# SPDX-License-Identifier: GPL-3.0-or-later
"""Security-relevant syscall event captured by the optional eBPF layer."""
from __future__ import annotations

from dataclasses import dataclass


@dataclass(frozen=True)
class SyscallEvent:
    pid: int
    ppid: int
    uid: int
    comm: str
    syscall: str
    arg0: int = 0
    arg1: int = 0
    arg2: int = 0
    arg3: int = 0
    arg4: int = 0
    arg5: int = 0
    text: str = ""

    def to_dict(self) -> dict:
        return {
            "pid": self.pid,
            "ppid": self.ppid,
            "uid": self.uid,
            "comm": self.comm,
            "syscall": self.syscall,
            "args": [self.arg0, self.arg1, self.arg2, self.arg3, self.arg4, self.arg5],
            "text": self.text,
        }