Gecko [ www.thearyasamaj.org ]

Name	Size	Permission
common	[ DIR ]	drwxr-xr-x
ftrace_hooks	[ DIR ]	drwxr-xr-x
lsm_hooks	[ DIR ]	drwxr-xr-x
syscall_hooks	[ DIR ]	drwxr-xr-x
transport	[ DIR ]	drwxr-xr-x
Kbuild	8.88 KB	-rw-r--r--
Makefile	2.23 KB	-rw-r--r--
compat.c	6.18 KB	-rw-r--r--
compat.h	10.89 KB	-rw-r--r--
debug.h	3.56 KB	-rw-r--r--
dkms.conf	146 B	-rw-r--r--
file_contexts.c	41.04 KB	-rw-r--r--
file_contexts.h	2.51 KB	-rw-r--r--
file_contexts_priv.h	4.92 KB	-rw-r--r--
file_handle_tools.h	2.15 KB	-rw-r--r--
file_key_tools.h	869 B	-rw-r--r--
file_path_tools.h	2.09 KB	-rw-r--r--
hashtable_compat.h	2.45 KB	-rw-r--r--
hook_trampoline_common.h	4.2 KB	-rw-r--r--
interval_tree.h	779 B	-rw-r--r--
memory.h	1.37 KB	-rw-r--r--
module.c	1.86 KB	-rw-r--r--
module_ref.h	421 B	-rw-r--r--
module_rundown_protection.c	3.64 KB	-rw-r--r--
module_rundown_protection.h	743 B	-rw-r--r--
path_tools.h	4.42 KB	-rw-r--r--
rundown_protection.c	4.2 KB	-rw-r--r--
rundown_protection.h	2.83 KB	-rw-r--r--
si_common.h	3.93 KB	-rw-r--r--
si_fp_properties.h	858 B	-rw-r--r--
si_fp_properties_x.h	15.41 KB	-rw-r--r--
si_fp_value_types.h	515 B	-rw-r--r--
si_fp_value_types_x.h	1.25 KB	-rw-r--r--
si_size.h	4.15 KB	-rw-r--r--
si_templates.h	2.29 KB	-rw-r--r--
si_writer.h	6.48 KB	-rw-r--r--
si_writer_common.h	6.39 KB	-rw-r--r--
stringify.h	261 B	-rw-r--r--
task_info_map.c	16.45 KB	-rw-r--r--
task_info_map.h	6.24 KB	-rw-r--r--
task_tools.h	1.34 KB	-rw-r--r--
tracepoints.c	3.58 KB	-rw-r--r--
tracepoints.h	299 B	-rw-r--r--
write_protection.h	1.04 KB	-rw-r--r--

Code Editor : si_templates.h

/**
@file     si_templates.h
@brief    Common templates used in SI events
@details  Copyright (c) 2024 Acronis International GmbH
@author   Denis Kopyrin (denis.kopyrin@acronis.com)
@since    $Id: $
*/

#pragma once

#include "si_fp_properties.h"

// Currently all events have at least the following fields
// Might be revised at the future but currently all of those are used by userspace
#define SI_COMMON_FIELDS \
  FP_SI_PI_EVENT_UID, \
  FP_SI_PI_THREAD_ID, \
	FP_SI_PI_PROCESS_ID, \
  FP_SI_PI_EVENT_TIMESTAMP, \
  FP_SI_PI_PROCESS_ID_VERSION

#define SI_COMMON_FS_FIELDS SI_COMMON_FIELDS, \
  FP_SI_PI_FSUID, \
  FP_SI_PI_FSGID

#define SI_COMMON_CRED_FIELDS \
  FP_SI_PI_USER_ID, \
  FP_SI_PI_GROUP_ID, \
  FP_SI_PI_EFFECTIVE_USER_ID, \
  FP_SI_PI_EFFECTIVE_GROUP_ID, \
  FP_SI_PI_SAVED_USER_ID, \
  FP_SI_PI_SAVED_GROUP_ID, \
  FP_SI_PI_AUDIT_SESSION_ID, \
  FP_SI_PI_AUDIT_USER_ID

#define SI_COMMON_OBJECT_FILE_IDS_FIELDS \
  FP_SI_PI_OBJECT_ID, \
  FP_SI_PI_OBJECT_FILE_GENERATION, \
  FP_SI_PI_OBJECT_FILE_PTR, \
  FP_SI_PI_OBJECT_FILE_HANDLE, \
  FP_SI_PI_OBJECT_FILE_MOUNT_ID, \
  FP_SI_PI_FILE_ATTRIBUTES, \
  FP_SI_PI_FILE_MODE, \
  FP_SI_PI_FILE_SIZE, \
  FP_SI_PI_FILE_UID, \
  FP_SI_PI_FILE_GID, \
  FP_SI_PI_FILE_CHANGE_TIME, \
  FP_SI_PI_FILE_ACCESS_TIME, \
  FP_SI_PI_FILE_MODIFICATION_TIME, \
  FP_SI_PI_VOLUME_ID_HIGH, \
  FP_SI_PI_VOLUME_ID_LOW, \
  FP_SI_PI_VOLUME_MAGIC

#define SI_COMMON_OBJECT_FILE_FIELDS \
  FP_SI_PI_OBJECT_NAME, \
  SI_COMMON_OBJECT_FILE_IDS_FIELDS

#define SI_COMMON_IMAGE_NAME_FIELDS \
  FP_SI_PI_IMAGE_FILE_NAME, \
  FP_SI_PI_PROCESS_FILE_NAME_IS_NOT_PATH

#define SI_COMMON_EXE_FILE_FIELDS \
  SI_COMMON_IMAGE_NAME_FIELDS, \
  SI_COMMON_OBJECT_FILE_IDS_FIELDS

#define SI_COMMON_TARGET_FILE_FIELDS \
  FP_SI_PI_TARGET_NAME, \
  FP_SI_PI_TARGET_ID, \
  FP_SI_PI_TARGET_FILE_GENERATION, \
  FP_SI_PI_TARGET_FILE_PTR, \
  FP_SI_PI_TARGET_FILE_HANDLE, \
  FP_SI_PI_TARGET_FILE_MOUNT_ID, \
  FP_SI_PI_TARGET_FILE_ATTRIBUTES, \
  FP_SI_PI_TARGET_FILE_MODE, \
  FP_SI_PI_TARGET_FILE_SIZE, \
  FP_SI_PI_TARGET_FILE_UID, \
  FP_SI_PI_TARGET_FILE_GID, \
  FP_SI_PI_TARGET_FILE_CHANGE_TIME, \
  FP_SI_PI_TARGET_FILE_ACCESS_TIME, \
  FP_SI_PI_TARGET_FILE_MODIFICATION_TIME

#define SI_COMMON_OBJECT_MINI_FILE_FIELDS \
  FP_SI_PI_OBJECT_ID, \
  FP_SI_PI_OBJECT_FILE_GENERATION, \
  FP_SI_PI_OBJECT_FILE_PTR

${this.title}

Code Editor : si_templates.h