From 20ddab74b35a1dcafb8464c17857103bc923d2ad Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 9 Feb 2024 01:12:38 +0200 Subject: add todo --- TODO.md | 5 +++++ main.go | 15 +++++++-------- 2 files changed, 12 insertions(+), 8 deletions(-) create mode 100644 TODO.md diff --git a/TODO.md b/TODO.md new file mode 100644 index 0000000..269ecf3 --- /dev/null +++ b/TODO.md @@ -0,0 +1,5 @@ +# TODO + +* Send PID and/or file pattern dynamically to the BPF program +* Capture all *open* and *close* syscalls (e.g. from debugfs?) + * Could write a Go code to check for available syscalls and then alert? diff --git a/main.go b/main.go index 8c74f4f..e580ee7 100644 --- a/main.go +++ b/main.go @@ -86,18 +86,17 @@ func main() { } pb.Poll(300) + for ev := range eventsChannel { + var e openatEvent + if err := binary.Read(bytes.NewReader(ev), binary.LittleEndian, &e); err != nil { + log.Fatal(err) - ev := <-eventsChannel - var e openatEvent - if err := binary.Read(bytes.NewReader(ev), binary.LittleEndian, &e); err != nil { - log.Fatal(err) + } + fmt.Println(e) + pb.Poll(300) } - fmt.Println("Bytes ", ev) - fmt.Println("Struct ", e) - fmt.Println("Human ", e.String()) - pb.Stop() pb.Close() } -- cgit v1.2.3