1 files changed, 84 insertions, 0 deletions

diff --git a/listener/global.go b/listener/global.go
new file mode 100644
index 0000000..11b18bf
--- /dev/null
+++ b/listener/global.go
@@ -0,0 +1,84 @@
+package main
+
+import (
+        "sync"
+        "time"
+)
+
+type eventType int
+
+const (
+        NEWPID eventType = iota
+        PIDEXIT
+        EXECVE
+        FILEOPEN
+        FILECLOSE
+        FILEWRITE
+        PIVOTROOT
+        TYPENUM
+)
+
+func (et eventType) String() string {
+        names := []string{"NEWPID", "PIDEXIT", "EXECVE", "FILEOPEN", "FILECLOSE", "FILEWRITE", "PIVOTROOT", "TYPENUM"}
+        if et < NEWPID || et > TYPENUM {
+                return "Unknown"
+        }
+        return names[et]
+}
+
+type Event struct {
+        tag              eventType
+        timestamp        time.Time
+        pid, tgid        int
+        ppid, parentTgid int
+        syscall          int
+        syscallParam     [4]uint64
+        argc             int
+        argv             []string
+        comm             string
+        cwd              string
+        exit_code        int
+        exit_signal      int
+        srcPath          string
+        destPath         string
+}
+
+var wg sync.WaitGroup        // 掌管协程
+var rawChan chan interface{} // 从接收到整理的管道
+var cookedChan chan Event    // 整理好的信息的管道
+var syscallTable [500]string //记录一下系统调用
+var containerdPid int
+
+// 插入到数据库的结构
+type Exec struct {
+        Timestamp time.Time `bson:"timestamp"`
+        ExecArgs  []string  `bson:"execArgs"`
+}
+
+type Process struct {
+        Star           bool      `bson:"star"`
+        StartTimestamp time.Time `bson:"start_timestamp"`
+        Ppid           int       `bson:"ppid"`
+        ParentTgid     int       `bson:"parentTgid"`
+        Pid            int       `bson:"pid"`
+        Tgid           int       `bson:"tgid"`
+        Args           []string  `bson:"args"`
+        Comm           string    `bson:"comm"`
+        RootFS         string    `bson:"rootfs"`
+        Cwd            string    `bson:"cwd"`
+        Children       []int     `bson:"children"`
+        Execve         []Exec    `bson:"execve"`
+        ExitCode       int       `bson:"exit_code"`
+        ExitSignal     int       `bson:"exit_signal"`
+        ExitTimestamp  time.Time `bson:"exit_timestamp"`
+}
+
+type File struct {
+        OpenTimestamp  time.Time   `bson:"timestamp"`
+        FileName       string      `bson:"fileName"`
+        Pid            int         `bson:"pid"`
+        Fd             int         `bson:"fd"`
+        Flags          [4]uint64   `bson:"flags"`
+        Written        []time.Time `bson:"written"`
+        CloseTimestamp time.Time   `bson:"close_timestamp"`
+}