endpoint_sec/event/
event_profile_remove.rs

1//! [`EventProfileRemove`]
2
3use endpoint_sec_sys::es_event_profile_remove_t;
4
5use crate::{AuditToken, Process, Profile};
6
7/// Notification for Profiles removed on the system.
8#[doc(alias = "es_event_profile_remove_t")]
9pub struct EventProfileRemove<'a> {
10    /// The raw reference.
11    pub(crate) raw: &'a es_event_profile_remove_t,
12    /// The version of the message.
13    pub(crate) version: u32,
14}
15
16impl<'a> EventProfileRemove<'a> {
17    /// Process that instigated the Profile removal.
18    #[inline(always)]
19    pub fn instigator(&self) -> Option<Process<'a>> {
20        // Safety: 'a tied to self, object obtained through ES
21        let process = unsafe { self.raw.instigator()? };
22        Some(Process::new(process, self.version))
23    }
24
25    /// Audit token of the process that instigated this event.
26    pub fn instigator_token(&self) -> AuditToken {
27        #[cfg(feature = "macos_15_0_0")]
28        if self.version >= 8 {
29            return AuditToken(self.raw.instigator_token);
30        }
31
32        // On old versions, the process was always non-null, and we can get
33        // its token easily.
34        self.instigator().unwrap().audit_token()
35    }
36
37    /// Profile install item.
38    #[inline(always)]
39    pub fn profile(&self) -> Profile<'a> {
40        Profile {
41            // Safety: 'a tied to self, object obtained through ES
42            raw: unsafe { self.raw.profile.as_ref() },
43        }
44    }
45}
46
47// Safety: safe to send across threads: does not contain any interior mutability nor depend on current thread state
48unsafe impl Send for EventProfileRemove<'_> {}
49// Safety: safe to share across threads: does not contain any interior mutability nor depend on current thread state
50unsafe impl Sync for EventProfileRemove<'_> {}
51
52impl_debug_eq_hash_with_functions!(EventProfileRemove<'a> with version; instigator, instigator_token, profile);
endpoint_sec/event/event_profile_remove.rs

endpoint_sec/event/
event_profile_remove.rs
