47 lines
1.2 KiB
Python
47 lines
1.2 KiB
Python
# SPDX-License-Identifier: GPL-3.0-or-later
|
|
"""Typed host event shared by non-exec, non-syscall event rules."""
|
|
from __future__ import annotations
|
|
|
|
from dataclasses import dataclass, field
|
|
|
|
|
|
@dataclass(frozen=True)
|
|
class HostEvent:
|
|
event: str
|
|
pid: int
|
|
ppid: int
|
|
uid: int
|
|
comm: str
|
|
parent_comm: str = ""
|
|
path: str = ""
|
|
argv: tuple[str, ...] = field(default_factory=tuple)
|
|
peer_ip: str = ""
|
|
peer_port: int = 0
|
|
local_ip: str = ""
|
|
local_port: int = 0
|
|
target_uid: int = -1
|
|
target_gid: int = -1
|
|
mode: int = 0
|
|
|
|
@property
|
|
def argv_str(self) -> str:
|
|
return " ".join((self.path, *self.argv)).strip()
|
|
|
|
def to_dict(self) -> dict:
|
|
return {
|
|
"event": self.event,
|
|
"pid": self.pid,
|
|
"ppid": self.ppid,
|
|
"uid": self.uid,
|
|
"comm": self.comm,
|
|
"parent_comm": self.parent_comm,
|
|
"path": self.path,
|
|
"argv": list(self.argv),
|
|
"peer_ip": self.peer_ip,
|
|
"peer_port": self.peer_port,
|
|
"local_ip": self.local_ip,
|
|
"local_port": self.local_port,
|
|
"target_uid": self.target_uid,
|
|
"target_gid": self.target_gid,
|
|
"mode": self.mode,
|
|
}
|