luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(go): port memory-map detector tranche

Browse source
This commit is contained in:
Luna 2026-07-11 01:19:56 -07:00
parent c6f7219de8
commit 6a27e6e770
No known key found for this signature in database
13 changed files with 377 additions and 41 deletions
Download patch file Download diff file Expand all files Collapse all files

23
go-agent/internal/model/model.go
View file

@ -7,12 +7,23 @@ package model
// Process is the subset of /proc process state needed by the first ported
// poll detectors. Fields are added as more Python detectors move across.
type Process struct {
PID int `json:"pid"`
Comm string `json:"comm"`
Cmdline string `json:"cmdline"`
Exe string `json:"exe"`
Environ map[string]string `json:"environ"`
FDTargets map[string]string `json:"fd_targets"`
PID int `json:"pid"`
Comm string `json:"comm"`
Cmdline string `json:"cmdline"`
Exe string `json:"exe"`
Environ map[string]string `json:"environ"`
FDTargets map[string]string `json:"fd_targets"`
MemoryMaps []MemoryMap `json:"memory_maps"`
}
// MemoryMap is one parsed /proc/<pid>/maps row. The detector only needs the
// address range, permission bits, and optional pathname; retaining those raw
// fields keeps fixture input and alert explanations close to Python.
type MemoryMap struct {
Start uint64 `json:"start"`
End uint64 `json:"end"`
Perms string `json:"perms"`
Path string `json:"path"`
}
// State is one injectable detector sweep, equivalent to the Python