-
Notifications
You must be signed in to change notification settings - Fork 417
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
pkg/proctree: add process tree to events pipeline
Create a process tree that feed upon the tracee's events. Register the process tree into the events pipeline.
- Loading branch information
1 parent
2a41c60
commit fdfd3df
Showing
16 changed files
with
2,072 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,38 @@ | ||
| package proctree | ||
|
|
||
| import ( | ||
| "github.com/aquasecurity/tracee/types/trace" | ||
| ) | ||
|
|
||
| // ProcessEvent update the process tree according to arriving event | ||
| func (tree *ProcessTree) ProcessEvent(traceeEvent *trace.Event) error { | ||
| switch traceeEvent.EventName { | ||
| case "sched_process_fork": | ||
| return tree.processForkEvent(traceeEvent) | ||
| case "sched_process_exec": | ||
| return tree.processExecEvent(traceeEvent) | ||
| case "sched_process_exit": | ||
| return tree.processExitEvent(traceeEvent) | ||
| case "exit", "init_namespaces": | ||
| return nil | ||
| default: | ||
| return tree.processDefaultEvent(traceeEvent) | ||
| } | ||
| } | ||
|
|
||
| // processDefaultEvent tries to expand the process tree in case of lost events or missing general information | ||
| func (tree *ProcessTree) processDefaultEvent(event *trace.Event) error { | ||
| process, err := tree.getProcess(event.HostProcessID) | ||
| if err != nil { | ||
| process = tree.addGeneralEventProcess(event) | ||
| process.addThreadID(event.HostThreadID) | ||
| } else if process.Status.Contains(uint32(hollowParent)) { | ||
| fillHollowParentProcessGeneralEvent(process, event) | ||
| } | ||
| process.addThreadID(event.HostThreadID) | ||
| if process.ParentProcess == nil { | ||
| tree.generateParentProcess(process) | ||
| } | ||
| return nil | ||
|
|
||
| } |
Oops, something went wrong.