1 /* 2 * cn_proc.h - process events connector 3 * 4 * Copyright (C) Matt Helsley, IBM Corp. 2005 5 * Based on cn_fork.h by Nguyen Anh Quynh and Guillaume Thouvenin 6 * Copyright (C) 2005 Nguyen Anh Quynh <[email protected]> 7 * Copyright (C) 2005 Guillaume Thouvenin <[email protected]> 8 * 9 * This program is free software; you can redistribute it and/or modify it 10 * under the terms of version 2.1 of the GNU Lesser General Public License 11 * as published by the Free Software Foundation. 12 * 13 * This program is distributed in the hope that it would be useful, but 14 * WITHOUT ANY WARRANTY; without even the implied warranty of 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 16 */ 17 18 #ifndef CN_PROC_H 19 #define CN_PROC_H 20 21 #include <linux/types.h> 22 23 /* 24 * Userspace sends this enum to register with the kernel that it is listening 25 * for events on the connector. 26 */ 27 enum proc_cn_mcast_op { 28 PROC_CN_MCAST_LISTEN = 1, 29 PROC_CN_MCAST_IGNORE = 2 30 }; 31 32 /* 33 * From the user's point of view, the process 34 * ID is the thread group ID and thread ID is the internal 35 * kernel "pid". So, fields are assigned as follow: 36 * 37 * In user space - In kernel space 38 * 39 * parent process ID = parent->tgid 40 * parent thread ID = parent->pid 41 * child process ID = child->tgid 42 * child thread ID = child->pid 43 */ 44 45 struct proc_event { 46 enum what { 47 /* Use successive bits so the enums can be used to record 48 * sets of events as well 49 */ 50 PROC_EVENT_NONE = 0x00000000, 51 PROC_EVENT_FORK = 0x00000001, 52 PROC_EVENT_EXEC = 0x00000002, 53 PROC_EVENT_UID = 0x00000004, 54 PROC_EVENT_GID = 0x00000040, 55 PROC_EVENT_SID = 0x00000080, 56 PROC_EVENT_PTRACE = 0x00000100, 57 /* "next" should be 0x00000400 */ 58 /* "last" is the last process event: exit */ 59 PROC_EVENT_EXIT = 0x80000000 60 } what; 61 __u32 cpu; 62 __u64 __attribute__((aligned(8))) timestamp_ns; 63 /* Number of nano seconds since system boot */ 64 union { /* must be last field of proc_event struct */ 65 struct { 66 __u32 err; 67 } ack; 68 69 struct fork_proc_event { 70 __kernel_pid_t parent_pid; 71 __kernel_pid_t parent_tgid; 72 __kernel_pid_t child_pid; 73 __kernel_pid_t child_tgid; 74 } fork; 75 76 struct exec_proc_event { 77 __kernel_pid_t process_pid; 78 __kernel_pid_t process_tgid; 79 } exec; 80 81 struct id_proc_event { 82 __kernel_pid_t process_pid; 83 __kernel_pid_t process_tgid; 84 union { 85 __u32 ruid; /* task uid */ 86 __u32 rgid; /* task gid */ 87 } r; 88 union { 89 __u32 euid; 90 __u32 egid; 91 } e; 92 } id; 93 94 struct sid_proc_event { 95 __kernel_pid_t process_pid; 96 __kernel_pid_t process_tgid; 97 } sid; 98 99 struct ptrace_proc_event { 100 __kernel_pid_t process_pid; 101 __kernel_pid_t process_tgid; 102 __kernel_pid_t tracer_pid; 103 __kernel_pid_t tracer_tgid; 104 } ptrace; 105 106 struct exit_proc_event { 107 __kernel_pid_t process_pid; 108 __kernel_pid_t process_tgid; 109 __u32 exit_code, exit_signal; 110 } exit; 111 } event_data; 112 }; 113 114 #ifdef __KERNEL__ 115 #ifdef CONFIG_PROC_EVENTS 116 void proc_fork_connector(struct task_struct *task); 117 void proc_exec_connector(struct task_struct *task); 118 void proc_id_connector(struct task_struct *task, int which_id); 119 void proc_sid_connector(struct task_struct *task); 120 void proc_ptrace_connector(struct task_struct *task, int which_id); 121 void proc_exit_connector(struct task_struct *task); 122 #else 123 static inline void proc_fork_connector(struct task_struct *task) 124 {} 125 126 static inline void proc_exec_connector(struct task_struct *task) 127 {} 128 129 static inline void proc_id_connector(struct task_struct *task, 130 int which_id) 131 {} 132 133 static inline void proc_sid_connector(struct task_struct *task) 134 {} 135 136 static inline void proc_ptrace_connector(struct task_struct *task, 137 int ptrace_id) 138 {} 139 140 static inline void proc_exit_connector(struct task_struct *task) 141 {} 142 #endif /* CONFIG_PROC_EVENTS */ 143 #endif /* __KERNEL__ */ 144 #endif /* CN_PROC_H */ 145