Fix some bugs, and 3nd coroutine can get pid tree.base

For some reasons, the linux kernel has made some changes in syscalls.
As shown in src code, we pay attention to fork/vfork/clone to create
process, while exit/exit_group to kill it. From my opinion, the fork
and clone syscall should be totally different, otherwise there will
be only one syscall. However, according to the logs, I heard only
clone but no fork, exit_group but no exit. Infact, fork calls clone
and then makes some special set. They're different, fork means parents
and children, while clone means calling and callee, which allows to
share sth between caller and callee. Both fork and clone makes a new
process, pthread makes tasks and is called thread. Pid is factually
task id.

Now the 3 coroutines works well, and I've get a process tree by
map[int]*process. Here hides some questions:
- is it right for 2nd corutine to send to 3rd as long as eoe?
- how to make the delay between exit_group and deletePid clear and
suitable?

Next works:
- Change the pids from map into DataBase, which means that we
should devide front-end and back-end. Besides, when you delete
sth(such as process exit), don't delete from databese, instead
just make a tag and record their exit code. In other words, we
judge if it's alive not by entry existance but exit tag.
- Make containers recorded, for instance, rootFS, root-process,
name, id, etc.. And record them in map, maintain this database table.

2 files changed, 113 insertions, 51 deletions

diff --git a/build.sh b/build.sh
deleted file mode 100755
index 8bdadb3..0000000
--- a/build.sh
+++ /dev/null
@@ -1,7 +0,0 @@
-#!/bin/bash
-
-set -e
-docker_api_version=$(docker version)
-docker_api_version=$(docker version | grep API | head -n 1 | awk '{print $3}')
-echo "Docker API version is $docker_api_version..."
-export DOCKER_API_VERSION=$docker_api_version
\ No newline at end of file
diff --git a/godo.go b/godo.go
index 2ba97d1..1ae336b 100644
--- a/godo.go
+++ b/godo.go
@@ -34,26 +34,27 @@ type Event struct {
         pid, ppid int
         syscall   int
         argc      int
-        args      []string
+        argv      []string
         cwd       string
 }
 
 type process struct {
-        cmdline  string
-        argv     []string
-        cwd      string
-        rootfs   string
-        children []int
+        timestamp time.Time
+        pid, ppid int
+        argv      []string
+        cwd       string
+        rootfs    string
+        children  []int
 }
 
-var pids map[int]*process     //古希腊掌管进程的神
-var containers map[string]int // 古希腊掌管容器的神
-var wg sync.WaitGroup         // 掌管协程
-var rawChan chan interface{}  // 从接收到整理的管道，这里不是原始数据类型，下文解释
-var cookedChan chan Event     // 整理好的信息的管道
-
+var pids sync.Map            // 古希腊掌管进程的神，int->*process
+var wg sync.WaitGroup        // 掌管协程
+var rawChan chan interface{} // 从接收到整理的管道
+var cookedChan chan Event    // 整理好的信息的管道
 var syscallTable [500]string //记录一下系统调用
 
+var containerdPid int
+
 func main() {
         // 检查用户身份，并添加auditd规则，监听所有syscall
         if os.Geteuid() != 0 {
@@ -72,26 +73,42 @@ func main() {
         auditCmd = exec.Command("auditctl", "-D") // 清空所有规则
         auditCmd.Run()
         // 设置监听规则
-        for i := 0; i < 5; i++ {
+        for i := 0; i < len(syscall); i++ {
                 auditCmd = exec.Command("auditctl", "-a", "exit,always", "-F", "arch=b64", "-S", syscall[i])
                 auditCmd.Run()
         }
 
         // 查找pid
-        containerdPid, err := getPid()
+        containerdPid, err = getPid()
         if err != nil {
                 fmt.Printf("Error finding containerd: %v\n", err)
                 return
         }
         // 数据结构初始化
-        pids = make(map[int]*process)
-        containers = make(map[string]int)
+        // pids = make(map[int]*process)
+        // containers = make(map[string]int)
 
         // 创世之神，1号进程
-        pids[1] = &process{rootfs: "/", children: make([]int, 0)}
-        pids[1].children = append(pids[1].children, containerdPid)
+        // pids[1] = &process{rootfs: "/", children: make([]int, 0)}
+        // pids[1].children = append(pids[1].children, containerdPid)
+        // 1号进程还是不要在进程树上直接出现了，不然它的小儿子们都会出现
+
         // /usr/bin/containerd，也就是我们最关注的进程
-        pids[containerdPid] = &process{cmdline: "/usr/bin/cmdline", rootfs: "/", children: make([]int, 0)}
+        // pids[containerdPid] = &process{rootfs: "/", children: make([]int, 0)}
+        pids.Store(containerdPid, &process{
+                ppid:     1,
+                pid:      containerdPid,
+                argv:     make([]string, 0),
+                cwd:      "/",
+                rootfs:   "/",
+                children: make([]int, 0),
+        })
+        p, ok := pids.Load(containerdPid)
+        if !ok {
+                fmt.Printf("???\n")
+                return
+        }
+        p.(*process).argv = append(p.(*process).argv, "/usr/bin/containerd")
 
         // 开始运行，解析命令行参数后监听
         if err := fs.Parse(os.Args[1:]); err != nil {
@@ -148,7 +165,7 @@ func getPid() (int, error) {
                         return pid, nil
                 }
         }
-        err = fmt.Errorf("Error: no containerd process found.\n")
+        err = fmt.Errorf("Error: no containerd process found.")
         return 0, err
 }
 
@@ -362,7 +379,7 @@ func orgnaze() {
                                         ppid:      event.ppid,
                                         pid:       event.pid,
                                         argc:      0,
-                                        args:      make([]string, 0),
+                                        argv:      make([]string, 0),
                                         cwd:       "",
                                 }
                         }
@@ -377,10 +394,9 @@ func orgnaze() {
                                                 if len(match[i][2]) == 0 {
                                                         // 代表着匹配到的是十六进制数
                                                         str := hexToAscii(string(match[i][3]))
-                                                        eventTable[eventId].args = append(eventTable[eventId].args, str)
-                                                        fmt.Printf("Origin: \"%s\", Res: \"%s\"\n", match[i][3], str)
+                                                        eventTable[eventId].argv = append(eventTable[eventId].argv, str)
                                                 } else {
-                                                        eventTable[eventId].args = append(eventTable[eventId].args, string(match[i][2]))
+                                                        eventTable[eventId].argv = append(eventTable[eventId].argv, string(match[i][2]))
                                                 }
                                         }
                                         eventTable[eventId].argc = argc
@@ -408,30 +424,21 @@ func orgnaze() {
                                         } else {
                                                 cmdline = string(match[3])
                                         }
-                                        pEvent.args = strings.Split(cmdline, " ")
-                                        pEvent.argc = len(eventTable[eventId].args)
-                                }
-                                // 当读到proctitle的时候，而且是个新进程最好检查一下cwd，如果还为空，找proc
-                                if pEvent.cwd == "" && (pEvent.syscall == 57 || pEvent.syscall == 58 || pEvent.syscall == 59) {
-                                        cwdFilePath := fmt.Sprintf("/proc/%d/cwd", pEvent.pid)
-                                        pEvent.cwd, err[1] = os.Readlink(cwdFilePath)
-                                        if err[1] != nil {
-                                                pEvent.cwd = ""
-                                                break
-                                        }
+                                        pEvent.argv = strings.Split(cmdline, " ")
+                                        pEvent.argc = len(eventTable[eventId].argv)
                                 }
                         }
                 case auparse.AUDIT_EOE:
                         if eoeRegex.Match(rawEvent.Data) {
                                 match := eoeRegex.FindSubmatch(rawEvent.Data)
                                 eventId, err[0] = strconv.Atoi(string(match[1]))
-                                // TODO: 事件整理完毕，即刻发出，是否合理呢？
+                                // ATTENTION: 事件整理完毕，即刻发出，是否合理呢？
                                 cooked = *eventTable[eventId] // 应当采用深拷贝吗？有待实验
                                 cookedChan <- cooked
                                 delete(eventTable, eventId) //发出之后就从信息表扔掉，死人别占地
                         }
                 default:
-                        // TODO: 这里也需要做防护
+                        // ATTENTION: 这里也需要做防护
                 }
         }
 }
@@ -453,14 +460,76 @@ func deal() {
                 //      args      []string
                 //      cwd       string
                 // }
-                fmt.Printf("recv: %v syscall=%d, ppid=%d, pid=%d, cwd=\"%s\", argc=%d, ", cooked.timestamp, cooked.syscall, cooked.ppid, cooked.pid, cooked.cwd, cooked.argc)
-                if len(cooked.args) != cooked.argc {
-                        fmt.Printf("Fuck!\n")
-                        continue
+                // type process struct {
+                //      timestamp time.Time
+                //      pid, ppid int
+                //      argv      []string
+                //      cwd       string
+                //      rootfs    string
+                //      children  []int
+                // }
+                switch syscallTable[cooked.syscall] {
+                case "fork", "vfork", "clone":
+                        ppid := cooked.ppid
+                        pid := cooked.pid
+                        parent, ok := pids.Load(ppid)
+                        if !ok {
+                                break
+                        }
+                        parent.(*process).children = append(parent.(*process).children, pid)
+                        pids.Store(pid, &process{
+                                timestamp: cooked.timestamp,
+                                pid:       cooked.pid,
+                                ppid:      cooked.ppid,
+                                argv:      cooked.argv,
+                                cwd:       cooked.cwd,
+                                children:  make([]int, 0),
+                        })
+                        fmt.Printf("%v syscall=%d, ppid=%d, pid=%d, cwd=\"%s\", argc=%d, ", cooked.timestamp, cooked.syscall, cooked.ppid, cooked.pid, cooked.cwd, cooked.argc)
+                        for i := 0; i < cooked.argc; i++ {
+                                fmt.Printf("arg[%d]=\"%s\", ", i, cooked.argv[i])
+                        }
+                        fmt.Printf("\n")
+                case "exit", "exit_group":
+                        _, ok := pids.Load(cooked.pid)
+                        if !ok {
+                                break
+                        }
+                        go deletePid(cooked)
+                }
+        }
+}
+
+func deletePid(cooked Event) {
+        time.Sleep(1 * time.Second)
+        Process, ok := pids.Load(cooked.pid)
+        if !ok {
+                return
+        }
+        pProcess := Process.(*process)
+
+        // 先从爹那里注销户籍
+        parent, ok := pids.Load(pProcess.ppid)
+        if ok {
+                pParent := parent.(*process)
+                for i, child := range pParent.children {
+                        if child == pProcess.pid {
+                                pParent.children = append(pParent.children[:i], pParent.children[i+1:]...)
+                                break
+                        }
                 }
-                for i := 0; i < cooked.argc; i++ {
-                        fmt.Printf("arg[%d]=\"%s\", ", i, cooked.args[i])
+        }
+
+        // 子进程需要收容
+        for i := 0; i < len(pProcess.children); i++ {
+                child, ok := pids.Load(pProcess.children[i])
+                if ok {
+                        child.(*process).ppid = 1
                 }
-                fmt.Printf("\n")
         }
+
+        // 可以去死了
+        pids.Delete(cooked.pid)
+        _, ok = pids.Load(cooked.pid)
+        fmt.Printf("%v Goodbye, %d! ok = %v\n", time.Now(), cooked.pid, ok)
 }