32 lines
768 B
Python
32 lines
768 B
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Security-relevant syscall event captured by the optional eBPF layer."""
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class SyscallEvent:
|
|
pid: int
|
|
ppid: int
|
|
uid: int
|
|
comm: str
|
|
syscall: str
|
|
arg0: int = 0
|
|
arg1: int = 0
|
|
arg2: int = 0
|
|
arg3: int = 0
|
|
arg4: int = 0
|
|
arg5: int = 0
|
|
text: str = ""
|
|
|
|
def to_dict(self) -> dict:
|
|
return {
|
|
"pid": self.pid,
|
|
"ppid": self.ppid,
|
|
"uid": self.uid,
|
|
"comm": self.comm,
|
|
"syscall": self.syscall,
|
|
"args": [self.arg0, self.arg1, self.arg2, self.arg3, self.arg4, self.arg5],
|
|
"text": self.text,
|
|
}
|