process.go RawHistoryFolder

1package platform
2
3import (
4	"bytes"
5	"encoding/binary"
6	"fmt"
7	"sort"
8	"time"
9)
10
11const processRecordCacheTTL = 250 * time.Millisecond
12
13type processRecord struct{ pid, pgrp int }
14
15func selectProcessGroupPID(recs []processRecord, pgid int, shellPid int) (int, bool) {
16	if pgid <= 0 {
17		return 0, false
18	}
19	matches := make([]int, 0)
20	for _, r := range recs {
21		if r.pgrp == pgid && r.pid != shellPid {
22			matches = append(matches, r.pid)
23		}
24	}
25	if len(matches) == 0 {
26		return 0, false
27	}
28	sort.Ints(matches)
29	return matches[0], true
30}
31
32// parseKernProcArgs2 parses the KERN_PROCARGS2 buffer returned by Darwin.
33// The layout is int argc, executable path, zero padding, argv, then envp.
34func parseKernProcArgs2(data []byte) ([]string, error) {
35	const argcSize = 4
36	if len(data) < argcSize {
37		return nil, fmt.Errorf("kern_procargs2: truncated argc")
38	}
39	argc := int(int32(binary.LittleEndian.Uint32(data[:argcSize])))
40	if argc <= 0 {
41		return nil, fmt.Errorf("kern_procargs2: invalid argc %d", argc)
42	}
43
44	rest := data[argcSize:]
45	execEnd := bytes.IndexByte(rest, 0)
46	if execEnd < 0 {
47		return nil, fmt.Errorf("kern_procargs2: unterminated executable path")
48	}
49	rest = rest[execEnd+1:]
50	for len(rest) > 0 && rest[0] == 0 {
51		rest = rest[1:]
52	}
53	// Each argument must contain at least its terminating NUL byte. Check this
54	// before allocating from the kernel-provided argc.
55	if argc > len(rest) {
56		return nil, fmt.Errorf("kern_procargs2: argc %d exceeds remaining data", argc)
57	}
58
59	argv := make([]string, 0, argc)
60	for len(argv) < argc {
61		end := bytes.IndexByte(rest, 0)
62		if end < 0 {
63			return nil, fmt.Errorf("kern_procargs2: truncated argv")
64		}
65		argv = append(argv, string(rest[:end]))
66		rest = rest[end+1:]
67	}
68	return argv, nil
69}