task-47: add KindExec for execve paths

1 files changed, 18 insertions, 0 deletions

diff --git a/internal/eventloop_exit.go b/internal/eventloop_exit.go
index 5ee31f5..598adba 100644
--- a/internal/eventloop_exit.go
+++ b/internal/eventloop_exit.go
@@ -16,6 +16,8 @@ func (e *eventLoop) handleTracepointExit(ep *event.Pair) bool {
 	switch ev := ep.EnterEv.(type) {
 	case *types.OpenEvent:
 		return e.handleOpenExit(ep, ev)
+	case *types.ExecEvent:
+		return e.handleExecExit(ep, ev)
 	case *types.NameEvent:
 		return e.handleNameExit(ep, ev)
 	case *types.PathEvent:
@@ -83,6 +85,22 @@ func (e *eventLoop) handleOpenExit(ep *event.Pair, openEv *types.OpenEvent) bool
 	return true
 }
 
+func (e *eventLoop) handleExecExit(ep *event.Pair, execEv *types.ExecEvent) bool {
+	if _, ok := ep.ExitEv.(*types.RetEvent); !ok {
+		e.recyclePair(ep, "Dropped malformed exec exit event")
+		return false
+	}
+	comm := types.StringValue(execEv.Comm[:])
+	ep.Comm = comm
+	ep.File = file.NewPathname(execEv.Filename[:])
+	e.setCachedComm(execEv.Tid, comm)
+	if !e.Filter().MatchPair(ep) {
+		ep.Recycle()
+		return false
+	}
+	return true
+}
+
 func (e *eventLoop) handleNameExit(ep *event.Pair, nameEv *types.NameEvent) bool {
 	ep.File = file.NewOldnameNewname(nameEv.Oldname[:], nameEv.Newname[:])
 	ep.Comm = e.comm(nameEv.GetTid())