ProcMon.cpp

1. Overview

Process inspection and checksum engine. Reads /proc metadata, resolves executable paths and ancestry, optionally computes MD5/SHA1/SHA256 hashes and maintains active and recently exited process caches.

The original source path is:

src/proc/ProcMon.cpp

2. Role in the Daemon

This file participates in the privileged BastionGuard Secure Connection daemon. It uses the shared bsc models and follows the daemon-wide fallback strategy: optional high-fidelity backends are used when available, while portable polling or stub behavior preserves service startup.

3. Namespaces

  • bsc::proc
  • fs

4. Dependencies and Included Interfaces

  • bsc/proc/ProcMon.hpp
  • algorithm
  • cctype
  • filesystem
  • fstream
  • openssl/md5.h
  • openssl/sha.h
  • sstream
  • unistd.h

5. API and Functions

The file declares or implements the following callable entry points:

  • slurp(const fs::path& p, bool binary=false)
  • split_nulls(const std::string& s)
  • md5_file(const fs::path& p)
  • sha1_file(const fs::path& p)
  • sha256_file(const fs::path& p)
  • ProcMon::inspect_procfs(std::uint32_t pid, bool checksums)
  • ProcMon::cached(std::uint32_t pid, bool allow_recent_exit)
  • ProcMon::recent_candidates(std::uint32_t uid, std::chrono::milliseconds max_age, std::size_t limit)
  • std::sort(tmp.begin(), tmp.end(), [](const auto& a, const auto& b)
  • ProcMon::recent_candidates_any(std::chrono::milliseconds max_age, std::size_t limit)
  • ProcMon::inspect(std::uint32_t pid, bool checksums)
  • ProcMon::cache_process(const bsc::model::ProcessInfo& info)
  • ProcMon::invalidate(std::uint32_t pid)
  • ProcMon::note_fork(std::uint32_t child_pid, std::uint32_t parent_pid)
  • ProcMon::note_exec(std::uint32_t pid, bool checksums)
  • ProcMon::note_exit(std::uint32_t pid)

6. Constants and Compile-Time Controls

  • auto kFreshCacheTtl = std::chrono::seconds(3)
  • auto kRecentExitTtl = std::chrono::seconds(2)
  • char* hex = "0123456789abcdef"
  • auto now = std::chrono::steady_clock::now()
  • auto age = now - it->second.updated_at
  • auto fresh = age <= kFreshCacheTtl
  • auto checksum_ok = !checksums || it->second.has_checksums

7. Cache Behavior

Active process entries are cached with timestamps. On exit, metadata moves to a short-lived exited cache so connections observed slightly after process termination can still be attributed. Fork events can clone parent identity until an exec refreshes the child.

8. External Resources and Protocol Values

Relevant paths, endpoints, command names or policy values referenced by this file include:

  • bsc/proc/ProcMon.hpp
  • /proc

9. Security Considerations

  • Reading /proc across users generally requires elevated privileges.
  • Environment variables and command arguments can contain secrets and must be protected in transit and logs.
  • Executable checksums improve rule identity but add I/O and CPU cost.

10. Implementation Considerations

  • Shared state is protected by mutexes; callers should avoid holding external locks while invoking callbacks.
  • Linux /proc data can disappear between reads because processes and sockets are inherently short-lived.

11. Source Metrics

MetricValue
File size11274 bytes
Lines273
Detected API entries16
Detected types0

Published on:
Last updated on: