) IsComm() bool

IsComm returns if the event is comm

func (*ProcEvent) IsExec ¶

func (pe *ProcEvent) IsExec() bool

IsExec returns if the event is exec

func (*ProcEvent) IsExit ¶

func (pe *ProcEvent) IsExit() bool

IsExit returns if the event is exit

func (*ProcEvent) IsFork ¶

func (pe *ProcEvent) IsFork() bool

IsFork returns if the event is fork

func (*ProcEvent) Msg ¶

func (pe *ProcEvent) Msg() interface{}

Msg returns the message received from netlink

func (*ProcEvent) Pid ¶

func (pe *ProcEvent) Pid() uint32

Pid returns the pid of the event

Source Files ¶

View all Source files

procmon.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL