model

type ArgsEntry struct {
	*ArgsEnvsCacheEntry

	Values    []string
	Truncated bool
	// contains filtered or unexported fields
}

type ArgsEnvs struct {
	ID        uint32
	Size      uint32
	ValuesRaw [256]byte
}

type ArgsEnvsCacheEntry struct {
	ArgsEnvs
	// contains filtered or unexported fields
}

type ArgsEnvsEvent struct {
	ArgsEnvs
}

type BinaryUnmarshaler interface {
	UnmarshalBinary(data []byte) (int, error)
}

type CapsetEvent struct {
	CapEffective uint64 `field:"cap_effective"` // Effective capability set of the process
	CapPermitted uint64 `field:"cap_permitted"` // Permitted capability set of the process
}

type ChmodEvent struct {
	SyscallEvent
	File FileEvent `field:"file"`
	Mode uint32    `field:"file.destination.mode" field:"file.destination.rights"` // New mode/rights of the chmod-ed file
}

type ChmodMode int

type ChownEvent struct {
	SyscallEvent
	File  FileEvent `field:"file"`
	UID   uint32    `field:"file.destination.uid"`                   // New UID of the chown-ed file's owner
	User  string    `field:"file.destination.user,ResolveChownUID"`  // New user of the chown-ed file's owner
	GID   uint32    `field:"file.destination.gid"`                   // New GID of the chown-ed file's owner
	Group string    `field:"file.destination.group,ResolveChownGID"` // New group of the chown-ed file's owner
}

type ContainerContext struct {
	ID   string   `field:"id,ResolveContainerID"`          // ID of the container
	Tags []string `field:"tags,ResolveContainerTags:9999"` // Tags of the container
}

type Credentials struct {
	UID   uint32 `field:"uid"`   // UID of the process
	GID   uint32 `field:"gid"`   // GID of the process
	User  string `field:"user"`  // User of the process
	Group string `field:"group"` // Group of the process

	EUID   uint32 `field:"euid"`   // Effective UID of the process
	EGID   uint32 `field:"egid"`   // Effective GID of the process
	EUser  string `field:"euser"`  // Effective user of the process
	EGroup string `field:"egroup"` // Effective group of the process

	FSUID   uint32 `field:"fsuid"`   // FileSystem-uid of the process
	FSGID   uint32 `field:"fsgid"`   // FileSystem-gid of the process
	FSUser  string `field:"fsuser"`  // FileSystem-user of the process
	FSGroup string `field:"fsgroup"` // FileSystem-group of the process

	CapEffective uint64 `field:"cap_effective"` // Effective capability set of the process
	CapPermitted uint64 `field:"cap_permitted"` // Permitted capability set of the process
}

type EnvsEntry struct {
	*ArgsEnvsCacheEntry

	Values    map[string]string
	Truncated bool
	// contains filtered or unexported fields
}

type Event struct {
	ID           string    `field:"-"`
	Type         uint64    `field:"-"`
	TimestampRaw uint64    `field:"-"`
	Timestamp    time.Time `field:"timestamp"` // Timestamp of the event

	ProcessContext   ProcessContext   `field:"process" event:"*"`
	SpanContext      SpanContext      `field:"-"`
	ContainerContext ContainerContext `field:"container"`

	Chmod       ChmodEvent    `field:"chmod" event:"chmod"`             // [7.27] [File] A file’s permissions were changed
	Chown       ChownEvent    `field:"chown" event:"chown"`             // [7.27] [File] A file’s owner was changed
	Open        OpenEvent     `field:"open" event:"open"`               // [7.27] [File] A file was opened
	Mkdir       MkdirEvent    `field:"mkdir" event:"mkdir"`             // [7.27] [File] A directory was created
	Rmdir       RmdirEvent    `field:"rmdir" event:"rmdir"`             // [7.27] [File] A directory was removed
	Rename      RenameEvent   `field:"rename" event:"rename"`           // [7.27] [File] A file/directory was renamed
	Unlink      UnlinkEvent   `field:"unlink" event:"unlink"`           // [7.27] [File] A file was deleted
	Utimes      UtimesEvent   `field:"utimes" event:"utimes"`           // [7.27] [File] Change file access/modification times
	Link        LinkEvent     `field:"link" event:"link"`               // [7.27] [File] Create a new name/alias for a file
	SetXAttr    SetXAttrEvent `field:"setxattr" event:"setxattr"`       // [7.27] [File] Set exteneded attributes
	RemoveXAttr SetXAttrEvent `field:"removexattr" event:"removexattr"` // [7.27] [File] Remove extended attributes
	Exec        ExecEvent     `field:"exec" event:"exec"`               // [7.27] [Process] A process was executed or forked

	SetUID SetuidEvent `field:"setuid" event:"setuid"` // [7.27] [Process] A process changed its effective uid
	SetGID SetgidEvent `field:"setgid" event:"setgid"` // [7.27] [Process] A process changed its effective gid
	Capset CapsetEvent `field:"capset" event:"capset"` // [7.27] [Process] A process changed its capacity set

	SELinux SELinuxEvent `field:"selinux" event:"selinux"` // [7.30] [Kernel] An SELinux operation was run

	Mount            MountEvent            `field:"-"`
	Umount           UmountEvent           `field:"-"`
	InvalidateDentry InvalidateDentryEvent `field:"-"`
	ArgsEnvs         ArgsEnvsEvent         `field:"-"`
	MountReleased    MountReleasedEvent    `field:"-"`
}

type EventCategory = string

type EventType uint64

type ExecEvent struct {
	Process

	// defined to generate accessors
	Args          string   `field:"args,ResolveExecArgs"`                                                                                     // Arguments of the process (as a string)
	Argv          []string `field:"argv,ResolveExecArgv" field:"args_flags,ResolveExecArgsFlags" field:"args_options,ResolveExecArgsOptions"` // Arguments of the process (as an array)
	ArgsTruncated bool     `field:"args_truncated,ResolveExecArgsTruncated"`                                                                  // Indicator of arguments truncation
	Envs          []string `field:"envs,ResolveExecEnvs"`                                                                                     // Environment variables of the process
	EnvsTruncated bool     `field:"envs_truncated,ResolveExecEnvsTruncated"`                                                                  // Indicator of environment variables truncation
}

type FileEvent struct {
	FileFields
	PathnameStr string `field:"path,ResolveFilePath"`             // File's path
	BasenameStr string `field:"name,ResolveFileBasename"`         // File's basename
	Filesytem   string `field:"filesystem,ResolveFileFilesystem"` // File's filesystem

	PathResolutionError error `field:"-"`
}

type FileFields struct {
	UID   uint32 `field:"uid"`                               // UID of the file's owner
	User  string `field:"user,ResolveFileFieldsUser"`        // User of the file's owner
	GID   uint32 `field:"gid"`                               // GID of the file's owner
	Group string `field:"group,ResolveFileFieldsGroup"`      // Group of the file's owner
	Mode  uint16 `field:"mode" field:"rights,ResolveRights"` // Mode/rights of the file
	CTime uint64 `field:"change_time"`                       // Change time of the file
	MTime uint64 `field:"modification_time"`                 // Modification time of the file

	MountID      uint32 `field:"mount_id"`                                     // Mount ID of the file
	Inode        uint64 `field:"inode"`                                        // Inode of the file
	InUpperLayer bool   `field:"in_upper_layer,ResolveFileFieldsInUpperLayer"` // Indicator of the file layer, in an OverlayFS for example

	NLink  uint32 `field:"-"`
	PathID uint32 `field:"-"`
	Flags  int32  `field:"-"`
}

type InvalidateDentryEvent struct {
	Inode             uint64
	MountID           uint32
	DiscarderRevision uint32
}

type KernelCapability uint64

type LinkEvent struct {
	SyscallEvent
	Source FileEvent `field:"file"`
	Target FileEvent `field:"file.destination"`
}

type MkdirEvent struct {
	SyscallEvent
	File FileEvent `field:"file"`
	Mode uint32    `field:"file.destination.mode" field:"file.destination.rights"` // Mode/rights of the new directory
}

type Model struct{}

type MountEvent struct {
	SyscallEvent
	MountID                       uint32
	GroupID                       uint32
	Device                        uint32
	ParentMountID                 uint32
	ParentInode                   uint64
	FSType                        string
	MountPointStr                 string
	MountPointPathResolutionError error
	RootMountID                   uint32
	RootInode                     uint64
	RootStr                       string
	RootPathResolutionError       error

	FSTypeRaw [16]byte
}

type MountReleasedEvent struct {
	MountID           uint32
	DiscarderRevision uint32
}

type OpenEvent struct {
	SyscallEvent
	File  FileEvent `field:"file"`
	Flags uint32    `field:"flags"`                 // Flags used when opening the file
	Mode  uint32    `field:"file.destination.mode"` // Mode of the created file
}

type OpenFlags int

type Process struct {
	// proc_cache_t
	FileFields FileFields `field:"file"`

	Pid uint32 `field:"pid"` // Process ID of the process (also called thread group ID)
	Tid uint32 `field:"tid"` // Thread ID of the thread

	PathnameStr         string `field:"file.path"`       // Path of the process executable
	BasenameStr         string `field:"file.name"`       // Basename of the path of the process executable
	Filesystem          string `field:"file.filesystem"` // FileSystem of the process executable
	PathResolutionError error  `field:"-"`

	ContainerID string `field:"container.id"` // Container ID

	TTYName string `field:"tty_name"` // Name of the TTY associated with the process
	Comm    string `field:"comm"`     // Comm attribute of the process

	// pid_cache_t
	ForkTime time.Time `field:"-"`
	ExitTime time.Time `field:"-"`
	ExecTime time.Time `field:"-"`

	CreatedAt uint64 `field:"created_at,ResolveProcessCreatedAt"` // Timestamp of the creation of the process

	Cookie uint32 `field:"cookie"` // Cookie of the process
	PPid   uint32 `field:"ppid"`   // Parent process ID

	// credentials_t section of pid_cache_t
	Credentials

	ArgsID uint32 `field:"-"`
	EnvsID uint32 `field:"-"`

	ArgsEntry     *ArgsEntry `field:"-"`
	EnvsEntry     *EnvsEntry `field:"-"`
	EnvsTruncated bool       `field:"-"`
	ArgsTruncated bool       `field:"-"`
}

type ProcessAncestorsIterator struct {
	// contains filtered or unexported fields
}

type ProcessCacheEntry struct {
	ProcessContext
	// contains filtered or unexported fields
}

type ProcessContext struct {
	Process

	Ancestor *ProcessCacheEntry `field:"ancestors,,ProcessAncestorsIterator"`
}

type RenameEvent struct {
	SyscallEvent
	Old               FileEvent `field:"file"`
	New               FileEvent `field:"file.destination"`
	DiscarderRevision uint32    `field:"-"`
}

type RetValError int

type RmdirEvent struct {
	SyscallEvent
	File              FileEvent `field:"file"`
	DiscarderRevision uint32    `field:"-"`
}

type SELinuxEvent struct {
	File            FileEvent        `field:"-"`
	EventKind       SELinuxEventKind `field:"-"`
	BoolName        string           `field:"bool.name,ResolveSELinuxBoolName"` // SELinux boolean name
	BoolChangeValue string           `field:"bool.state"`                       // SELinux boolean new value
	BoolCommitValue bool             `field:"bool_commit.state"`                // Indicator of a SELinux boolean commit operation
	EnforceStatus   string           `field:"enforce.status"`                   // SELinux enforcement status (one of "enforcing", "permissive", "disabled"")
}

type SELinuxEventKind uint32

type SetXAttrEvent struct {
	SyscallEvent
	File      FileEvent `field:"file"`
	Namespace string    `field:"file.destination.namespace,ResolveXAttrNamespace"` // Namespace of the extended attribute
	Name      string    `field:"file.destination.name,ResolveXAttrName"`           // Name of the extended attribute

	NameRaw [200]byte
}

type SetgidEvent struct {
	GID     uint32 `field:"gid"`                          // New GID of the process
	Group   string `field:"group,ResolveSetgidGroup"`     // New group of the process
	EGID    uint32 `field:"egid"`                         // New effective GID of the process
	EGroup  string `field:"egroup,ResolveSetgidEGroup"`   // New effective group of the process
	FSGID   uint32 `field:"fsgid"`                        // New FileSystem GID of the process
	FSGroup string `field:"fsgroup,ResolveSetgidFSGroup"` // New FileSystem group of the process
}

type SetuidEvent struct {
	UID    uint32 `field:"uid"`                        // New UID of the process
	User   string `field:"user,ResolveSetuidUser"`     // New user of the process
	EUID   uint32 `field:"euid"`                       // New effective UID of the process
	EUser  string `field:"euser,ResolveSetuidEUser"`   // New effective user of the process
	FSUID  uint32 `field:"fsuid"`                      // New FileSystem UID of the process
	FSUser string `field:"fsuser,ResolveSetuidFSUser"` // New FileSystem user of the process
}

type SpanContext struct {
	SpanID  uint64 `field:"_"`
	TraceID uint64 `field:"_"`
}

type SyscallEvent struct {
	Retval int64 `field:"retval"` // Return value of the syscall
}

type UmountEvent struct {
	SyscallEvent
	MountID uint32
}

type UnlinkEvent struct {
	SyscallEvent
	File              FileEvent `field:"file"`
	Flags             uint32    `field:"-"`
	DiscarderRevision uint32    `field:"-"`
}

type UnlinkFlags int

type UtimesEvent struct {
	SyscallEvent
	File  FileEvent `field:"file"`
	Atime time.Time `field:"-"`
	Mtime time.Time `field:"-"`
}