CoreCtrl Process Executable Solver library

libcopes is a library for monitoring exec and exit process events efficiently by using the Linux process events connector kernel interface. It also provides some functionality to get process information, like the executed file and its command line.

Rust version support

The minimum supported Rust toolchain version is currently Rust 1.77.

Example

This basic example shows how to get events and information about the executable file that launched the process.

use libcopes::{
    PEvent, ProcessEventsConnector, get_process_executed_file,
    io::{cmdline_reader, exe_reader},
};

fn main() -> Result<(), std::io::Error> {
    let connector = ProcessEventsConnector::try_new()?;
    let mut events = connector.into_iter();
    loop {
        if let Some(event) = events.next() {
            if let Ok(process_event) = event {
                match process_event {
                    PEvent::Exec(pid) => {
                        let cmdline = cmdline_reader(pid)?;
                        let exe = get_process_executed_file(exe_reader(pid)?, &cmdline);
                        println!("Exec: PID {}, file: '{}', cmdline: {}", pid, exe, cmdline)
                    }
                    PEvent::Exit(pid) => println!("Exit: PID {}", pid),
                }
            }
        }
    }
}

License

Licensed under the Mozilla Public License 2.0. Permissions of this copyleft license are conditioned on making available source code of licensed files and modifications of those files under the same license (or in certain cases, one of the GNU licenses). Copyright and license notices must be preserved. Contributors provide an express grant of patent rights. However, a larger work using the licensed work may be distributed under different terms and without source code for files added in the larger work.

Contribution

Please, read the CONTRIBUTING guide for more information about how to get started.

Any contribution intentionally submitted for inclusion in the work by you shall be licensed under the Mozilla Public License 2.0 (MPL-2.0). It is required to add a boilerplate copyright notice to the top of each file:

// SPDX-License-Identifier: MPL-2.0
// Copyright {year} {person OR org} <{email}>