pub struct ProcTable {
pub lazy: bool,
procs: RwLock<HashMap<i32, TraceeInfo>>,
tids: RwLock<HashMap<i32, (i32, Instant)>>,
defaults: RwLock<TraceeInfo>,
forks: Mutex<HashMap<i32, VecDeque<TraceeInfo>>>,
orphans: Mutex<VecDeque<(Instant, TraceeInfo)>>,
shim: AtomicUsize,
reaper: Mutex<Option<Reaper>>,
}Expand description
The process table.
Fields§
§lazy: boolTrue without ptrace: processes are discovered at their first syscall.
procs: RwLock<HashMap<i32, TraceeInfo>>§tids: RwLock<HashMap<i32, (i32, Instant)>>§defaults: RwLock<TraceeInfo>State given to a process whose ancestry leads nowhere known.
forks: Mutex<HashMap<i32, VecDeque<TraceeInfo>>>Snapshots taken at clone, waiting for the child, keyed by parent.
orphans: Mutex<VecDeque<(Instant, TraceeInfo)>>Snapshots whose parent exited before the child was seen.
shim: AtomicUsizeAt least the number of processes with a pending exec, so the check on every notification costs nothing while there is none.
reaper: Mutex<Option<Reaper>>Implementations§
Source§impl ProcTable
impl ProcTable
Sourcepub fn register_root(&self, root: i32, info: TraceeInfo)
pub fn register_root(&self, root: i32, info: TraceeInfo)
Sets the state handed to processes with no known ancestor, and
registers root with it.
§Arguments
root- Pid of the first tracee.info- Its initial state.
Sourcepub fn info(&self, tid: i32) -> TraceeInfo
pub fn info(&self, tid: i32) -> TraceeInfo
Sourcepub fn update(&self, tid: i32, f: impl FnOnce(&mut TraceeInfo))
pub fn update(&self, tid: i32, f: impl FnOnce(&mut TraceeInfo))
Changes the state of the process of thread tid in place.
Without ptrace, children forked since the last change are registered first, with the state the parent had when it forked them.
§Arguments
tid- Thread or process id.f- The change.
Sourcepub fn fork(&self, parent: i32, child: i32)
pub fn fork(&self, parent: i32, child: i32)
Registers child with a copy of parent’s state (ptrace fork event).
§Arguments
parent- Thread id of the forking thread.child- New process (or thread) id.
Sourcepub fn view_of(&self, tid: i32) -> Option<Arc<View>>
pub fn view_of(&self, tid: i32) -> Option<Arc<View>>
The view of the process of thread tid, if it has one of its own.
§Arguments
tid- Thread or process id.
Sourcepub fn forked(&self, tid: i32, vfork: bool)
pub fn forked(&self, tid: i32, vfork: bool)
Takes a snapshot of the forking process for the child to inherit (no ptrace).
§Arguments
tid- Thread callingclone,forkorvfork.vfork- The child shares the parent’s memory until it execs.
Sourcepub fn forget(&self, pid: i32)
pub fn forget(&self, pid: i32)
Forgets a process or thread that exited.
Snapshots it left for unborn children move to the orphan list.
§Arguments
pid- Thread or process id.
Sourcepub fn set_exe(&self, tid: i32, guest: Vec<u8>, host: Vec<u8>)
pub fn set_exe(&self, tid: i32, guest: Vec<u8>, host: Vec<u8>)
Records the executable the process of tid now runs.
Sourcepub fn dumpable(&self, tid: i32) -> bool
pub fn dumpable(&self, tid: i32) -> bool
Whether the process of thread tid still reads as dumpable.
Sourcepub fn set_dumpable(&self, tid: i32, dumpable: bool)
pub fn set_dumpable(&self, tid: i32, dumpable: bool)
Records the dumpable flag the process of thread tid set.
Sourcepub fn exe_of(&self, tid: i32) -> Option<Vec<u8>>
pub fn exe_of(&self, tid: i32) -> Option<Vec<u8>>
The recorded guest program of thread tid, if any.
Sourcepub fn cwd_of(&self, tid: i32) -> Option<Vec<u8>>
pub fn cwd_of(&self, tid: i32) -> Option<Vec<u8>>
The virtual working directory of the process of tid (no ptrace).
Sourcepub fn set_cwd(&self, tid: i32, cwd: Vec<u8>)
pub fn set_cwd(&self, tid: i32, cwd: Vec<u8>)
Replaces the virtual working directory of the process of tid.
Sourcepub fn ids(&self, tid: i32) -> Ids
pub fn ids(&self, tid: i32) -> Ids
The virtual identity of the process of tid (root until changed).
Sourcepub fn groups(&self, tid: i32) -> Option<Vec<u32>>
pub fn groups(&self, tid: i32) -> Option<Vec<u32>>
Supplementary groups of the process of tid, if setgroups was called.
Sourcepub fn set_groups(&self, tid: i32, groups: Vec<u32>)
pub fn set_groups(&self, tid: i32, groups: Vec<u32>)
Records the supplementary groups of the process of tid.
Sourcepub fn shim_enter(&self, tgid: i32, pending: PendingExec)
pub fn shim_enter(&self, tgid: i32, pending: PendingExec)
Marks process tgid as about to run the exec shim for pending.
Sourcepub fn shim_pending(&self, tgid: i32) -> Option<PendingExec>
pub fn shim_pending(&self, tgid: i32) -> Option<PendingExec>
The pending exec of process tgid, if it is in the shim.
Sourcepub fn shim_leave(&self, tgid: i32)
pub fn shim_leave(&self, tgid: i32)
Clears the shim mark of process tgid.
Sourcefn ensure(&self, tgid: i32)
fn ensure(&self, tgid: i32)
Makes sure process tgid has an entry, discovering its ancestry if needed.
Sourcefn discover(&self, tgid: i32, depth: usize)
fn discover(&self, tgid: i32, depth: usize)
Registers tgid with the state of its parent, walking up as needed.
A parent that is still known contributes the snapshot it took at the fork, or its current state. A process whose parent is gone (reparented to init or to the supervisor) takes the oldest orphaned snapshot, or the defaults.
Sourcefn adopt_children(&self, tgid: i32)
fn adopt_children(&self, tgid: i32)
Registers the children tgid forked since its last state change.
Only done while snapshots are pending, since finding children means
scanning /proc.