endpoint_sec_sys

Function es_mute_path

Source 
pub unsafe extern "C" fn es_mute_path(
    client: *mut es_client_t,
    path: *const c_char,
    type_: es_mute_path_type_t,
) -> es_return_t
Available on macOS and crate feature macos_12_0_0 only.
Expand description

Suppress all events matching a path.

  • client: The es_client_t for which the path will be muted.
  • path: The path to mute.
  • type: Describes the type of the path parameter.

Path-based muting applies to the real and potentially firmlinked path of a file as seen by VFS, and as available from fcntl(2) F_GETPATH. No special provisions are made for files with multiple (“hard”) links, or for symbolic links.

In particular, when using inverted target path muting to monitor a particular path for writing, you will need to check if the file(s) of interest are also reachable via additional hard links outside of the paths you are observing.

See es_mute_path_events()

When using the path types ES_MUTE_PATH_TYPE_TARGET_PREFIX and ES_MUTE_PATH_TYPE_TARGET_LITERAL not all events are supported. Furthermore the interpretation of target path is contextual. For events with more than one target path (such as es_event_exchangedata_t) the behavior depends on the mute inversion state:

  • Under normal muting the event is suppressed only if ALL paths are muted
  • When target path muting is inverted the event is selected if ANY target path is muted

For example a rename will be suppressed if and only if both the source path and destination path are muted. Supported events are listed below. For each event the target path is defined as:

  • EXEC: The file being executed
  • OPEN: The file being opened
  • MMAP: The file being memory mapped
  • RENAME: Both the source and destination path.
  • SIGNAL: The path of the process being signalled
  • UNLINK: The file being unlinked
  • CLOSE: The file being closed
  • CREATE: The path to the file that will be created or replaced
  • GET_TASK: The path of the process for which the task port is being retrieved
  • LINK: Both the source and destination path
  • SETATTRLIST: The file for which the attributes are being set
  • SETEXTATTR: The file for which the extended attributes are being set
  • SETFLAGS: The file for which flags are being set
  • SETMODE: The file for which the mode is being set
  • SETOWNER: The file for which the owner is being set
  • WRITE: The file being written to
  • READLINK: The symbolic link being resolved
  • TRUNCATE: The file being truncated
  • CHDIR: The new working directory
  • GETATTRLIST: The file for which the attribute list is being retrieved
  • STAT: The file for which the stat is being retrieved
  • ACCESS: The file for which access is being tested
  • CHROOT: The file which will become the new root
  • UTIMES: The file for which times are being set
  • CLONE: Both the source file and target path
  • FCNTL: The file under file control
  • GETEXTATTR: The file for which extended attributes are being retrieved
  • LISTEXTATTR: The file for which extended attributes are being listed
  • READDIR: The directory for whose contents will be read
  • DELETEEXTATTR: The file for which extended attributes will be deleted
  • DUP: The file being duplicated
  • UIPC_BIND: The path to the unix socket that will be created
  • UIPC_CONNECT: The file that the unix socket being connected is bound to
  • EXCHANGEDATA: The path of both file1 and file2
  • SETACL: The file for which ACLs are being set
  • PROC_CHECK: The path of the process against which access is being checked
  • SEARCHFS: The path of the volume which will be searched
  • PROC_SUSPEND_RESUME: The path of the process being suspended or resumed
  • GET_TASK_NAME: The path of the process for which the task name port will be retrieved
  • TRACE: The path of the process that will be attached to
  • REMOTE_THREAD_CREATE: The path of the process in which the new thread is created
  • GET_TASK_READ: The path of the process for which the task read port will be retrieved
  • GET_TASK_INSPECT: The path of the process for which the task inspect port will be retrieved
  • COPYFILE: The path to the source file and the path to either the new file to be created or the existing file to be overwritten