예제 #1
0
pt_info_t * pt_investigate_kevent (process_tracker_t * pt, struct kevent * ke)
{
    pt_info_t * result;
    pt_info_t info;

    if (ke->filter != EVFILT_PROC)
        goto no_result;

    if (ke->fflags & NOTE_CHILD)
    {
        printf ("new pid %d has %d as parent\n", ke->ident, ke->data);
        info.event = PT_CHILD;
        info.pid = ke->ident;
        info.ppid = ke->data;

        pid_list_add (pt->pids, pid_new_p (ke->ident));

        goto result;
    }
    if (ke->fflags & NOTE_EXIT)
    {
        pid_list_iterator it;

        printf ("pid %d exited\n", ke->ident);
        info.event = PT_EXIT;
        info.pid = ke->ident;
        info.ppid = 0;
        info.flags = ke->data;

        for (it = pid_list_begin (pt->pids); it != NULL;
                pid_list_iterator_next (&it))
        {
            if (*it->val == ke->ident)
                goto found;
        }

        goto result;

found:
        free (it->val);
        pid_list_del (pt->pids, it->val);
        goto result;
    }

no_result:
    return 0;

result:
    result = malloc (sizeof (pt_info_t));
    *result = info;
    return result;
}
예제 #2
0
int pt_watch_pid (process_tracker_t * pt, pid_t pid)
{
    int i;
    struct kevent ke;

    EV_SET (&ke, pid, EVFILT_PROC, EV_ADD, NOTE_EXIT | NOTE_TRACK, 0, NULL);
    i = kevent (pt->kq, &ke, 1, NULL, 0, NULL);

    if (i == -1)
        fprintf (stderr, "Error: failed to watch PID %d: %s\n", pid,
                 strerror (errno));
    else
        pid_list_add (pt->pids, pid_new_p (pid));

    return i == -1 ? 1 : 0;
}
예제 #3
0
int pt_watch_pid (process_tracker_t * pt, pid_t pid)
{
    pid_list_add (pt->pids, pid_new_p (pid));
    return 0;
}