From dfdb18f83f7a957f99196369d97827d6209eeb9a Mon Sep 17 00:00:00 2001
From: We-unite <3205135446@qq.com>
Date: Tue, 13 Aug 2024 10:53:24 +0800
Subject: Filtering process data from mongodb

First of all, fix sth in listener to fit the function of filter. Ori-
ginally, listener mark the /usr/bin/containerd process id with star,
but the children in db is updated by ppid, which is pid of parent but
not tgid, so the stared pid has no children. To Fix this, we add all
the pid of /usr/bin/containerd into the db, and set their ptgid/tgid,
so that they're just normal process as others. Maybe we should finish
the info of these processes? haha.

Then, the filter of pid. There're some designed steps to do, and their
methods are as follows:

- Initially, because of the multithreading execution of listener,
  there may be several entries for the same process, and we should
  merge them. Extract data from database into a slice, and use a map
  to record process info. Iterate the slice, if the pid is in the
  map, then merge them, else insert into the map.
- Then, we should build process tree, but what we have is pid. So
  use another data structure, iterate merged process map, and build
  a map from tgid to a slice of processes. Find out the star. Build
  a map from pid to its tgid.
- BFS. Design a simple queue, and build the tree from the root(stared
  tgid), record all the visited tgid in another map. That's just the
  tree.

As usual, let's talk about the remaining issues:
- Some pids did not recieve exit message. Check the exit time of
  its tgid, or even its ppid.
- Optimize the data structure, record the tree by itself. Now the
  tree is recorded by not only the last helloTree map from tgid to
  slice but the map from pid to tgid. It's hard to store in the
  database. Design a better ds, so the viewer can build the tree
  quickly from the data in db.
- For future file filter, the close time, the same file for the same
  pid, and the pathName of a file, should be paid mych attention.

Fighting!
---
 listener/deal.go | 47 +++++++++++++++++++++++++++++++++--------------
 1 file changed, 33 insertions(+), 14 deletions(-)

(limited to 'listener/deal.go')

diff --git a/listener/deal.go b/listener/deal.go
index 8f77431..8225224 100644
--- a/listener/deal.go
+++ b/listener/deal.go
@@ -3,6 +3,7 @@ package main
 import (
 	"fmt"
 	"os"
+	"strconv"
 	"syscall"
 	"time"
 
@@ -17,27 +18,45 @@ const (
 )
 
 var pidCol, fdCol, fileCol mongoClient
-var err error
+
+func initPidCol() (err error) {
+	// TODO: 这里是否需要补全一下进程信息？
+	dirs, err := os.ReadDir(fmt.Sprintf("/proc/%d/task", containerdPid))
+	if err != nil {
+		return err
+	}
+	for _, file := range dirs {
+		pid, _ := strconv.Atoi(file.Name())
+		process := Process{
+			Ppid:       1,
+			ParentTgid: 1,
+			Pid:        pid,
+			Tgid:       containerdPid,
+			Cwd:        "/",
+			Children:   make([]int, 0),
+			Execve:     make([]Exec, 0),
+			Args:       make([]string, 0),
+		}
+		if pid == containerdPid {
+			process.Star = true
+		}
+		err = pidCol.InsertOne(process)
+	}
+	return nil
+}
 
 func deal() {
 	defer wg.Done()
 	var cooked Event
 	var ok bool
+	var err error
 
 	if err = pidCol.init(dbName, pidColName); err != nil {
 		fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
 		return
 	}
-	err = pidCol.InsertOne(Process{
-		Ppid:     1,
-		Pid:      containerdPid,
-		Cwd:      "/",
-		Children: make([]int, 0),
-		Star:     true,
-	})
-	if err != nil {
-		fmt.Fprintf(os.Stderr, "Error while initing the mongodb: %v\n", err)
-		return
+	if err = initPidCol(); err != nil {
+		fmt.Fprintf(os.Stderr, "Err while initing pidcol: %v\n", err)
 	}
 
 	if err = fdCol.init(dbName, fdColName); err != nil {
@@ -96,7 +115,7 @@ func deletePid(cooked Event) {
 func dealNewPid(cooked Event) {
 	// 自身是否已经记录
 	var docRes []Process
-	err = pidCol.Finddoc(bson.M{"pid": cooked.pid}, &docRes)
+	err := pidCol.Finddoc(bson.M{"pid": cooked.pid}, &docRes)
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "Err finding: %v\n", err)
 		return
@@ -136,7 +155,7 @@ func dealNewPid(cooked Event) {
 		}
 	}
 
-	err := pidCol.UpdateOne(bson.M{"pid": cooked.ppid}, bson.M{
+	err = pidCol.UpdateOne(bson.M{"pid": cooked.ppid}, bson.M{
 		"$push": bson.M{
 			"children": cooked.pid,
 		},
@@ -149,7 +168,7 @@ func dealNewPid(cooked Event) {
 func dealExecve(cooked Event) {
 	var docRes []Process
 	// 首先检查进程是否存在，如不存在则为之创建
-	err = pidCol.Finddoc(bson.M{"pid": cooked.pid}, &docRes)
+	err := pidCol.Finddoc(bson.M{"pid": cooked.pid}, &docRes)
 	if err != nil {
 		return
 	}
-- 
cgit v1.2.3-70-g09d2