ProcEventMonitor.cpp

1. Overview

Linux process connector implementation. Subscribes to CN_PROC events, decodes process lifecycle notifications in a worker thread and provides a compile/runtime availability check.

The original source path is:

src/netlink/ProcEventMonitor.cpp

---

2. Role in the Daemon

This file participates in the privileged BastionGuard Secure Connection daemon. It uses the shared bsc models and follows the daemon-wide fallback strategy: optional high-fidelity backends are used when available, while portable polling or stub behavior preserves service startup.

---

3. Namespaces

• bsc::netlink

---

4. Dependencies and Included Interfaces

• bsc/netlink/ProcEventMonitor.hpp
• bsc/logging/Logger.hpp
• array
• cerrno
• cstring
• memory
• thread
• linux/cn_proc.h
• linux/connector.h
• linux/netlink.h
• sys/socket.h
• unistd.h

---

5. Declared Types

• class ProcEventMonitor
• enum proc_cn_mcast_op

---

6. API and Functions

The file declares or implements the following callable entry points:

• from_what(std::uint32_t what)
• subscribe(bool enable)
• ProcEventMonitor::ProcEventMonitor() : impl_(std::make_unique<Impl>())
• ProcEventMonitor::~ProcEventMonitor()
• ProcEventMonitor::start(Handler handler)
• ProcEventMonitor::stop()
• ProcEventMonitor::available()
• ProcEventMonitor::start(Handler)

---

7. Constants and Compile-Time Controls

• auto recv_len = ::recv(impl_->fd, buf.data(), buf.size(), 0)

---

8. External Resources and Protocol Values

Relevant paths, endpoints, command names or policy values referenced by this file include:

• bsc/netlink/ProcEventMonitor.hpp
• bsc/logging/Logger.hpp

---

9. Concurrency and Lifecycle

• Uses one or more worker threads.

---

10. Security Considerations

• The component processes privileged operating-system or network data and should run with only the capabilities required by its backend.

---

11. Implementation Considerations

• Availability depends on Linux connector support and the required privileges.
• A stub implementation is provided on unsupported build targets.
• Events can race with process exit, so ProcMon retains recently exited metadata.
• The file creates or manages worker threads and requires deterministic stop/join behavior during daemon shutdown.

---

12. Source Metrics

Metric	Value
File size	7160 bytes
Lines	200
Detected API entries	8
Detected types	2