1 files changed, 113 insertions, 44 deletions

diff --git a/godo.go b/godo.go
index 2ba97d1..1ae336b 100644
--- a/godo.go
+++ b/godo.go
@@ -34,26 +34,27 @@ type Event struct {
         pid, ppid int
         syscall   int
         argc      int
-        args      []string
+        argv      []string
         cwd       string
 }
 
 type process struct {
-        cmdline  string
-        argv     []string
-        cwd      string
-        rootfs   string
-        children []int
+        timestamp time.Time
+        pid, ppid int
+        argv      []string
+        cwd       string
+        rootfs    string
+        children  []int
 }
 
-var pids map[int]*process     //古希腊掌管进程的神
-var containers map[string]int // 古希腊掌管容器的神
-var wg sync.WaitGroup         // 掌管协程
-var rawChan chan interface{}  // 从接收到整理的管道，这里不是原始数据类型，下文解释
-var cookedChan chan Event     // 整理好的信息的管道
-
+var pids sync.Map            // 古希腊掌管进程的神，int->*process
+var wg sync.WaitGroup        // 掌管协程
+var rawChan chan interface{} // 从接收到整理的管道
+var cookedChan chan Event    // 整理好的信息的管道
 var syscallTable [500]string //记录一下系统调用
 
+var containerdPid int
+
 func main() {
         // 检查用户身份，并添加auditd规则，监听所有syscall
         if os.Geteuid() != 0 {
@@ -72,26 +73,42 @@ func main() {
         auditCmd = exec.Command("auditctl", "-D") // 清空所有规则
         auditCmd.Run()
         // 设置监听规则
-        for i := 0; i < 5; i++ {
+        for i := 0; i < len(syscall); i++ {
                 auditCmd = exec.Command("auditctl", "-a", "exit,always", "-F", "arch=b64", "-S", syscall[i])
                 auditCmd.Run()
         }
 
         // 查找pid
-        containerdPid, err := getPid()
+        containerdPid, err = getPid()
         if err != nil {
                 fmt.Printf("Error finding containerd: %v\n", err)
                 return
         }
         // 数据结构初始化
-        pids = make(map[int]*process)
-        containers = make(map[string]int)
+        // pids = make(map[int]*process)
+        // containers = make(map[string]int)
 
         // 创世之神，1号进程
-        pids[1] = &process{rootfs: "/", children: make([]int, 0)}
-        pids[1].children = append(pids[1].children, containerdPid)
+        // pids[1] = &process{rootfs: "/", children: make([]int, 0)}
+        // pids[1].children = append(pids[1].children, containerdPid)
+        // 1号进程还是不要在进程树上直接出现了，不然它的小儿子们都会出现
+
         // /usr/bin/containerd，也就是我们最关注的进程
-        pids[containerdPid] = &process{cmdline: "/usr/bin/cmdline", rootfs: "/", children: make([]int, 0)}
+        // pids[containerdPid] = &process{rootfs: "/", children: make([]int, 0)}
+        pids.Store(containerdPid, &process{
+                ppid:     1,
+                pid:      containerdPid,
+                argv:     make([]string, 0),
+                cwd:      "/",
+                rootfs:   "/",
+                children: make([]int, 0),
+        })
+        p, ok := pids.Load(containerdPid)
+        if !ok {
+                fmt.Printf("???\n")
+                return
+        }
+        p.(*process).argv = append(p.(*process).argv, "/usr/bin/containerd")
 
         // 开始运行，解析命令行参数后监听
         if err := fs.Parse(os.Args[1:]); err != nil {
@@ -148,7 +165,7 @@ func getPid() (int, error) {
                         return pid, nil
                 }
         }
-        err = fmt.Errorf("Error: no containerd process found.\n")
+        err = fmt.Errorf("Error: no containerd process found.")
         return 0, err
 }
 
@@ -362,7 +379,7 @@ func orgnaze() {
                                         ppid:      event.ppid,
                                         pid:       event.pid,
                                         argc:      0,
-                                        args:      make([]string, 0),
+                                        argv:      make([]string, 0),
                                         cwd:       "",
                                 }
                         }
@@ -377,10 +394,9 @@ func orgnaze() {
                                                 if len(match[i][2]) == 0 {
                                                         // 代表着匹配到的是十六进制数
                                                         str := hexToAscii(string(match[i][3]))
-                                                        eventTable[eventId].args = append(eventTable[eventId].args, str)
-                                                        fmt.Printf("Origin: \"%s\", Res: \"%s\"\n", match[i][3], str)
+                                                        eventTable[eventId].argv = append(eventTable[eventId].argv, str)
                                                 } else {
-                                                        eventTable[eventId].args = append(eventTable[eventId].args, string(match[i][2]))
+                                                        eventTable[eventId].argv = append(eventTable[eventId].argv, string(match[i][2]))
                                                 }
                                         }
                                         eventTable[eventId].argc = argc
@@ -408,30 +424,21 @@ func orgnaze() {
                                         } else {
                                                 cmdline = string(match[3])
                                         }
-                                        pEvent.args = strings.Split(cmdline, " ")
-                                        pEvent.argc = len(eventTable[eventId].args)
-                                }
-                                // 当读到proctitle的时候，而且是个新进程最好检查一下cwd，如果还为空，找proc
-                                if pEvent.cwd == "" && (pEvent.syscall == 57 || pEvent.syscall == 58 || pEvent.syscall == 59) {
-                                        cwdFilePath := fmt.Sprintf("/proc/%d/cwd", pEvent.pid)
-                                        pEvent.cwd, err[1] = os.Readlink(cwdFilePath)
-                                        if err[1] != nil {
-                                                pEvent.cwd = ""
-                                                break
-                                        }
+                                        pEvent.argv = strings.Split(cmdline, " ")
+                                        pEvent.argc = len(eventTable[eventId].argv)
                                 }
                         }
                 case auparse.AUDIT_EOE:
                         if eoeRegex.Match(rawEvent.Data) {
                                 match := eoeRegex.FindSubmatch(rawEvent.Data)
                                 eventId, err[0] = strconv.Atoi(string(match[1]))
-                                // TODO: 事件整理完毕，即刻发出，是否合理呢？
+                                // ATTENTION: 事件整理完毕，即刻发出，是否合理呢？
                                 cooked = *eventTable[eventId] // 应当采用深拷贝吗？有待实验
                                 cookedChan <- cooked
                                 delete(eventTable, eventId) //发出之后就从信息表扔掉，死人别占地
                         }
                 default:
-                        // TODO: 这里也需要做防护
+                        // ATTENTION: 这里也需要做防护
                 }
         }
 }
@@ -453,14 +460,76 @@ func deal() {
                 //      args      []string
                 //      cwd       string
                 // }
-                fmt.Printf("recv: %v syscall=%d, ppid=%d, pid=%d, cwd=\"%s\", argc=%d, ", cooked.timestamp, cooked.syscall, cooked.ppid, cooked.pid, cooked.cwd, cooked.argc)
-                if len(cooked.args) != cooked.argc {
-                        fmt.Printf("Fuck!\n")
-                        continue
+                // type process struct {
+                //      timestamp time.Time
+                //      pid, ppid int
+                //      argv      []string
+                //      cwd       string
+                //      rootfs    string
+                //      children  []int
+                // }
+                switch syscallTable[cooked.syscall] {
+                case "fork", "vfork", "clone":
+                        ppid := cooked.ppid
+                        pid := cooked.pid
+                        parent, ok := pids.Load(ppid)
+                        if !ok {
+                                break
+                        }
+                        parent.(*process).children = append(parent.(*process).children, pid)
+                        pids.Store(pid, &process{
+                                timestamp: cooked.timestamp,
+                                pid:       cooked.pid,
+                                ppid:      cooked.ppid,
+                                argv:      cooked.argv,
+                                cwd:       cooked.cwd,
+                                children:  make([]int, 0),
+                        })
+                        fmt.Printf("%v syscall=%d, ppid=%d, pid=%d, cwd=\"%s\", argc=%d, ", cooked.timestamp, cooked.syscall, cooked.ppid, cooked.pid, cooked.cwd, cooked.argc)
+                        for i := 0; i < cooked.argc; i++ {
+                                fmt.Printf("arg[%d]=\"%s\", ", i, cooked.argv[i])
+                        }
+                        fmt.Printf("\n")
+                case "exit", "exit_group":
+                        _, ok := pids.Load(cooked.pid)
+                        if !ok {
+                                break
+                        }
+                        go deletePid(cooked)
+                }
+        }
+}
+
+func deletePid(cooked Event) {
+        time.Sleep(1 * time.Second)
+        Process, ok := pids.Load(cooked.pid)
+        if !ok {
+                return
+        }
+        pProcess := Process.(*process)
+
+        // 先从爹那里注销户籍
+        parent, ok := pids.Load(pProcess.ppid)
+        if ok {
+                pParent := parent.(*process)
+                for i, child := range pParent.children {
+                        if child == pProcess.pid {
+                                pParent.children = append(pParent.children[:i], pParent.children[i+1:]...)
+                                break
+                        }
                 }
-                for i := 0; i < cooked.argc; i++ {
-                        fmt.Printf("arg[%d]=\"%s\", ", i, cooked.args[i])
+        }
+
+        // 子进程需要收容
+        for i := 0; i < len(pProcess.children); i++ {
+                child, ok := pids.Load(pProcess.children[i])
+                if ok {
+                        child.(*process).ppid = 1
                 }
-                fmt.Printf("\n")
         }
+
+        // 可以去死了
+        pids.Delete(cooked.pid)
+        _, ok = pids.Load(cooked.pid)
+        fmt.Printf("%v Goodbye, %d! ok = %v\n", time.Now(), cooked.pid, ok)
 }