From be6d4e8ffc722bf0d36c5b01ff46f817539a1525 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Wed, 20 May 2026 23:42:12 +0300 Subject: task-47: add KindExec for execve paths --- internal/eventloop_runtime.go | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'internal/eventloop_runtime.go') diff --git a/internal/eventloop_runtime.go b/internal/eventloop_runtime.go index 334fa63..d9d9c4c 100644 --- a/internal/eventloop_runtime.go +++ b/internal/eventloop_runtime.go @@ -250,6 +250,7 @@ func (e *eventLoop) initRawHandlers() { e.registerTwoFdHandlers() e.registerMemoryHandlers() e.registerSleepHandlers() + e.registerProcessHandlers() e.registerSecurityHandlers() } @@ -483,6 +484,16 @@ func (e *eventLoop) registerSleepHandlers() { } } +func (e *eventLoop) registerProcessHandlers() { + e.rawHandlers[types.ENTER_EXEC_EVENT] = func(raw []byte, _ chan<- *event.Pair) { + execEv, ok := decodeRawEvent(e, types.ENTER_EXEC_EVENT, raw, types.NewExecEventFast) + if !ok { + return + } + e.tracepointEntered(execEv) + } +} + func (e *eventLoop) registerSecurityHandlers() { e.rawHandlers[types.ENTER_KEYCTL_EVENT] = func(raw []byte, _ chan<- *event.Pair) { keyctlEv, ok := decodeRawEvent(e, types.ENTER_KEYCTL_EVENT, raw, types.NewKeyctlEventFast) @@ -528,6 +539,8 @@ func (e *eventLoop) tracepointEntered(enterEv event.Event) { switch enterEv.(type) { case *types.OpenEvent: e.pairs.set(enterEv) + case *types.ExecEvent: + e.pairs.set(enterEv) default: // Only, when we have a comm name if _, ok := e.cachedComm(tid); ok { -- cgit v1.2.3