1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
|
#include
#include
#include
#include
#include
#include
#include
#include
#include
#include
// #include
#include
#include
#include
#include "cn_proc.h"
typedef struct __attribute__((aligned(NLMSG_ALIGNTO)))
{
struct nlmsghdr nl_hdr;
struct __attribute__((__packed__))
{
struct cn_msg cn_msg;
enum proc_cn_mcast_op cn_mcast;
};
} register_msg_t;
typedef struct __attribute__((aligned(NLMSG_ALIGNTO)))
{
struct nlmsghdr nl_hdr;
struct __attribute__((__packed__))
{
struct cn_msg cn_msg;
struct proc_event proc_ev;
};
} event_msg_t;
event_msg_t proc_msg;
void Now()
{
struct timespec ts;
struct tm *tm_info;
char buffer[64];
if (clock_gettime(CLOCK_REALTIME, &ts) == -1)
{
perror("clock_gettime");
return;
}
tm_info = localtime(&ts.tv_sec);
strftime(buffer, sizeof(buffer), "%Y-%m-%d %H:%M:%S", tm_info);
printf("Localtime %s.%03ld ", buffer, ts.tv_nsec / 1000000);
}
void printEvent()
{
union unnamed *procEvent = &proc_msg.proc_ev.event_data;
switch (proc_msg.proc_ev.what)
{
case PROC_EVENT_FORK:
Now();
printf("Fork\t%6d\t%6d\t%6d\t%6d\n", procEvent->fork.parent_pid, procEvent->fork.parent_tgid, procEvent->fork.child_pid, procEvent->fork.child_tgid);
break;
case PROC_EVENT_EXIT:
Now();
printf("Exit\t%6d\t%6d\t%6d\t%6d\n", procEvent->exit.process_pid, procEvent->exit.process_tgid, procEvent->exit.exit_code, procEvent->exit.exit_signal);
break;
case PROC_EVENT_EXEC:
default:
break;
}
}
int main()
{
int s = socket(PF_NETLINK, SOCK_DGRAM, NETLINK_CONNECTOR);
register_msg_t nlcn_msg;
struct sockaddr_nl l_local;
l_local.nl_family = AF_NETLINK;
l_local.nl_groups = 12345;
l_local.nl_pid = 0;
if (bind(s, (struct sockaddr *)&l_local, sizeof(struct sockaddr_nl)) == -1)
{
perror(bind);
close(s);
return -1;
}
// int on = l_local.nl_groups;
// setsockopt(s,270,1,&on,sizeof(on));
memset(&nlcn_msg, 0, sizeof(nlcn_msg));
nlcn_msg.nl_hdr.nlmsg_len = sizeof(nlcn_msg);
nlcn_msg.nl_hdr.nlmsg_pid = getpid();
nlcn_msg.nl_hdr.nlmsg_type = NLMSG_DONE;
nlcn_msg.cn_msg.id.idx = CN_IDX_PROC;
nlcn_msg.cn_msg.id.val = CN_VAL_PROC;
nlcn_msg.cn_msg.len = sizeof(enum proc_cn_mcast_op);
nlcn_msg.cn_mcast = PROC_CN_MCAST_LISTEN;
if (send(s, &nlcn_msg, sizeof(nlcn_msg), 0) == -1)
{
perror("can't register to netlink");
close(s);
return -1;
}
// 震惊，拿到socket了，开听！
printf("Hello, kernel-connector!\n");
// fd_set readfds;
// struct timeval tv = {
// .tv_sec = 5,
// .tv_usec = 0};
struct pollfd fds;
fds.fd = s;
fds.events = POLLIN;
int rc;
while (1)
{
// FD_ZERO(&readfds);
// FD_SET(s, &readfds);
// int rc = select(s + 1, &readfds, NULL, NULL, &tv);
rc = poll(&fds, 1, 5000);
if (rc == -1)
{
if (errno == EINTR)
{
continue;
}
fprintf(stderr, "Failed to listen to netlink socket: %s\n", strerror(errno));
return -1;
}
else if (rc == 0)
{
printf("No message in 5s...\n");
}
else
{
rc = recv(s, &proc_msg, sizeof(proc_msg), 0);
if (rc == -1)
{
if (errno == EINTR)
{
continue;
}
fprintf(stderr, "Failed to listen to netlink socket: %s\n", strerror(errno));
}
else
{
printEvent();
}
}
}
}
|
