BastionGuard/thirdparty/bastionguard-secure-connection/daemon/include/bsc/proc/ProcMon.hpp
specialworld83 f0f913a209 Release 2.0
2026-07-15 10:52:22 +02:00

42 lines
1.7 KiB
C++

#pragma once
#include "bsc/model/ProcessInfo.hpp"
#include <chrono>
#include <cstdint>
#include <mutex>
#include <optional>
#include <string>
#include <unordered_map>
#include <vector>
namespace bsc::proc {
class ProcMon {
public:
std::optional<bsc::model::ProcessInfo> inspect(std::uint32_t pid, bool checksums = false) const;
std::optional<bsc::model::ProcessInfo> cached(std::uint32_t pid, bool allow_recent_exit = true) const;
std::vector<bsc::model::ProcessInfo> recent_candidates(std::uint32_t uid,
std::chrono::milliseconds max_age = std::chrono::milliseconds(5000),
std::size_t limit = 8) const;
std::vector<bsc::model::ProcessInfo> recent_candidates_any(std::chrono::milliseconds max_age = std::chrono::milliseconds(1500),
std::size_t limit = 8) const;
void cache_process(const bsc::model::ProcessInfo& info) const;
void invalidate(std::uint32_t pid) const;
void note_fork(std::uint32_t child_pid, std::uint32_t parent_pid) const;
void note_exec(std::uint32_t pid, bool checksums = false) const;
void note_exit(std::uint32_t pid) const;
private:
struct CacheEntry {
bsc::model::ProcessInfo info;
bool has_checksums{false};
std::chrono::steady_clock::time_point updated_at{};
};
static std::optional<bsc::model::ProcessInfo> inspect_procfs(std::uint32_t pid, bool checksums);
mutable std::mutex cache_mutex_;
mutable std::unordered_map<std::uint32_t, CacheEntry> cache_;
mutable std::unordered_map<std::uint32_t, CacheEntry> exited_;
};
} // namespace bsc::proc