diff options
| -rw-r--r-- | TODO.md | 5 | ||||
| -rw-r--r-- | main.go | 15 |
2 files changed, 12 insertions, 8 deletions
@@ -0,0 +1,5 @@ +# TODO + +* Send PID and/or file pattern dynamically to the BPF program +* Capture all *open* and *close* syscalls (e.g. from debugfs?) + * Could write a Go code to check for available syscalls and then alert? @@ -86,18 +86,17 @@ func main() { } pb.Poll(300) + for ev := range eventsChannel { + var e openatEvent + if err := binary.Read(bytes.NewReader(ev), binary.LittleEndian, &e); err != nil { + log.Fatal(err) - ev := <-eventsChannel - var e openatEvent - if err := binary.Read(bytes.NewReader(ev), binary.LittleEndian, &e); err != nil { - log.Fatal(err) + } + fmt.Println(e) + pb.Poll(300) } - fmt.Println("Bytes ", ev) - fmt.Println("Struct ", e) - fmt.Println("Human ", e.String()) - pb.Stop() pb.Close() } |
