Use netlink connector to recv pid info, fix exec

For some reasons, kernel-connector can catch exec event, but it
doesn't tell me about what the process exec and what're its args.
So we should use audit to collect these infomations, and complete
in the database.

However, there's different delays between connector and audit,
although they both use netlink socket, as a result of which, exec
may comes before fork. we deal with it the same way. But, there's
also exec event lost, may because of the check for ppid in exec
event, but it's necessary, and if is deleted, too much irrelavent
infomation would flood into database, i've tried. So make it there,
just go forward.

Besides, what's newly discovered is that pthread_create also use
clone syscall, but if pid 1 has a thread 2, the exec info will say
that pid 2 execs. So i shouldn't ignore connector msg that childPid
ne childTgid.

This is my first attempt to use git-submodule function in my own pro-
ject, also golang local package. Congratulations!

Now, fight to fix about file operations. Hope that there wouldn't
be too many fucking bugs.

9 files changed, 117 insertions, 49 deletions

diff --git a/.gitignore b/.gitignore
index bfe22fb..b9f0a38 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 .vscode/*
-godo
+*/godo
+*/hello
 
 old/*
 !old/*.*
diff --git a/.gitmodules b/.gitmodules
new file mode 100644
index 0000000..6a63c7b
--- /dev/null
+++ b/.gitmodules
@@ -0,0 +1,3 @@
+[submodule "src/netlink"]
+        path = src/netlink
+        url = https://github.com/We-unite/netlink
diff --git a/src/deal.go b/src/deal.go
index 717344c..3119fff 100644
--- a/src/deal.go
+++ b/src/deal.go
@@ -98,12 +98,15 @@ func deletePid(cooked Event) {
                 "$set": bson.M{
                         "exit_timestamp": cooked.timestamp,
                         "exit_code":      cooked.exit_code,
+                        "exit_signal":    cooked.exit_signal,
                 },
         })
         mongoMutex.Unlock()
+        fmt.Printf("Exit: %v\t%6d\t%6d\n", cooked.timestamp, cooked.pid, cooked.exit_code)
 }
 
 func dealNewPid(cooked Event) {
+        fmt.Printf("Fork: %v\t%6d\t%6d\n", cooked.timestamp, cooked.ppid, cooked.pid)
         // 有无父进程在观察中
         docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.ppid})
         if err != nil || len(docRes) != 1 {
@@ -153,6 +156,7 @@ func dealNewPid(cooked Event) {
 }
 
 func dealExecve(cooked Event) {
+        fmt.Printf("EXEC: %6d\t%6d\n", cooked.ppid, cooked.pid)
         // 父进程在不在？不在扔
         docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.ppid})
         if err != nil || len(docRes) != 1 {
@@ -175,19 +179,19 @@ func dealExecve(cooked Event) {
                                 },
                         },
                 })
-                // } else {
-                //      // 先fork抵达，插入
-                //      pidCol.InsertOne(bson.M{
-                //              "ppid":     cooked.ppid,
-                //              "pid":      cooked.pid,
-                //              "children": []bson.M{},
-                //              "execve": []bson.M{
-                //                      {
-                //                              "timestamp": cooked.timestamp,
-                //                              "execArgs":  cooked.argv,
-                //                      },
-                //              },
-                //      })
+        } else {
+                // 先fork抵达，插入
+                pidCol.InsertOne(bson.M{
+                        "ppid":     cooked.ppid,
+                        "pid":      cooked.pid,
+                        "children": []bson.M{},
+                        "execve": []bson.M{
+                                {
+                                        "timestamp": cooked.timestamp,
+                                        "execArgs":  cooked.argv,
+                                },
+                        },
+                })
         }
         mongoMutex.Unlock()
 }
diff --git a/src/global.go b/src/global.go
index f0f909c..a266b1b 100644
--- a/src/global.go
+++ b/src/global.go
@@ -33,12 +33,13 @@ type Event struct {
         timestamp    time.Time
         pid, ppid    int
         syscall      int
-        exit_code    uint64
+        syscallParam [4]uint64
+        pathName     string
         argc         int
         argv         []string
         cwd          string
-        syscallParam [4]uint64
-        pathName     string
+        exit_code    uint64
+        exit_signal  int
 }
 
 func (event Event) String() string {
diff --git a/src/go.work b/src/go.work
new file mode 100644
index 0000000..5b6c957
--- /dev/null
+++ b/src/go.work
@@ -0,0 +1,6 @@
+go 1.21.5
+
+use (
+    ./netlink
+    ./
+)
\ No newline at end of file
diff --git a/src/go.work.sum b/src/go.work.sum
new file mode 100644
index 0000000..8201e39
--- /dev/null
+++ b/src/go.work.sum
@@ -0,0 +1,4 @@
+golang.org/x/mod v0.8.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
+golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
+golang.org/x/term v0.19.0/go.mod h1:2CuTdWZ7KHSQwUzKva0cbMg6q2DMI3Mmxp+gKJbskEk=
+golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
diff --git a/src/godo.go b/src/godo.go
index 0edcc9f..c332c86 100644
--- a/src/godo.go
+++ b/src/godo.go
@@ -1,11 +1,15 @@
 package main
 
 import (
+        "bufio"
         "flag"
         "fmt"
         "log"
+        "netlink"
         "os"
         "os/exec"
+        "strings"
+        "syscall"
         "time"
 
         "github.com/elastic/go-libaudit/v2"
@@ -37,7 +41,8 @@ func main() {
         auditCmd = exec.Command("auditctl", "-D") // 清空所有规则
         auditCmd.Run()
 
-        pidSyscall := []string{"fork", "vfork", "clone", "execve", "exit", "exit_group"}
+        pidSyscall := []string{"execve"}
+        // pidSyscall := []string{"fork", "vfork", "clone", "execve", "exit", "exit_group"}
         // 设置监听规则
         for i := 0; i < len(pidSyscall); i++ {
                 auditCmd = exec.Command("auditctl", "-a", "exit,always", "-F", "arch=b64", "-S", pidSyscall[i])
@@ -77,6 +82,10 @@ func coroutine(client *libaudit.AuditClient) {
         // 各协程至此开始
         rawChan = make(chan interface{})
         cookedChan = make(chan Event)
+
+        wg.Add(1)
+        go procWatch()
+
         wg.Add(1)
         go receive(client)
         wg.Add(1)
@@ -87,3 +96,74 @@ func coroutine(client *libaudit.AuditClient) {
         wg.Wait()
         time.Sleep(2 * time.Second)
 }
+
+func procWatch() error {
+        ns, err := netlink.NewNetlinkSocket(syscall.NETLINK_CONNECTOR, 12345)
+        if err != nil {
+                fmt.Printf("Error creating socket: %v\n", err)
+                return err
+        }
+        defer ns.Close()
+        for {
+                res, err := ns.Receive()
+                if err != nil {
+                        fmt.Printf("Error recv: %v\n", err)
+                        continue
+                }
+                for i := 0; i < len(res); i++ {
+                        procEvent := netlink.ParseProcEvent(res[i].Data)
+                        switch procEvent.What {
+                        case netlink.PROC_EVENT_FORK:
+                                data := procEvent.Data.(netlink.ProcEventFork)
+                                cooked := Event{
+                                        tag:       NEWPID,
+                                        ppid:      int(data.ParentTgid),
+                                        pid:       int(data.ChildPid),
+                                        timestamp: time.Now(),
+                                }
+                                checkProc(&cooked)
+                                if data.ChildPid != data.ChildTgid {
+                                        cooked.ppid = int(data.ChildTgid)
+                                        cooked.pid = int(data.ChildPid)
+                                }
+                                cookedChan <- cooked
+                        case netlink.PROC_EVENT_EXIT:
+                                data := procEvent.Data.(netlink.ProcEventExit)
+                                cooked := Event{
+                                        tag:         PIDEXIT,
+                                        timestamp:   time.Now(),
+                                        pid:         int(data.ProcessPid),
+                                        exit_code:   uint64(data.ExitCode),
+                                        exit_signal: int(data.ExitSignal),
+                                }
+                                cookedChan <- cooked
+                        default:
+                        }
+                }
+        }
+}
+
+func checkProc(pCooked *Event) {
+        fileName := fmt.Sprintf("/proc/%d/cmdline", pCooked.pid)
+        fd, err := os.Open(fileName)
+        if err != nil {
+                fmt.Printf("Err opening file %s: %v\n", fileName, err)
+                return
+        }
+
+        scanner := bufio.NewScanner(fd)
+        scanner.Split(bufio.ScanLines)
+        for scanner.Scan() {
+                line := scanner.Text()
+                pCooked.argv = append(pCooked.argv, strings.Split(line, "\x00")...)
+        }
+        pCooked.argc = len(pCooked.argv)
+        fd.Close()
+
+        fileName = fmt.Sprintf("/proc/%d/cwd", pCooked.pid)
+        pCooked.cwd, err = os.Readlink(fileName)
+        if err != nil {
+                fmt.Printf("Err readlink %s: %v\n", fileName, err)
+                pCooked.cwd = ""
+        }
+}
diff --git a/src/netlink b/src/netlink
new file mode 160000
+Subproject 10d3ea361f0bcafb9b92054440984d32421aeb7
diff --git a/src/organize.go b/src/organize.go
index d7a1df1..238509f 100644
--- a/src/organize.go
+++ b/src/organize.go
@@ -47,7 +47,6 @@ func orgnaze() {
                         break
                 }
                 rawEvent = raw.(libaudit.RawAuditMessage)
-                fmt.Printf("type=%v msg=%s\n", rawEvent.Type, rawEvent.Data)
 
                 switch rawEvent.Type {
                 case auparse.AUDIT_SYSCALL:
@@ -100,24 +99,6 @@ func syscallRaw(rawEvent libaudit.RawAuditMessage) {
         }
 
         switch syscallTable[event.syscall] {
-        case "clone":
-                if exit == 0 || event.pid > exit {
-                        // exit=0是给新进程的返回，没用
-                        // pid>exit，证明有问题，抛弃
-                        break
-                } else {
-                        eventTable.Store(eventId, &Event{
-                                tag:       NEWPID,
-                                timestamp: event.timestamp,
-                                syscall:   event.syscall,
-                                exit_code: 0,
-                                ppid:      event.pid,
-                                pid:       exit,
-                                argc:      0,
-                                argv:      make([]string, 0),
-                                cwd:       "",
-                        })
-                }
         case "execve":
                 eventTable.Store(eventId, &Event{
                         tag:       EXECVE,
@@ -130,18 +111,6 @@ func syscallRaw(rawEvent libaudit.RawAuditMessage) {
                         argv:      make([]string, 0),
                         cwd:       "",
                 })
-        case "exit", "exit_group":
-                eventTable.Store(eventId, &Event{
-                        tag:       PIDEXIT,
-                        timestamp: event.timestamp,
-                        syscall:   event.syscall,
-                        exit_code: a[0],
-                        ppid:      event.ppid,
-                        pid:       event.pid,
-                        argc:      0,
-                        argv:      make([]string, 0),
-                        cwd:       "",
-                })
         case "open":
                 // 检查打开的权限
                 if a[1]&(syscall.O_APPEND|syscall.O_WRONLY|syscall.O_RDWR|syscall.O_TRUNC) == 0 {