ProcMon.hpp

1. Overview

Process inspection and cache interface. Declares /proc inspection, recently exited process retention, fork/exec/exit cache updates and candidate lookup.

The original source path is:

include/bsc/proc/ProcMon.hpp

---

2. Role in the Daemon

This file participates in the privileged BastionGuard Secure Connection daemon. It uses the shared bsc models and follows the daemon-wide fallback strategy: optional high-fidelity backends are used when available, while portable polling or stub behavior preserves service startup.

---

3. Namespaces

• bsc::proc

---

4. Dependencies and Included Interfaces

• bsc/model/ProcessInfo.hpp
• chrono
• cstdint
• mutex
• optional
• string
• unordered_map
• vector

---

5. Declared Types

• class ProcMon
• struct CacheEntry

---

6. State and Data Members

The interface declares the following relevant state members:

• std::size_t limit = 8) const
• std::size_t limit = 8) const
• bsc::model::ProcessInfo info
• mutable std::mutex cache_mutex_
• mutable std::unordered_map<std::uint32_t, CacheEntry> cache_
• mutable std::unordered_map<std::uint32_t, CacheEntry> exited_

---

7. API and Functions

The file declares or implements the following callable entry points:

• public: std::optional<bsc::model::ProcessInfo> inspect(std::uint32_t pid, bool checksums = false) const
• std::optional<bsc::model::ProcessInfo> cached(std::uint32_t pid, bool allow_recent_exit = true) const
• std::vector<bsc::model::ProcessInfo> recent_candidates(std::uint32_t uid, std::chrono::milliseconds max_age = std::chrono::milliseconds(5000), std::size_t limit = 8) const
• std::vector<bsc::model::ProcessInfo> recent_candidates_any(std::chrono::milliseconds max_age = std::chrono::milliseconds(1500), std::size_t limit = 8) const
• void cache_process(const bsc::model::ProcessInfo& info) const
• void invalidate(std::uint32_t pid) const
• void note_fork(std::uint32_t child_pid, std::uint32_t parent_pid) const
• void note_exec(std::uint32_t pid, bool checksums = false) const
• void note_exit(std::uint32_t pid) const
• static std::optional<bsc::model::ProcessInfo> inspect_procfs(std::uint32_t pid, bool checksums)

---

8. External Resources and Protocol Values

Relevant paths, endpoints, command names or policy values referenced by this file include:

• bsc/model/ProcessInfo.hpp

---

9. Concurrency and Lifecycle

• Protects mutable shared data with std::mutex.

---

10. Implementation Considerations

• Shared state is protected by mutexes; callers should avoid holding external locks while invoking callbacks.

---

11. Source Metrics

Metric	Value
File size	1745 bytes
Lines	42
Detected API entries	10
Detected types	2