1 files changed, 81 insertions, 1 deletions

diff --git a/src/godo.go b/src/godo.go
index 0edcc9f..c332c86 100644
--- a/src/godo.go
+++ b/src/godo.go
@@ -1,11 +1,15 @@
 package main
 
 import (
+        "bufio"
         "flag"
         "fmt"
         "log"
+        "netlink"
         "os"
         "os/exec"
+        "strings"
+        "syscall"
         "time"
 
         "github.com/elastic/go-libaudit/v2"
@@ -37,7 +41,8 @@ func main() {
         auditCmd = exec.Command("auditctl", "-D") // 清空所有规则
         auditCmd.Run()
 
-        pidSyscall := []string{"fork", "vfork", "clone", "execve", "exit", "exit_group"}
+        pidSyscall := []string{"execve"}
+        // pidSyscall := []string{"fork", "vfork", "clone", "execve", "exit", "exit_group"}
         // 设置监听规则
         for i := 0; i < len(pidSyscall); i++ {
                 auditCmd = exec.Command("auditctl", "-a", "exit,always", "-F", "arch=b64", "-S", pidSyscall[i])
@@ -77,6 +82,10 @@ func coroutine(client *libaudit.AuditClient) {
         // 各协程至此开始
         rawChan = make(chan interface{})
         cookedChan = make(chan Event)
+
+        wg.Add(1)
+        go procWatch()
+
         wg.Add(1)
         go receive(client)
         wg.Add(1)
@@ -87,3 +96,74 @@ func coroutine(client *libaudit.AuditClient) {
         wg.Wait()
         time.Sleep(2 * time.Second)
 }
+
+func procWatch() error {
+        ns, err := netlink.NewNetlinkSocket(syscall.NETLINK_CONNECTOR, 12345)
+        if err != nil {
+                fmt.Printf("Error creating socket: %v\n", err)
+                return err
+        }
+        defer ns.Close()
+        for {
+                res, err := ns.Receive()
+                if err != nil {
+                        fmt.Printf("Error recv: %v\n", err)
+                        continue
+                }
+                for i := 0; i < len(res); i++ {
+                        procEvent := netlink.ParseProcEvent(res[i].Data)
+                        switch procEvent.What {
+                        case netlink.PROC_EVENT_FORK:
+                                data := procEvent.Data.(netlink.ProcEventFork)
+                                cooked := Event{
+                                        tag:       NEWPID,
+                                        ppid:      int(data.ParentTgid),
+                                        pid:       int(data.ChildPid),
+                                        timestamp: time.Now(),
+                                }
+                                checkProc(&cooked)
+                                if data.ChildPid != data.ChildTgid {
+                                        cooked.ppid = int(data.ChildTgid)
+                                        cooked.pid = int(data.ChildPid)
+                                }
+                                cookedChan <- cooked
+                        case netlink.PROC_EVENT_EXIT:
+                                data := procEvent.Data.(netlink.ProcEventExit)
+                                cooked := Event{
+                                        tag:         PIDEXIT,
+                                        timestamp:   time.Now(),
+                                        pid:         int(data.ProcessPid),
+                                        exit_code:   uint64(data.ExitCode),
+                                        exit_signal: int(data.ExitSignal),
+                                }
+                                cookedChan <- cooked
+                        default:
+                        }
+                }
+        }
+}
+
+func checkProc(pCooked *Event) {
+        fileName := fmt.Sprintf("/proc/%d/cmdline", pCooked.pid)
+        fd, err := os.Open(fileName)
+        if err != nil {
+                fmt.Printf("Err opening file %s: %v\n", fileName, err)
+                return
+        }
+
+        scanner := bufio.NewScanner(fd)
+        scanner.Split(bufio.ScanLines)
+        for scanner.Scan() {
+                line := scanner.Text()
+                pCooked.argv = append(pCooked.argv, strings.Split(line, "\x00")...)
+        }
+        pCooked.argc = len(pCooked.argv)
+        fd.Close()
+
+        fileName = fmt.Sprintf("/proc/%d/cwd", pCooked.pid)
+        pCooked.cwd, err = os.Readlink(fileName)
+        if err != nil {
+                fmt.Printf("Err readlink %s: %v\n", fileName, err)
+                pCooked.cwd = ""
+        }
+}