#pragma once #include #include #include #include #include namespace bsc::netlink { struct ProcEvent { enum class Type { Unknown, Fork, Exec, Exit, Uid, Gid, Sid, Comm, Ptrace, CoreDump }; Type type{Type::Unknown}; std::uint32_t pid{0}; std::uint32_t tgid{0}; std::uint32_t parent_pid{0}; std::uint32_t parent_tgid{0}; std::uint32_t uid{0}; std::uint32_t gid{0}; std::int32_t exit_code{0}; std::uint32_t exit_signal{0}; std::string comm; }; class ProcEventMonitor { public: using Handler = std::function; ProcEventMonitor(); ~ProcEventMonitor(); bool start(Handler handler); void stop(); bool running() const noexcept { return running_; } static bool available(); private: class Impl; std::unique_ptr impl_; std::atomic_bool running_{false}; }; } // namespace bsc::netlink