Struct OriginRecord 

#[repr(C)]
pub struct OriginRecord {
    pub version: u32,
    pub pid: u32,
    pub ts_boot_ns: u64,
    pub comm: [u8; 16],
    pub creator_uid: u32,
    pub _pad: u32,
    pub creator_path: [u8; 256],
    pub landing_filename: [u8; 256],
}

Provenance record. Carried in the security.bpf.linprov.origin xattr and in the INODE_MARKS storage map.

Filled in stages:

• BPF file_open writes version, pid, ts_boot_ns, comm, creator_uid, and landing_filename (the path where the file was first written, via bpf_d_path).
• Userspace, on the corresponding ringbuf event, reads /proc/$pid/exe and overwrites the xattr with the augmented record (creator_path filled).

creator_path may be all-zeros if the creator process exited before userspace got to it. Allowlist rules keyed on creator_process won’t match such records, but other dims still do.

Fields

version: u32

pid: u32

ts_boot_ns: u64

comm: [u8; 16]

creator_uid: u32

_pad: u32

creator_path: [u8; 256]

landing_filename: [u8; 256]

Trait Implementations

impl Clone for OriginRecord

fn clone(&self) -> OriginRecord

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for OriginRecord