1 /* 2 * cn_proc.h - process events connector 3 * 4 * Copyright (C) Matt Helsley, IBM Corp. 2005 5 * Based on cn_fork.h by Nguyen Anh Quynh and Guillaume Thouvenin 6 * Original copyright notice follows: 7 * Copyright (C) 2005 Nguyen Anh Quynh <[email protected]> 8 * Copyright (C) 2005 Guillaume Thouvenin <[email protected]> 9 * 10 * This program is free software; you can redistribute it and/or modify 11 * it under the terms of the GNU General Public License as published by 12 * the Free Software Foundation; either version 2 of the License, or 13 * (at your option) any later version. 14 * 15 * This program is distributed in the hope that it will be useful, 16 * but WITHOUT ANY WARRANTY; without even the implied warranty of 17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 18 * GNU General Public License for more details. 19 * 20 * You should have received a copy of the GNU General Public License 21 * along with this program; if not, write to the Free Software 22 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA 23 */ 24 25 #ifndef CN_PROC_H 26 #define CN_PROC_H 27 28 #include <linux/types.h> 29 30 /* 31 * Userspace sends this enum to register with the kernel that it is listening 32 * for events on the connector. 33 */ 34 enum proc_cn_mcast_op { 35 PROC_CN_MCAST_LISTEN = 1, 36 PROC_CN_MCAST_IGNORE = 2 37 }; 38 39 /* 40 * From the user's point of view, the process 41 * ID is the thread group ID and thread ID is the internal 42 * kernel "pid". So, fields are assigned as follow: 43 * 44 * In user space - In kernel space 45 * 46 * parent process ID = parent->tgid 47 * parent thread ID = parent->pid 48 * child process ID = child->tgid 49 * child thread ID = child->pid 50 */ 51 52 struct proc_event { 53 enum what { 54 /* Use successive bits so the enums can be used to record 55 * sets of events as well 56 */ 57 PROC_EVENT_NONE = 0x00000000, 58 PROC_EVENT_FORK = 0x00000001, 59 PROC_EVENT_EXEC = 0x00000002, 60 PROC_EVENT_UID = 0x00000004, 61 PROC_EVENT_GID = 0x00000040, 62 /* "next" should be 0x00000400 */ 63 /* "last" is the last process event: exit */ 64 PROC_EVENT_EXIT = 0x80000000 65 } what; 66 __u32 cpu; 67 struct timespec timestamp; 68 union { /* must be last field of proc_event struct */ 69 struct { 70 __u32 err; 71 } ack; 72 73 struct fork_proc_event { 74 pid_t parent_pid; 75 pid_t parent_tgid; 76 pid_t child_pid; 77 pid_t child_tgid; 78 } fork; 79 80 struct exec_proc_event { 81 pid_t process_pid; 82 pid_t process_tgid; 83 } exec; 84 85 struct id_proc_event { 86 pid_t process_pid; 87 pid_t process_tgid; 88 union { 89 __u32 ruid; /* task uid */ 90 __u32 rgid; /* task gid */ 91 } r; 92 union { 93 __u32 euid; 94 __u32 egid; 95 } e; 96 } id; 97 98 struct exit_proc_event { 99 pid_t process_pid; 100 pid_t process_tgid; 101 __u32 exit_code, exit_signal; 102 } exit; 103 } event_data; 104 }; 105 106 #ifdef __KERNEL__ 107 #ifdef CONFIG_PROC_EVENTS 108 void proc_fork_connector(struct task_struct *task); 109 void proc_exec_connector(struct task_struct *task); 110 void proc_id_connector(struct task_struct *task, int which_id); 111 void proc_exit_connector(struct task_struct *task); 112 #else 113 static inline void proc_fork_connector(struct task_struct *task) 114 {} 115 116 static inline void proc_exec_connector(struct task_struct *task) 117 {} 118 119 static inline void proc_id_connector(struct task_struct *task, 120 int which_id) 121 {} 122 123 static inline void proc_exit_connector(struct task_struct *task) 124 {} 125 #endif /* CONFIG_PROC_EVENTS */ 126 #endif /* __KERNEL__ */ 127 #endif /* CN_PROC_H */ 128