pub fn detect_ssh_session(lineage: &[u32]) -> Option<(String, String, u32)>Expand description
If any ancestor in lineage is an sshd, return the
(user, remote_host, sshd_pid) session it established.
Advisory only: on NixOS there is no dpkg package database, so the sshd
process is identified by its /proc executable path (not a verified Debian
package). A /proc/<pid>/exe we cannot read is skipped, not fatal.