Struct Event 

#[repr(C)]
pub struct Event {
    pub kind: u32,
    pub pid: u32,
    pub tgid: u32,
    pub status: i32,
    pub comm: [u8; 16],
    pub origin: OriginRecord,
    pub filename: [u8; 4096],
}

Ring-buffer record. Two kinds: NetworkFileOpen — informational; eBPF just wrote (or tried to write) the xattr. status is the kfunc return code. Execve — bprm_check fired AND the file already carried the mark. origin is the record we read back; status is unused.

Fields

kind: u32

pid: u32

tgid: u32

status: i32

comm: [u8; 16]

origin: OriginRecord

filename: [u8; 4096]

The live path: landing path for NetworkFileOpen, exec/target path for Execve. Sized to PATH_MAX; transient (ringbuf only).

Implementations

impl Event

pub const SIZE: usize

Trait Implementations

impl Clone for Event

fn clone(&self) -> Event

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for Event