42 lines
1.3 KiB
Go
42 lines
1.3 KiB
Go
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
|
|
package events
|
|
|
|
import "encoding/json"
|
|
|
|
// SyscallEvent is the transport-neutral security telemetry consumed by the
|
|
// syscall rules. Unsupplied arguments decode as zero, matching Python's
|
|
// dataclass defaults and the partial fixtures accepted by rule operations.
|
|
type SyscallEvent struct {
|
|
PID int `json:"pid"`
|
|
PPID int `json:"ppid"`
|
|
UID int `json:"uid"`
|
|
Comm string `json:"comm"`
|
|
Syscall string `json:"syscall"`
|
|
Args [6]uint64 `json:"args"`
|
|
Text string `json:"text"`
|
|
}
|
|
|
|
func (e *SyscallEvent) UnmarshalJSON(raw []byte) error {
|
|
var values map[string]any
|
|
if err := json.Unmarshal(raw, &values); err != nil {
|
|
return err
|
|
}
|
|
e.PID = integerValue(values["pid"], 0)
|
|
e.PPID = integerValue(values["ppid"], 0)
|
|
e.UID = integerValue(values["uid"], 0)
|
|
e.Comm = stringValue(values["comm"])
|
|
e.Syscall = stringValue(values["syscall"])
|
|
e.Text = stringValue(values["text"])
|
|
if args, ok := values["args"].([]any); ok {
|
|
for index := 0; index < len(args) && index < len(e.Args); index++ {
|
|
e.Args[index] = uint64(integerValue(args[index], 0))
|
|
}
|
|
}
|
|
for index, key := range []string{"arg0", "arg1", "arg2", "arg3", "arg4", "arg5"} {
|
|
if value, ok := values[key]; ok {
|
|
e.Args[index] = uint64(integerValue(value, int(e.Args[index])))
|
|
}
|
|
}
|
|
return nil
|
|
}
|