1 /* SPDX-License-Identifier: LGPL-2.1 WITH Linux-syscall-note */ 2 /* 3 * cn_proc.h - process events connector 4 * 5 * Copyright (C) Matt Helsley, IBM Corp. 2005 6 * Based on cn_fork.h by Nguyen Anh Quynh and Guillaume Thouvenin 7 * Copyright (C) 2005 Nguyen Anh Quynh <[email protected]> 8 * Copyright (C) 2005 Guillaume Thouvenin <[email protected]> 9 * 10 * This program is free software; you can redistribute it and/or modify it 11 * under the terms of version 2.1 of the GNU Lesser General Public License 12 * as published by the Free Software Foundation. 13 * 14 * This program is distributed in the hope that it would be useful, but 15 * WITHOUT ANY WARRANTY; without even the implied warranty of 16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. 17 */ 18 19 #ifndef _UAPICN_PROC_H 20 #define _UAPICN_PROC_H 21 22 #include <linux/types.h> 23 24 /* 25 * Userspace sends this enum to register with the kernel that it is listening 26 * for events on the connector. 27 */ 28 enum proc_cn_mcast_op { 29 PROC_CN_MCAST_LISTEN = 1, 30 PROC_CN_MCAST_IGNORE = 2 31 }; 32 33 enum proc_cn_event { 34 /* Use successive bits so the enums can be used to record 35 * sets of events as well 36 */ 37 PROC_EVENT_NONE = 0x00000000, 38 PROC_EVENT_FORK = 0x00000001, 39 PROC_EVENT_EXEC = 0x00000002, 40 PROC_EVENT_UID = 0x00000004, 41 PROC_EVENT_GID = 0x00000040, 42 PROC_EVENT_SID = 0x00000080, 43 PROC_EVENT_PTRACE = 0x00000100, 44 PROC_EVENT_COMM = 0x00000200, 45 /* "next" should be 0x00000400 */ 46 /* "last" is the last process event: exit, 47 * while "next to last" is coredumping event 48 */ 49 PROC_EVENT_COREDUMP = 0x40000000, 50 PROC_EVENT_EXIT = 0x80000000 51 }; 52 53 struct proc_input { 54 enum proc_cn_mcast_op mcast_op; 55 }; 56 57 /* 58 * From the user's point of view, the process 59 * ID is the thread group ID and thread ID is the internal 60 * kernel "pid". So, fields are assigned as follow: 61 * 62 * In user space - In kernel space 63 * 64 * parent process ID = parent->tgid 65 * parent thread ID = parent->pid 66 * child process ID = child->tgid 67 * child thread ID = child->pid 68 */ 69 70 struct proc_event { 71 enum proc_cn_event what; 72 __u32 cpu; 73 __u64 __attribute__((aligned(8))) timestamp_ns; 74 /* Number of nano seconds since system boot */ 75 union { /* must be last field of proc_event struct */ 76 struct { 77 __u32 err; 78 } ack; 79 80 struct fork_proc_event { 81 __kernel_pid_t parent_pid; 82 __kernel_pid_t parent_tgid; 83 __kernel_pid_t child_pid; 84 __kernel_pid_t child_tgid; 85 } fork; 86 87 struct exec_proc_event { 88 __kernel_pid_t process_pid; 89 __kernel_pid_t process_tgid; 90 } exec; 91 92 struct id_proc_event { 93 __kernel_pid_t process_pid; 94 __kernel_pid_t process_tgid; 95 union { 96 __u32 ruid; /* task uid */ 97 __u32 rgid; /* task gid */ 98 } r; 99 union { 100 __u32 euid; 101 __u32 egid; 102 } e; 103 } id; 104 105 struct sid_proc_event { 106 __kernel_pid_t process_pid; 107 __kernel_pid_t process_tgid; 108 } sid; 109 110 struct ptrace_proc_event { 111 __kernel_pid_t process_pid; 112 __kernel_pid_t process_tgid; 113 __kernel_pid_t tracer_pid; 114 __kernel_pid_t tracer_tgid; 115 } ptrace; 116 117 struct comm_proc_event { 118 __kernel_pid_t process_pid; 119 __kernel_pid_t process_tgid; 120 char comm[16]; 121 } comm; 122 123 struct coredump_proc_event { 124 __kernel_pid_t process_pid; 125 __kernel_pid_t process_tgid; 126 __kernel_pid_t parent_pid; 127 __kernel_pid_t parent_tgid; 128 } coredump; 129 130 struct exit_proc_event { 131 __kernel_pid_t process_pid; 132 __kernel_pid_t process_tgid; 133 __u32 exit_code, exit_signal; 134 __kernel_pid_t parent_pid; 135 __kernel_pid_t parent_tgid; 136 } exit; 137 138 } event_data; 139 }; 140 141 #endif /* _UAPICN_PROC_H */ 142