Skip to content
API Documentation
BastionGuard™
rg_event Struct Reference

#include <rootguard_shared.h>

Public Attributes

__u64 timestamp_ns
__u32 pid
__u32 tgid
__u32 ppid
__u32 old_euid
__u32 new_euid
__u32 event_type
__u32 verdict
__u32 reason_flags
__u32 rule_id
__s32 lsm_flags
__u32 auxiliary
__u32 path_resolution
__u32 reserved_event
struct rg_file_key file
struct rg_file_key actor_file
struct rg_file_key parent_file
__u64 actor_start_boottime_ns
__u32 old_mode
__u32 new_mode
__u32 old_uid
__u32 new_uid
__u32 old_gid
__u32 new_gid
char comm [RG_COMM_LEN]
char parent_comm [RG_COMM_LEN]
char filename [RG_FILENAME_LEN]
char actor_executable [RG_FILENAME_LEN]
char parent_executable [RG_FILENAME_LEN]
char xattr_name [RG_XATTR_NAME_LEN]

Detailed Description

Definition at line 148 of file rootguard_shared.h.

Member Data Documentation

◆ actor_executable

char rg_event::actor_executable[RG_FILENAME_LEN]

Definition at line 176 of file rootguard_shared.h.

Referenced by enrich_event_actor().

◆ actor_file

struct rg_file_key rg_event::actor_file

Definition at line 164 of file rootguard_shared.h.

Referenced by enrich_event_actor().

◆ actor_start_boottime_ns

__u64 rg_event::actor_start_boottime_ns

Definition at line 166 of file rootguard_shared.h.

Referenced by enrich_event_actor().

◆ auxiliary

__u32 rg_event::auxiliary

Definition at line 160 of file rootguard_shared.h.

Referenced by emit_event().

◆ comm

char rg_event::comm[RG_COMM_LEN]

Definition at line 173 of file rootguard_shared.h.

Referenced by emit_event().

◆ event_type

__u32 rg_event::event_type

◆ file

struct rg_file_key rg_event::file

Definition at line 163 of file rootguard_shared.h.

◆ filename

char rg_event::filename[RG_FILENAME_LEN]

Definition at line 175 of file rootguard_shared.h.

Referenced by emit_event().

◆ lsm_flags

__s32 rg_event::lsm_flags

Definition at line 159 of file rootguard_shared.h.

◆ new_euid

__u32 rg_event::new_euid

Definition at line 154 of file rootguard_shared.h.

Referenced by emit_event().

◆ new_gid

__u32 rg_event::new_gid

Definition at line 172 of file rootguard_shared.h.

Referenced by emit_event().

◆ new_mode

__u32 rg_event::new_mode

Definition at line 168 of file rootguard_shared.h.

Referenced by emit_event().

◆ new_uid

__u32 rg_event::new_uid

Definition at line 170 of file rootguard_shared.h.

Referenced by emit_event().

◆ old_euid

__u32 rg_event::old_euid

Definition at line 153 of file rootguard_shared.h.

Referenced by emit_event().

◆ old_gid

__u32 rg_event::old_gid

Definition at line 171 of file rootguard_shared.h.

Referenced by emit_event().

◆ old_mode

__u32 rg_event::old_mode

Definition at line 167 of file rootguard_shared.h.

Referenced by emit_event().

◆ old_uid

__u32 rg_event::old_uid

Definition at line 169 of file rootguard_shared.h.

Referenced by emit_event().

◆ parent_comm

char rg_event::parent_comm[RG_COMM_LEN]

Definition at line 174 of file rootguard_shared.h.

Referenced by enrich_event_actor().

◆ parent_executable

char rg_event::parent_executable[RG_FILENAME_LEN]

Definition at line 177 of file rootguard_shared.h.

Referenced by enrich_event_actor().

◆ parent_file

struct rg_file_key rg_event::parent_file

Definition at line 165 of file rootguard_shared.h.

◆ path_resolution

__u32 rg_event::path_resolution

Definition at line 161 of file rootguard_shared.h.

Referenced by emit_event().

◆ pid

__u32 rg_event::pid

◆ ppid

__u32 rg_event::ppid

Definition at line 152 of file rootguard_shared.h.

Referenced by emit_event(), and enrich_event_actor().

◆ reason_flags

__u32 rg_event::reason_flags

Definition at line 157 of file rootguard_shared.h.

Referenced by emit_event().

◆ reserved_event

__u32 rg_event::reserved_event

Definition at line 162 of file rootguard_shared.h.

◆ rule_id

__u32 rg_event::rule_id

Definition at line 158 of file rootguard_shared.h.

Referenced by emit_event().

◆ tgid

__u32 rg_event::tgid

Definition at line 151 of file rootguard_shared.h.

Referenced by emit_event().

◆ timestamp_ns

__u64 rg_event::timestamp_ns

Definition at line 149 of file rootguard_shared.h.

◆ verdict

__u32 rg_event::verdict

Definition at line 156 of file rootguard_shared.h.

Referenced by emit_event().

◆ xattr_name

char rg_event::xattr_name[RG_XATTR_NAME_LEN]

Definition at line 178 of file rootguard_shared.h.

Referenced by emit_event().


The documentation for this struct was generated from the following file: