1 files changed, 40 insertions, 11 deletions

diff --git a/src/deal.go b/src/deal.go
index f2b7d4b..e553174 100644
--- a/src/deal.go
+++ b/src/deal.go
@@ -2,6 +2,7 @@ package main
 
 import (
         "fmt"
+        "os"
         "syscall"
 
         "go.mongodb.org/mongo-driver/bson"
@@ -26,7 +27,7 @@ func deal() {
         var ok bool
 
         if err = pidCol.init(dbName, pidColName); err != nil {
-                fmt.Printf("Error while initing the mongodb: %v\n", err)
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
                 return
         }
         err = pidCol.InsertOne(bson.M{
@@ -37,16 +38,16 @@ func deal() {
                 "daemon":   true,
         })
         if err != nil {
-                fmt.Printf("Error while initing the mongodb: %v\n", err)
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
                 return
         }
 
         if err = fdCol.init(dbName, fdColName); err != nil {
-                fmt.Printf("Error while initing the mongodb: %v\n", err)
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
                 return
         }
         if err = fileCol.init(dbName, fileColName); err != nil {
-                fmt.Printf("Error while initing the mongodb: %v\n", err)
+                fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
         }
 
         fmt.Printf("Containerd: %d\n", containerdPid)
@@ -73,6 +74,8 @@ func deal() {
                         go fileWrite(cooked)
                 case FILECLOSE:
                         go fileClose(cooked)
+                case PIVOTROOT:
+                        go pivotRoot(cooked)
                 }
         }
 }
@@ -85,9 +88,6 @@ func deletePid(cooked Event) {
                 },
         })
 
-        // 孩子们需要收容
-        // 不必到children里一个个找，直接看ppid即可
-        // pidCol.UpdateMany(bson.M{"ppid": cooked.pid}, bson.M{"ppid": 1})
         // 在这套逻辑里，孩子是不需要收容的，因为我们根本就不看ppid来工作
 
         // 可以去死了
@@ -98,13 +98,15 @@ func deletePid(cooked Event) {
                         "exit_signal":    cooked.exit_signal,
                 },
         })
+
+        // 理论上这里需要关闭所有文件描述符，但为了处理效率，留给后续流程
 }
 
 func dealNewPid(cooked Event) {
         // 自身是否已经记录
         docRes, err = pidCol.Finddoc(bson.M{"pid": cooked.pid})
         if err != nil {
-                fmt.Printf("Err finding: %v\n", err)
+                fmt.Fprintf(os.Stderr, "Err finding: %v\n", err)
                 return
         }
 
@@ -189,7 +191,7 @@ func fileOpen(cooked Event) {
         // 权限检查过了，不必再查
         fdCol.InsertOne(bson.M{
                 "timestamp": cooked.timestamp,
-                "fileName":  cooked.pathName,
+                "fileName":  cooked.srcPath,
                 "pid":       cooked.pid,
                 "fd":        cooked.exit_code,
                 "flags":     cooked.syscallParam,
@@ -212,7 +214,7 @@ func fileClose(cooked Event) {
         }
         res["close_timestamp"] = cooked.timestamp
         if err := fileCol.InsertOne(res); err != nil {
-                fmt.Printf("Err inserting files: %v\n", err)
+                fmt.Fprintf(os.Stderr, "Err inserting files: %v\n", err)
         }
 }
 
@@ -223,7 +225,7 @@ func fileWrite(cooked Event) {
                 "close_timestamp": bson.M{"$exists": false},
         })
         if err != nil {
-                fmt.Printf("Err closing fd %d of pid %d: %v\n", cooked.syscallParam[0], cooked.pid, err)
+                fmt.Fprintf(os.Stderr, "Err closing fd %d of pid %d: %v\n", cooked.syscallParam[0], cooked.pid, err)
         }
         if len(res) == 0 {
                 return
@@ -234,3 +236,30 @@ func fileWrite(cooked Event) {
                 "close_timestamp": bson.M{"$exists": false},
         }, bson.M{"$push": bson.M{"written": cooked.timestamp}})
 }
+
+func pivotRoot(cooked Event) {
+        // docker的根目录信息，记录
+        docRes, err := pidCol.Finddoc(bson.M{"pid": cooked.pid})
+        if err != nil {
+                fmt.Fprintf(os.Stderr, "Err finding: %v\n", err)
+                return
+        }
+
+        if len(docRes) == 0 {
+                // fork还没到，等一下
+                pidCol.InsertOne(bson.M{
+                        "start_timestamp": cooked.timestamp,
+                        "ppid":            cooked.ppid,
+                        "pid":             cooked.pid,
+                        "rootfs":          "cwd",
+                })
+        } else {
+                // 读取已有的工作目录
+                cwd := docRes[0]["cwd"]
+                pidCol.UpdateOne(bson.M{"pid": cooked.pid}, bson.M{
+                        "$set": bson.M{
+                                "rootfs": cwd,
+                        },
+                })
+        }
+}