hmz007
36ed224bac
Signed-off-by: hmz007 <hmz007@gmail.com> Change-Id: Ib87fdbe7a0be7dc961af3500fe9ea4589a127f9f
27 lines
646 B
C
27 lines
646 B
C
/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
|
|
#ifndef __EXECSNOOP_H
|
|
#define __EXECSNOOP_H
|
|
|
|
#define ARGSIZE 128
|
|
#define TASK_COMM_LEN 16
|
|
#define TOTAL_MAX_ARGS 60
|
|
#define DEFAULT_MAXARGS 20
|
|
#define FULL_MAX_ARGS_ARR (TOTAL_MAX_ARGS * ARGSIZE)
|
|
#define INVALID_UID ((uid_t)-1)
|
|
#define BASE_EVENT_SIZE (size_t)(&((struct event*)0)->args)
|
|
#define EVENT_SIZE(e) (BASE_EVENT_SIZE + e->args_size)
|
|
#define LAST_ARG (FULL_MAX_ARGS_ARR - ARGSIZE)
|
|
|
|
struct event {
|
|
pid_t pid;
|
|
pid_t ppid;
|
|
uid_t uid;
|
|
int retval;
|
|
int args_count;
|
|
unsigned int args_size;
|
|
char comm[TASK_COMM_LEN];
|
|
char args[FULL_MAX_ARGS_ARR];
|
|
};
|
|
|
|
#endif /* __EXECSNOOP_H */
|