mirror of https://github.com/Qortal/Brooklyn
You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
134 lines
3.4 KiB
134 lines
3.4 KiB
/* SPDX-License-Identifier: LGPL-2.1 WITH Linux-syscall-note */ |
|
/* |
|
* cn_proc.h - process events connector |
|
* |
|
* Copyright (C) Matt Helsley, IBM Corp. 2005 |
|
* Based on cn_fork.h by Nguyen Anh Quynh and Guillaume Thouvenin |
|
* Copyright (C) 2005 Nguyen Anh Quynh <[email protected]> |
|
* Copyright (C) 2005 Guillaume Thouvenin <[email protected]> |
|
* |
|
* This program is free software; you can redistribute it and/or modify it |
|
* under the terms of version 2.1 of the GNU Lesser General Public License |
|
* as published by the Free Software Foundation. |
|
* |
|
* This program is distributed in the hope that it would be useful, but |
|
* WITHOUT ANY WARRANTY; without even the implied warranty of |
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. |
|
*/ |
|
|
|
#ifndef _UAPICN_PROC_H |
|
#define _UAPICN_PROC_H |
|
|
|
#include <linux/types.h> |
|
|
|
/* |
|
* Userspace sends this enum to register with the kernel that it is listening |
|
* for events on the connector. |
|
*/ |
|
enum proc_cn_mcast_op { |
|
PROC_CN_MCAST_LISTEN = 1, |
|
PROC_CN_MCAST_IGNORE = 2 |
|
}; |
|
|
|
/* |
|
* From the user's point of view, the process |
|
* ID is the thread group ID and thread ID is the internal |
|
* kernel "pid". So, fields are assigned as follow: |
|
* |
|
* In user space - In kernel space |
|
* |
|
* parent process ID = parent->tgid |
|
* parent thread ID = parent->pid |
|
* child process ID = child->tgid |
|
* child thread ID = child->pid |
|
*/ |
|
|
|
struct proc_event { |
|
enum what { |
|
/* Use successive bits so the enums can be used to record |
|
* sets of events as well |
|
*/ |
|
PROC_EVENT_NONE = 0x00000000, |
|
PROC_EVENT_FORK = 0x00000001, |
|
PROC_EVENT_EXEC = 0x00000002, |
|
PROC_EVENT_UID = 0x00000004, |
|
PROC_EVENT_GID = 0x00000040, |
|
PROC_EVENT_SID = 0x00000080, |
|
PROC_EVENT_PTRACE = 0x00000100, |
|
PROC_EVENT_COMM = 0x00000200, |
|
/* "next" should be 0x00000400 */ |
|
/* "last" is the last process event: exit, |
|
* while "next to last" is coredumping event */ |
|
PROC_EVENT_COREDUMP = 0x40000000, |
|
PROC_EVENT_EXIT = 0x80000000 |
|
} what; |
|
__u32 cpu; |
|
__u64 __attribute__((aligned(8))) timestamp_ns; |
|
/* Number of nano seconds since system boot */ |
|
union { /* must be last field of proc_event struct */ |
|
struct { |
|
__u32 err; |
|
} ack; |
|
|
|
struct fork_proc_event { |
|
__kernel_pid_t parent_pid; |
|
__kernel_pid_t parent_tgid; |
|
__kernel_pid_t child_pid; |
|
__kernel_pid_t child_tgid; |
|
} fork; |
|
|
|
struct exec_proc_event { |
|
__kernel_pid_t process_pid; |
|
__kernel_pid_t process_tgid; |
|
} exec; |
|
|
|
struct id_proc_event { |
|
__kernel_pid_t process_pid; |
|
__kernel_pid_t process_tgid; |
|
union { |
|
__u32 ruid; /* task uid */ |
|
__u32 rgid; /* task gid */ |
|
} r; |
|
union { |
|
__u32 euid; |
|
__u32 egid; |
|
} e; |
|
} id; |
|
|
|
struct sid_proc_event { |
|
__kernel_pid_t process_pid; |
|
__kernel_pid_t process_tgid; |
|
} sid; |
|
|
|
struct ptrace_proc_event { |
|
__kernel_pid_t process_pid; |
|
__kernel_pid_t process_tgid; |
|
__kernel_pid_t tracer_pid; |
|
__kernel_pid_t tracer_tgid; |
|
} ptrace; |
|
|
|
struct comm_proc_event { |
|
__kernel_pid_t process_pid; |
|
__kernel_pid_t process_tgid; |
|
char comm[16]; |
|
} comm; |
|
|
|
struct coredump_proc_event { |
|
__kernel_pid_t process_pid; |
|
__kernel_pid_t process_tgid; |
|
__kernel_pid_t parent_pid; |
|
__kernel_pid_t parent_tgid; |
|
} coredump; |
|
|
|
struct exit_proc_event { |
|
__kernel_pid_t process_pid; |
|
__kernel_pid_t process_tgid; |
|
__u32 exit_code, exit_signal; |
|
__kernel_pid_t parent_pid; |
|
__kernel_pid_t parent_tgid; |
|
} exit; |
|
|
|
} event_data; |
|
}; |
|
|
|
#endif /* _UAPICN_PROC_H */
|
|
|