9#include <cosmos/BitMask.hxx>
10#include <cosmos/proc/ptrace.hxx>
11#include <cosmos/proc/types.hxx>
12#include <cosmos/string.hxx>
15#include <clues/types.hxx>
53 using FormatFlags = cosmos::BitMask<FormatFlag>;
59 m_consumer{consumer} {
97 TraceePtr addTracee(
const cosmos::ProcessID pid,
const FollowChildren follow_children,
98 const AttachThreads attach_threads,
const cosmos::ProcessID sibling = cosmos::ProcessID::INVALID);
118 TraceePtr addTracee(
const cosmos::StringVector &cmdline,
const FollowChildren follow_children);
152 void stop(
const std::optional<cosmos::Signal> signal);
154 FormatFlags formatFlags()
const {
155 return m_format_flags;
169 using TraceeMap = std::map<cosmos::ProcessID, TraceePtr>;
171 using EventMap = std::map<cosmos::ProcessID, cosmos::ChildState>;
183 void checkCleanupTracee(TraceeMap::iterator it);
185 void checkUnknownEvents();
187 Decision handleEvent(
const cosmos::ChildState &data);
189 void handleNoChildren();
198 Decision checkUnknownTraceeEvent(
const cosmos::ChildState &data);
200 bool tryUpdateTraceePID(
const cosmos::ProcessID old_pid,
const cosmos::ProcessID new_pid);
209 void handleAutoAttach(
Tracee &parent,
const cosmos::ProcessID pid,
210 const cosmos::ptrace::Event event,
const SystemCall &sc);
213 TraceePtr handleSubstitution(
const cosmos::ProcessID old_pid);
Main class for configuring and running libclues.
Engine(EventConsumer &consumer)
Creates a new Engine that reports events to consumer.
TraceeMap m_tracees
Currently active tracees.
Decision
Different decisions what to do with ptrace events.
@ DONE
the event has been successfully processed.
@ STORE
store the event for later.
@ DROP
ignore/drop the event.
@ RETRY
retry processing the event.
void setFormatFlags(const FormatFlags flags)
Change formatting behaviour for system calls.
EventMap m_unknown_events
Unknown ptrace events stored for later processing.
cosmos::ProcessID m_newly_attached_pid
The PID of a newly auto-attached Tracee, if any.
FormatFlags m_format_flags
Format settings for all tracees attached to this engine.
@ FD_INFO
print detailed file descriptor information
Callback interface for consumers of tracing events.
Access to System Call Data.
Base class for traced processes.
cosmos::NamedBool< struct attach_threads_t, true > AttachThreads
A strong boolean type denoting whether to automatically all other threads of a process.
cosmos::NamedBool< struct follow_children_t, true > FollowChildren
A strong boolean type denoting whether to automatically attach to newly created child processes.