ProcEventMonitor.hpp

Go to the documentation of this file.

#pragma once
#include <atomic>
#include <cstdint>
#include <functional>
#include <memory>
#include <string>
 
namespace bsc::netlink {
 
struct ProcEvent {
    enum class Type {
        Unknown,
        Fork,
        Exec,
        Exit,
        Uid,
        Gid,
        Sid,
        Comm,
        Ptrace,
        CoreDump
    };
 
    Type type{Type::Unknown};
    std::uint32_t pid{0};
    std::uint32_t tgid{0};
    std::uint32_t parent_pid{0};
    std::uint32_t parent_tgid{0};
    std::uint32_t uid{0};
    std::uint32_t gid{0};
    std::int32_t exit_code{0};
    std::uint32_t exit_signal{0};
    std::string comm;
};
 
class ProcEventMonitor {
  public:
    using Handler = std::function<void(const ProcEvent&)>;
 
    ProcEventMonitor();
    ~ProcEventMonitor();
 
    bool start(Handler handler);
    void stop();
    bool running() const noexcept { return running_; }
    static bool available();
 
  private:
    class Impl;
    std::unique_ptr<Impl> impl_;
    std::atomic_bool running_{false};
};
 
} // namespace bsc::netlink