pt_info_t * pt_investigate_kevent (process_tracker_t * pt, struct kevent * ke)
{
pt_info_t * result;
pt_info_t info;
if (ke->filter != EVFILT_PROC)
goto no_result;
if (ke->fflags & NOTE_CHILD)
{
printf ("new pid %d has %d as parent\n", ke->ident, ke->data);
info.event = PT_CHILD;
info.pid = ke->ident;
info.ppid = ke->data;
pid_list_add (pt->pids, pid_new_p (ke->ident));
goto result;
}
if (ke->fflags & NOTE_EXIT)
{
pid_list_iterator it;
printf ("pid %d exited\n", ke->ident);
info.event = PT_EXIT;
info.pid = ke->ident;
info.ppid = 0;
info.flags = ke->data;
for (it = pid_list_begin (pt->pids); it != NULL;
pid_list_iterator_next (&it))
{
if (*it->val == ke->ident)
goto found;
}
goto result;
found:
free (it->val);
pid_list_del (pt->pids, it->val);
goto result;
}
no_result:
return 0;
result:
result = malloc (sizeof (pt_info_t));
*result = info;
return result;
}
void unit_deregister_pid (unit_t * unit, pid_t pid)
{
for (pid_list_iterator it = pid_list_begin (unit->pids); it != NULL;
pid_list_iterator_next (&it))
{
if (*it->val == pid)
{
pid_t * tofree = it->val;
pid_list_del (unit->pids, it->val);
pt_disregard_pid (Manager.ptrack, pid);
s16mem_free (tofree);
return;
}
}
}
void pt_disregard_pid (process_tracker_t * pt, pid_t pid)
{
pid_list_iterator it;
for (it = pid_list_begin (pt->pids); it != NULL;
pid_list_iterator_next (&it))
{
if (*it->val == pid)
{
s16mem_free (it->val);
pid_list_del (pt->pids, it->val);
break;
}
}
return;
}
void pt_disregard_pid (process_tracker_t * pt, pid_t pid)
{
struct kevent ke;
pid_list_iterator it;
EV_SET (&ke, pid, EVFILT_PROC, EV_ADD, NOTE_EXIT | NOTE_TRACK, 0, NULL);
kevent (pt->kq, &ke, 1, NULL, 0, NULL);
for (it = pid_list_begin (pt->pids); it != NULL;
pid_list_iterator_next (&it))
{
if (*it->val == pid)
goto found;
}
return;
found:
free (it->val);
pid_list_del (pt->pids, it->val);
}
