12243963475

Committed 09 Dec 2024 08:43PM UTC coverage: 62.982% (-0.3%) from 63.269%

Build # 12243963475

Build Type

Pull #1440

github

Committed by

web-flow

Commit Message

Merge 9de4798cf into 737525b74

Pull Request Pull Request #1440: Add ancestry annotator

Run Details

5620 of 13444 branches covered (41.8%)

Branch coverage included in aggregate %.

7 of 69 new or added lines in 6 files covered. (10.14%)

2 existing lines in 1 file now uncovered.

18837 of 25388 relevant lines covered (74.2%)

6436.13 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

46.9

/Source/santad/ProcessTree/process_tree.cc

/// Copyright 2023 Google LLC
///
/// Licensed under the Apache License, Version 2.0 (the "License");
/// you may not use this file except in compliance with the License.
/// You may obtain a copy of the License at
///
///     https://www.apache.org/licenses/LICENSE-2.0
///
/// Unless required by applicable law or agreed to in writing, software
/// distributed under the License is distributed on an "AS IS" BASIS,
/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
/// See the License for the specific language governing permissions and
/// limitations under the License.
#include "Source/santad/ProcessTree/process_tree.h"

#include <sys/types.h>

#include <algorithm>
#include <cassert>
#include <cstdint>
#include <functional>
#include <memory>
#include <optional>
#include <typeindex>
#include <utility>
#include <vector>

#include "Source/santad/ProcessTree/annotations/annotator.h"
#include "Source/santad/ProcessTree/process.h"
#include "Source/santad/ProcessTree/process_tree.pb.h"
#include "absl/container/flat_hash_map.h"
#include "absl/container/flat_hash_set.h"
#include "absl/status/status.h"
#include "absl/status/statusor.h"
#include "absl/synchronization/mutex.h"

namespace santa::santad::process_tree {

void ProcessTree::BackfillInsertChildren(
    absl::flat_hash_map<pid_t, std::vector<Process>> &parent_map,
    std::shared_ptr<Process> parent, const Process &unlinked_proc) {
  auto proc = std::make_shared<Process>(
      unlinked_proc.pid_, unlinked_proc.effective_cred_,
      // Re-use shared pointers from parent if value equivalent
      (parent && *(unlinked_proc.program_) == *(parent->program_))
          ? parent->program_
          : unlinked_proc.program_,
      parent, 0);
  {
    absl::MutexLock lock(&mtx_);
    map_.emplace(unlinked_proc.pid_, proc);
  }

  // The only case where we should not have a parent is the root processes
  // (e.g. init, kthreadd).
  if (parent) {
    for (auto &annotator : annotators_) {
      annotator->AnnotateFork(*this, *(proc->parent_), *proc);
      if (proc->program_ != proc->parent_->program_) {
        annotator->AnnotateExec(*this, *(proc->parent_), *proc);
      }
    }
  }

  for (const Process &child : parent_map[unlinked_proc.pid_.pid]) {
    BackfillInsertChildren(parent_map, proc, child);
  }
}

std::vector<::santa::pb::v1::process_tree::AncestryProcessID>
ProcessTree::GetAncestors(const Process &process) {
  std::vector<::santa::pb::v1::process_tree::AncestryProcessID> ancestors;
  if (!process.parent_) {
    return ancestors;
  }
  {
    absl::MutexLock lock(&mtx_);
    std::optional<std::shared_ptr<Process>> chainProcess =
        GetLocked(process.parent_->pid_);
    while (chainProcess != std::nullopt) {
      ::santa::pb::v1::process_tree::AncestryProcessID process_id;
      process_id.set_pid((*chainProcess)->pid_.pid);
      process_id.set_secondary_id((*chainProcess)->pid_.pidversion);
      ancestors.push_back(process_id);
      if ((*chainProcess)->parent_) {
        chainProcess = GetLocked((*chainProcess)->parent_->pid_);
      } else {
        chainProcess = std::nullopt;
      }
    }
  }
  return ancestors;
}

void ProcessTree::HandleFork(uint64_t timestamp, const Process &parent,
                             const Pid new_pid) {
  if (Step(timestamp)) {
    std::shared_ptr<Process> child;
    {
      absl::MutexLock lock(&mtx_);
      child = std::make_shared<Process>(new_pid, parent.effective_cred_,
                                        parent.program_, map_[parent.pid_],
                                        timestamp);
      map_.emplace(new_pid, child);
    }
    for (const auto &annotator : annotators_) {
      annotator->AnnotateFork(*this, parent, *child);
    }
  }
}

void ProcessTree::HandleExec(uint64_t timestamp, const Process &p,
                             const Pid new_pid, const Program prog,
                             const Cred c) {
  if (Step(timestamp)) {
    // TODO(nickmg): should struct pid be reworked and only pid_version be
    // passed?
    assert(new_pid.pid == p.pid_.pid);

    auto new_proc = std::make_shared<Process>(
        new_pid, c, std::make_shared<const Program>(prog), p.parent_,
        timestamp);
    {
      absl::MutexLock lock(&mtx_);
      remove_at_.push_back({timestamp, p.pid_});
      map_.emplace(new_proc->pid_, new_proc);
    }
    for (const auto &annotator : annotators_) {
      annotator->AnnotateExec(*this, p, *new_proc);
    }
  }
}

void ProcessTree::HandleExit(uint64_t timestamp, const Process &p) {
  if (Step(timestamp)) {
    absl::MutexLock lock(&mtx_);
    remove_at_.push_back({timestamp, p.pid_});
  }
}

bool ProcessTree::Step(uint64_t timestamp) {
  absl::MutexLock lock(&mtx_);
  uint64_t new_cutoff = seen_timestamps_.front();
  if (timestamp < new_cutoff) {
    // Event timestamp is before the rolling list of seen events.
    // This event may or may not have been processed, but be conservative and
    // do not reprocess.
    return false;
  }

  // seen_timestamps_ is sorted, so only look for the value if it's possibly
  // within the array.
  if (timestamp < seen_timestamps_.back()) {
    // TODO(nickmg): If array is made bigger, replace with a binary search.
    for (const auto seen_ts : seen_timestamps_) {
      if (seen_ts == timestamp) {
        // Event seen, signal it should not be reprocessed.
        return false;
      }
    }
  }

  auto insert_point =
      std::find_if(seen_timestamps_.rbegin(), seen_timestamps_.rend(),
                   [&](uint64_t x) { return x < timestamp; });
  std::move(seen_timestamps_.begin() + 1, insert_point.base(),
            seen_timestamps_.begin());
  *insert_point = timestamp;

  for (auto it = remove_at_.begin(); it != remove_at_.end();) {
    if (it->first < new_cutoff) {
      if (auto target = GetLocked(it->second);
          target && (*target)->refcnt_ > 0) {
        (*target)->tombstoned_ = true;
      } else {
        map_.erase(it->second);
      }
      it = remove_at_.erase(it);
    } else {
      it++;
    }
  }

  return true;
}

void ProcessTree::RetainProcess(std::vector<struct Pid> &pids) {
  absl::MutexLock lock(&mtx_);
  for (const struct Pid &p : pids) {
    auto proc = GetLocked(p);
    if (proc) {
      (*proc)->refcnt_++;
    }
  }
}

void ProcessTree::ReleaseProcess(std::vector<struct Pid> &pids) {
  absl::MutexLock lock(&mtx_);
  for (const struct Pid &p : pids) {
    auto proc = GetLocked(p);
    if (proc) {
      if (--(*proc)->refcnt_ == 0 && (*proc)->tombstoned_) {
        map_.erase(p);
      }
    }
  }
}

/*
---
Annotation get/set
---
*/

void ProcessTree::AnnotateProcess(const Process &p,
                                  std::shared_ptr<const Annotator> a) {
  absl::MutexLock lock(&mtx_);
  const Annotator &x = *a;
  map_[p.pid_]->annotations_.emplace(std::type_index(typeid(x)), std::move(a));
}

std::optional<::santa::pb::v1::process_tree::Annotations>
ProcessTree::ExportAnnotations(const Pid p) {
  auto proc = Get(p);
  if (!proc || (*proc)->annotations_.empty()) {
    return std::nullopt;
  }
  ::santa::pb::v1::process_tree::Annotations a;
  for (const auto &[_, annotation] : (*proc)->annotations_) {
    if (auto x = annotation->Proto(); x) a.MergeFrom(*x);
  }
  return a;
}

/*
---
Tree inspection methods
---
*/

std::vector<std::shared_ptr<const Process>> ProcessTree::RootSlice(
    std::shared_ptr<const Process> p) const {
  std::vector<std::shared_ptr<const Process>> slice;
  while (p) {
    slice.push_back(p);
    p = p->parent_;
  }
  return slice;
}

void ProcessTree::Iterate(
    std::function<void(std::shared_ptr<const Process> p)> f) const {
  std::vector<std::shared_ptr<const Process>> procs;
  {
    absl::ReaderMutexLock lock(&mtx_);
    procs.reserve(map_.size());
    for (auto &[_, proc] : map_) {
      procs.push_back(proc);
    }
  }

  for (auto &p : procs) {
    f(p);
  }
}

std::optional<std::shared_ptr<const Process>> ProcessTree::Get(
    const Pid target) const {
  absl::ReaderMutexLock lock(&mtx_);
  return GetLocked(target);
}

std::optional<std::shared_ptr<Process>> ProcessTree::GetLocked(
    const Pid target) const {
  auto it = map_.find(target);
  if (it == map_.end()) {
    return std::nullopt;
  }
  return it->second;
}

std::shared_ptr<const Process> ProcessTree::GetParent(const Process &p) const {
  return p.parent_;
}

#if SANTA_PROCESS_TREE_DEBUG
void ProcessTree::DebugDump(std::ostream &stream) const {
  absl::ReaderMutexLock lock(&mtx_);
  stream << map_.size() << " processes" << std::endl;
  DebugDumpLocked(stream, 0, 0);
}

void ProcessTree::DebugDumpLocked(std::ostream &stream, int depth,
                                  pid_t ppid) const
    ABSL_SHARED_LOCKS_REQUIRED(mtx_) {
  for (auto &[_, process] : map_) {
    if ((ppid == 0 && !process->parent_) ||
        (process->parent_ && process->parent_->pid_.pid == ppid)) {
      stream << std::string(2 * depth, ' ') << process->pid_.pid
             << process->program_->executable << std::endl;
      DebugDumpLocked(stream, depth + 1, process->pid_.pid);
    }
  }
}
#endif

absl::StatusOr<std::shared_ptr<ProcessTree>> CreateTree(
    std::vector<std::unique_ptr<Annotator>> annotations) {
  absl::flat_hash_set<std::type_index> seen;
  for (const auto &annotator : annotations) {
    if (seen.count(std::type_index(typeid(annotator)))) {
      return absl::InvalidArgumentError(
          "Multiple annotators of the same class");
    }
    seen.emplace(std::type_index(typeid(annotator)));
  }

  if (seen.empty()) {
    return nullptr;
  }

  auto tree = std::make_shared<ProcessTree>(std::move(annotations));
  if (auto status = tree->Backfill(); !status.ok()) {
    return status;
  }
  return tree;
}

/*
----
Tokens
----
*/

ProcessToken::ProcessToken(std::shared_ptr<ProcessTree> tree,
                           std::vector<struct Pid> pids)
    : tree_(std::move(tree)), pids_(std::move(pids)) {
  tree_->RetainProcess(pids);
}

ProcessToken::~ProcessToken() { tree_->ReleaseProcess(pids_); }

}  // namespace santa::santad::process_tree

1	/// Copyright 2023 Google LLC
2	///
3	/// Licensed under the Apache License, Version 2.0 (the "License");
4	/// you may not use this file except in compliance with the License.
5	/// You may obtain a copy of the License at
6	///
7	/// https://www.apache.org/licenses/LICENSE-2.0
8	///
9	/// Unless required by applicable law or agreed to in writing, software
10	/// distributed under the License is distributed on an "AS IS" BASIS,
11	/// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12	/// See the License for the specific language governing permissions and
13	/// limitations under the License.
14	#include "Source/santad/ProcessTree/process_tree.h"
15
16	#include <sys/types.h>
17
18	#include <algorithm>
19	#include <cassert>
20	#include <cstdint>
21	#include <functional>
22	#include <memory>
23	#include <optional>
24	#include <typeindex>
25	#include <utility>
26	#include <vector>
27
28	#include "Source/santad/ProcessTree/annotations/annotator.h"
29	#include "Source/santad/ProcessTree/process.h"
30	#include "Source/santad/ProcessTree/process_tree.pb.h"
31	#include "absl/container/flat_hash_map.h"
32	#include "absl/container/flat_hash_set.h"
33	#include "absl/status/status.h"
34	#include "absl/status/statusor.h"
35	#include "absl/synchronization/mutex.h"
36
37	namespace santa::santad::process_tree {
38
39	void ProcessTree::BackfillInsertChildren(
40	absl::flat_hash_map<pid_t, std::vector<Process>> &parent_map,
41	std::shared_ptr<Process> parent, const Process &unlinked_proc) {	×
42	auto proc = std::make_shared<Process>(	×
43	unlinked_proc.pid_, unlinked_proc.effective_cred_,	×
44	// Re-use shared pointers from parent if value equivalent
45	(parent && (unlinked_proc.program_) == (parent->program_))	×
46	? parent->program_	×
47	: unlinked_proc.program_,	×
NEW 48	parent, 0);	×
49	{	×
50	absl::MutexLock lock(&mtx_);	×
51	map_.emplace(unlinked_proc.pid_, proc);	×
52	}	×
53
54	// The only case where we should not have a parent is the root processes
55	// (e.g. init, kthreadd).
56	if (parent) {	×
57	for (auto &annotator : annotators_) {	×
58	annotator->AnnotateFork(this, (proc->parent_), *proc);	×
59	if (proc->program_ != proc->parent_->program_) {	×
60	annotator->AnnotateExec(this, (proc->parent_), *proc);	×
61	}	×
62	}	×
63	}	×
64
65	for (const Process &child : parent_map[unlinked_proc.pid_.pid]) {	×
66	BackfillInsertChildren(parent_map, proc, child);	×
67	}	×
68	}	×
69
70	std::vector<::santa::pb::v1::process_tree::AncestryProcessID>
NEW 71	ProcessTree::GetAncestors(const Process &process) {	×
NEW 72	std::vector<::santa::pb::v1::process_tree::AncestryProcessID> ancestors;	×
NEW 73	if (!process.parent_) {	×
NEW 74	return ancestors;	×
NEW 75	}	×
NEW 76	{	×
NEW 77	absl::MutexLock lock(&mtx_);	×
NEW 78	std::optional<std::shared_ptr<Process>> chainProcess =	×
NEW 79	GetLocked(process.parent_->pid_);	×
NEW 80	while (chainProcess != std::nullopt) {	×
NEW 81	::santa::pb::v1::process_tree::AncestryProcessID process_id;	×
NEW 82	process_id.set_pid((*chainProcess)->pid_.pid);	×
NEW 83	process_id.set_secondary_id((*chainProcess)->pid_.pidversion);	×
NEW 84	ancestors.push_back(process_id);	×
NEW 85	if ((*chainProcess)->parent_) {	×
NEW 86	chainProcess = GetLocked((*chainProcess)->parent_->pid_);	×
NEW 87	} else {	×
NEW 88	chainProcess = std::nullopt;	×
NEW 89	}	×
NEW 90	}	×
NEW 91	}	×
NEW 92	return ancestors;	×
NEW 93	}	×
94
95	void ProcessTree::HandleFork(uint64_t timestamp, const Process &parent,
96	const Pid new_pid) {	1,040✔
97	if (Step(timestamp)) {	1,040!
98	std::shared_ptr<Process> child;	1,040✔
99	{	1,040✔
100	absl::MutexLock lock(&mtx_);	1,040✔
101	child = std::make_shared<Process>(new_pid, parent.effective_cred_,	1,040✔
102	parent.program_, map_[parent.pid_],	1,040✔
103	timestamp);	1,040✔
104	map_.emplace(new_pid, child);	1,040✔
105	}	1,040✔
106	for (const auto &annotator : annotators_) {	1,040✔
107	annotator->AnnotateFork(this, parent, child);	4✔
108	}	4✔
109	}	1,040✔
110	}	1,040✔
111
112	void ProcessTree::HandleExec(uint64_t timestamp, const Process &p,
113	const Pid new_pid, const Program prog,
114	const Cred c) {	5✔
115	if (Step(timestamp)) {	5!
116	// TODO(nickmg): should struct pid be reworked and only pid_version be
117	// passed?
118	assert(new_pid.pid == p.pid_.pid);	5✔
119
120	auto new_proc = std::make_shared<Process>(	5✔
121	new_pid, c, std::make_shared<const Program>(prog), p.parent_,	5✔
122	timestamp);	5✔
123	{	5✔
124	absl::MutexLock lock(&mtx_);	5✔
125	remove_at_.push_back({timestamp, p.pid_});	5✔
126	map_.emplace(new_proc->pid_, new_proc);	5✔
127	}	5✔
128	for (const auto &annotator : annotators_) {	5✔
129	annotator->AnnotateExec(this, p, new_proc);	4✔
130	}	4✔
131	}	5✔
132	}	5✔
133
134	void ProcessTree::HandleExit(uint64_t timestamp, const Process &p) {	2✔
135	if (Step(timestamp)) {	2!
136	absl::MutexLock lock(&mtx_);	2✔
137	remove_at_.push_back({timestamp, p.pid_});	2✔
138	}	2✔
139	}	2✔
140
141	bool ProcessTree::Step(uint64_t timestamp) {	1,047✔
142	absl::MutexLock lock(&mtx_);	1,047✔
143	uint64_t new_cutoff = seen_timestamps_.front();	1,047✔
144	if (timestamp < new_cutoff) {	1,047!
145	// Event timestamp is before the rolling list of seen events.
146	// This event may or may not have been processed, but be conservative and
147	// do not reprocess.
148	return false;	×
149	}	×
150
151	// seen_timestamps_ is sorted, so only look for the value if it's possibly
152	// within the array.
153	if (timestamp < seen_timestamps_.back()) {	1,047!
154	// TODO(nickmg): If array is made bigger, replace with a binary search.
155	for (const auto seen_ts : seen_timestamps_) {	×
156	if (seen_ts == timestamp) {	×
157	// Event seen, signal it should not be reprocessed.
158	return false;	×
159	}	×
160	}	×
161	}	×
162
163	auto insert_point =	1,047✔
164	std::find_if(seen_timestamps_.rbegin(), seen_timestamps_.rend(),	1,047✔
165	[&](uint64_t x) { return x < timestamp; });	1,047✔
166	std::move(seen_timestamps_.begin() + 1, insert_point.base(),	1,047✔
167	seen_timestamps_.begin());	1,047✔
168	*insert_point = timestamp;	1,047✔
169
170	for (auto it = remove_at_.begin(); it != remove_at_.end();) {	1,117✔
171	if (it->first < new_cutoff) {	70✔
172	if (auto target = GetLocked(it->second);	2✔
173	target && (*target)->refcnt_ > 0) {	2!
174	(*target)->tombstoned_ = true;	1✔
175	} else {	1✔
176	map_.erase(it->second);	1✔
177	}	1✔
178	it = remove_at_.erase(it);	2✔
179	} else {	68✔
180	it++;	68✔
181	}	68✔
182	}	70✔
183
184	return true;	1,047✔
185	}	1,047✔
186
187	void ProcessTree::RetainProcess(std::vector<struct Pid> &pids) {	1✔
188	absl::MutexLock lock(&mtx_);	1✔
189	for (const struct Pid &p : pids) {	1✔
190	auto proc = GetLocked(p);	1✔
191	if (proc) {	1!
192	(*proc)->refcnt_++;	1✔
193	}	1✔
194	}	1✔
195	}	1✔
196
197	void ProcessTree::ReleaseProcess(std::vector<struct Pid> &pids) {	1✔
198	absl::MutexLock lock(&mtx_);	1✔
199	for (const struct Pid &p : pids) {	1✔
200	auto proc = GetLocked(p);	1✔
201	if (proc) {	1!
202	if (--(proc)->refcnt_ == 0 && (proc)->tombstoned_) {	1!
203	map_.erase(p);	1✔
204	}	1✔
205	}	1✔
206	}	1✔
207	}	1✔
208
209	/*
210	---
211	Annotation get/set
212	---
213	*/
214
215	void ProcessTree::AnnotateProcess(const Process &p,
216	std::shared_ptr<const Annotator> a) {	6✔
217	absl::MutexLock lock(&mtx_);	6✔
218	const Annotator &x = *a;	6✔
219	map_[p.pid_]->annotations_.emplace(std::type_index(typeid(x)), std::move(a));	6✔
220	}	6✔
221
222	std::optional<::santa::pb::v1::process_tree::Annotations>
223	ProcessTree::ExportAnnotations(const Pid p) {	×
224	auto proc = Get(p);	×
225	if (!proc \|\| (*proc)->annotations_.empty()) {	×
226	return std::nullopt;	×
227	}	×
228	::santa::pb::v1::process_tree::Annotations a;	×
229	for (const auto &[_, annotation] : (*proc)->annotations_) {	×
230	if (auto x = annotation->Proto(); x) a.MergeFrom(*x);	×
231	}	×
232	return a;	×
233	}	×
234
235	/*
236	---
237	Tree inspection methods
238	---
239	*/
240
241	std::vector<std::shared_ptr<const Process>> ProcessTree::RootSlice(
242	std::shared_ptr<const Process> p) const {	×
243	std::vector<std::shared_ptr<const Process>> slice;	×
244	while (p) {	×
245	slice.push_back(p);	×
246	p = p->parent_;	×
247	}	×
248	return slice;	×
249	}	×
250
251	void ProcessTree::Iterate(
252	std::function<void(std::shared_ptr<const Process> p)> f) const {	×
253	std::vector<std::shared_ptr<const Process>> procs;	×
254	{	×
255	absl::ReaderMutexLock lock(&mtx_);	×
256	procs.reserve(map_.size());	×
257	for (auto &[_, proc] : map_) {	×
258	procs.push_back(proc);	×
259	}	×
260	}	×
261
262	for (auto &p : procs) {	×
263	f(p);	×
264	}	×
265	}	×
266
267	std::optional<std::shared_ptr<const Process>> ProcessTree::Get(
268	const Pid target) const {	1,017✔
269	absl::ReaderMutexLock lock(&mtx_);	1,017✔
270	return GetLocked(target);	1,017✔
271	}	1,017✔
272
273	std::optional<std::shared_ptr<Process>> ProcessTree::GetLocked(
274	const Pid target) const {	1,021✔
275	auto it = map_.find(target);	1,021✔
276	if (it == map_.end()) {	1,021✔
277	return std::nullopt;	2✔
278	}	2✔
279	return it->second;	1,019✔
280	}	1,021✔
281
282	std::shared_ptr<const Process> ProcessTree::GetParent(const Process &p) const {	1✔
283	return p.parent_;	1✔
284	}	1✔
285
286	#if SANTA_PROCESS_TREE_DEBUG
287	void ProcessTree::DebugDump(std::ostream &stream) const {
288	absl::ReaderMutexLock lock(&mtx_);
289	stream << map_.size() << " processes" << std::endl;
290	DebugDumpLocked(stream, 0, 0);
291	}
292
293	void ProcessTree::DebugDumpLocked(std::ostream &stream, int depth,
294	pid_t ppid) const
295	ABSL_SHARED_LOCKS_REQUIRED(mtx_) {
296	for (auto &[_, process] : map_) {
297	if ((ppid == 0 && !process->parent_) \|\|
298	(process->parent_ && process->parent_->pid_.pid == ppid)) {
299	stream << std::string(2 * depth, ' ') << process->pid_.pid
300	<< process->program_->executable << std::endl;
301	DebugDumpLocked(stream, depth + 1, process->pid_.pid);
302	}
303	}
304	}
305	#endif
306
307	absl::StatusOr<std::shared_ptr<ProcessTree>> CreateTree(
308	std::vector<std::unique_ptr<Annotator>> annotations) {	24✔
309	absl::flat_hash_set<std::type_index> seen;	24✔
310	for (const auto &annotator : annotations) {	24!
311	if (seen.count(std::type_index(typeid(annotator)))) {	×
312	return absl::InvalidArgumentError(	×
313	"Multiple annotators of the same class");	×
314	}	×
315	seen.emplace(std::type_index(typeid(annotator)));	×
316	}	×
317
318	if (seen.empty()) {	24!
319	return nullptr;	24✔
320	}	24✔
321
322	auto tree = std::make_shared<ProcessTree>(std::move(annotations));	×
323	if (auto status = tree->Backfill(); !status.ok()) {	×
324	return status;	×
325	}	×
326	return tree;	×
327	}	×
328
329	/*
330	----
331	Tokens
332	----
333	*/
334
335	ProcessToken::ProcessToken(std::shared_ptr<ProcessTree> tree,
336	std::vector<struct Pid> pids)
337	: tree_(std::move(tree)), pids_(std::move(pids)) {	×
338	tree_->RetainProcess(pids);	×
339	}	×
340
341	ProcessToken::~ProcessToken() { tree_->ReleaseProcess(pids_); }	×
342
343	} // namespace santa::santad::process_tree

google / santa / 12243963475

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous