12242432202

Committed 09 Dec 2024 07:00PM UTC coverage: 62.914% (-0.4%) from 63.269%

Build # 12242432202

Build Type

Pull #1440

github

Committed by

web-flow

Commit Message

Merge d399f0a54 into 737525b74

Pull Request Pull Request #1440: Add ancestry annotator

Run Details

5631 of 13490 branches covered (41.74%)

Branch coverage included in aggregate %.

1 of 62 new or added lines in 5 files covered. (1.61%)

7 existing lines in 1 file now uncovered.

18827 of 25385 relevant lines covered (74.17%)

5816.96 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/Source/santad/ProcessTree/annotations/ancestry.cc

/// Copyright 2023 Google LLC
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///     https://www.apache.org/licenses/LICENSE-2.0
///
/// Unless required by applicable law or agreed to in writing, software
/// distributed under the License is distributed on an "AS IS" BASIS,
/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
/// See the License for the specific language governing permissions and
/// limitations under the License.
#include "Source/santad/ProcessTree/annotations/ancestry.h"

#include "Source/santad/ProcessTree/process.h"
#include "Source/santad/ProcessTree/process_tree.h"
#include "Source/santad/ProcessTree/process_tree.pb.h"
#include "absl/container/flat_hash_map.h"

namespace ptpb = ::santa::pb::v1::process_tree;

namespace santa::santad::process_tree {

::santa::pb::v1::process_tree::Annotations::Ancestry
AncestryAnnotator::getAncestry() const {
  ::santa::pb::v1::process_tree::Annotations::Ancestry ancestry;
  ancestry.CopyFrom(ancestry_);
  return ancestry;
}

void AncestryAnnotator::AddProcessToAncestry(
    ptpb::Annotations::Ancestry &ancestry, const Process &process) {
  ptpb::ProcessID *ancestor = ancestry.add_ancestor();
  ancestor->set_pid(process.pid_.pid);
  ancestor->set_pidversion(process.pid_.pidversion);
}

void AncestryAnnotator::AnnotateFork(ProcessTree &tree, const Process &parent,
                                     const Process &child) {
  ptpb::Annotations::Ancestry ancestry;

  // If parent process has ancestry annotation, copy and add parent.
  if (auto parent_annotation = tree.GetAnnotation<AncestryAnnotator>(parent)) {
    ancestry.CopyFrom((*parent_annotation)->getAncestry());
    AddProcessToAncestry(ancestry, parent);
    // Otherwise, get all ancestors of the child and add them.
  } else {
    std::vector<ptpb::ProcessID> ancestors = tree.GetAncestors(child);
    // Add ancestors starting from the root process
    for (auto it = ancestors.rbegin(); it != ancestors.rend(); it++) {
      ptpb::ProcessID *ancestor = ancestry.add_ancestor();
      ancestor->set_pid(it->pid());
      ancestor->set_pidversion(it->pidversion());
    }
  }
  tree.AnnotateProcess(child, std::make_shared<AncestryAnnotator>(ancestry));
}

void AncestryAnnotator::AnnotateExec(ProcessTree &tree,
                                     const Process &orig_process,
                                     const Process &new_process) {
  // Do not annotate process on exec
  return;
}

std::optional<ptpb::Annotations> AncestryAnnotator::Proto() const {
  auto annotation = ptpb::Annotations();
  auto *ancestry_ptr = annotation.mutable_ancestry();
  ancestry_ptr->CopyFrom(AncestryAnnotator::getAncestry());
  return annotation;
}

}  // namespace santa::santad::process_tree

1	/// Copyright 2023 Google LLC
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// https://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14	#include "Source/santad/ProcessTree/annotations/ancestry.h"
15
16	#include "Source/santad/ProcessTree/process.h"
17	#include "Source/santad/ProcessTree/process_tree.h"
18	#include "Source/santad/ProcessTree/process_tree.pb.h"
19	#include "absl/container/flat_hash_map.h"
20
21	namespace ptpb = ::santa::pb::v1::process_tree;
22
23	namespace santa::santad::process_tree {
24
25	::santa::pb::v1::process_tree::Annotations::Ancestry
NEW 26	AncestryAnnotator::getAncestry() const {	×
NEW 27	::santa::pb::v1::process_tree::Annotations::Ancestry ancestry;	×
NEW 28	ancestry.CopyFrom(ancestry_);	×
NEW 29	return ancestry;	×
NEW 30	}	×
31
32	void AncestryAnnotator::AddProcessToAncestry(
NEW 33	ptpb::Annotations::Ancestry &ancestry, const Process &process) {	×
NEW 34	ptpb::ProcessID *ancestor = ancestry.add_ancestor();	×
NEW 35	ancestor->set_pid(process.pid_.pid);	×
NEW 36	ancestor->set_pidversion(process.pid_.pidversion);	×
NEW 37	}	×
38
39	void AncestryAnnotator::AnnotateFork(ProcessTree &tree, const Process &parent,
NEW 40	const Process &child) {	×
NEW 41	ptpb::Annotations::Ancestry ancestry;	×
42
43	// If parent process has ancestry annotation, copy and add parent.
NEW 44	if (auto parent_annotation = tree.GetAnnotation<AncestryAnnotator>(parent)) {	×
NEW 45	ancestry.CopyFrom((*parent_annotation)->getAncestry());	×
NEW 46	AddProcessToAncestry(ancestry, parent);	×
47	// Otherwise, get all ancestors of the child and add them.
NEW 48	} else {	×
NEW 49	std::vector<ptpb::ProcessID> ancestors = tree.GetAncestors(child);	×
50	// Add ancestors starting from the root process
NEW 51	for (auto it = ancestors.rbegin(); it != ancestors.rend(); it++) {	×
NEW 52	ptpb::ProcessID *ancestor = ancestry.add_ancestor();	×
NEW 53	ancestor->set_pid(it->pid());	×
NEW 54	ancestor->set_pidversion(it->pidversion());	×
NEW 55	}	×
NEW 56	}	×
NEW 57	tree.AnnotateProcess(child, std::make_shared<AncestryAnnotator>(ancestry));	×
NEW 58	}	×
59
60	void AncestryAnnotator::AnnotateExec(ProcessTree &tree,
61	const Process &orig_process,
NEW 62	const Process &new_process) {	×
63	// Do not annotate process on exec
NEW 64	return;	×
NEW 65	}	×
66
NEW 67	std::optional<ptpb::Annotations> AncestryAnnotator::Proto() const {	×
NEW 68	auto annotation = ptpb::Annotations();	×
NEW 69	auto *ancestry_ptr = annotation.mutable_ancestry();	×
NEW 70	ancestry_ptr->CopyFrom(AncestryAnnotator::getAncestry());	×
NEW 71	return annotation;	×
NEW 72	}	×
73
74	} // namespace santa::santad::process_tree

google / santa / 12242432202

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous