can gather file path from proc fs if unknown

2 files changed, 15 insertions, 2 deletions

diff --git a/internal/eventloop.go b/internal/eventloop.go
index 634e5d5..b26ae35 100644
--- a/internal/eventloop.go
+++ b/internal/eventloop.go
@@ -100,7 +100,7 @@ func (e *eventLoop) syscallExit(exitEv event, ch chan<- *eventPair) {
 		openEv := ev.enterEv.(*OpenEvent)
 
 		fd := int32(ev.exitEv.(*RetEvent).Ret)
-		file := fdFile{fd, string(openEv.Filename[:])}
+		file := newFdFile(fd, string(openEv.Filename[:]))
 		if fd >= 0 {
 			e.files[fd] = file
 		}
@@ -130,7 +130,7 @@ func (e *eventLoop) syscallExit(exitEv event, ch chan<- *eventPair) {
 				delete(e.files, fd)
 			}
 		} else {
-			ev.file = fdFile{fd, "?"}
+			ev.file = newFdFileWithPid(fd, ev.enterEv.(*FdEvent).Pid)
 		}
 		ev.comm, _ = e.comms[ev.enterEv.GetTid()]
 
diff --git a/internal/file.go b/internal/file.go
index 9230afd..efb570b 100644
--- a/internal/file.go
+++ b/internal/file.go
@@ -1,6 +1,8 @@
 package internal
 
 import (
+	"fmt"
+	"os"
 	"strconv"
 	"strings"
 )
@@ -14,6 +16,17 @@ type fdFile struct {
 	name string
 }
 
+func newFdFile(fd int32, name string) fdFile {
+	return fdFile{fd, name}
+}
+
+func newFdFileWithPid(fd int32, pid uint32) fdFile {
+	if linkName, err := os.Readlink(fmt.Sprintf("/proc/%d/fd/%d", pid, fd)); err == nil {
+		return fdFile{fd, linkName}
+	}
+	return fdFile{fd, "?"}
+}
+
 func (f fdFile) String() string {
 	var sb strings.Builder