mac-process 0.1.0

User-mode library for querying and verifying integrity of MacOS processes
docs.rs failed to build mac-process-0.1.0
Please check the build logs for more information.
See Builds for ideas on how to fix a failed build, or Metadata for how to configure docs.rs builds.
If you believe this is docs.rs' fault, open an issue.

mac-process

This is a divergent fork/port of libproc-rs for getting information and verifying the integrity of macOS processes that diverges from the original libproc source code.

Comparison

  • Focuses mainly on macOS-specific functionality, while other OSes are not supported (Linux users should use procfs, which provide a similar interface to this crate using /proc/{pid}).
  • Supports a higher-level construct with the help of Mach functions, libproc functions, and the kqueue API:
    • The ProcessMonitor object yields shared, (practically) race-free handles to live processes.
    • Process exit notifications are supported.
    • To avoid race conditions due to PID reuse, dead processes cannot be queried (if they happen to be queried, the results are ignored).
  • All errors are converted to std::io::Error, and certain items in low-level libraries are also parsed into Rust types.
  • Caching of certain immutable fields is supported - this is useful when a user needs to query the same process multiple times.
  • Supports opening the main executable over /.vol for checking its contents (e.g. MD5 and SHA256 hashes).

Credits

Certain parts of this codebase are directly reused here. Please give them support:

More information (testing, building)

See the original repo (https://github.com/andrewdavidmackenzie/libproc-rs) for more details. Information related to Linux is not applicable in this crate.

TODO

  • Introduce signature verification for MacOS binaries
  • Implement other high-level APIs
  • Discuss re-merging with libproc-rs for completeness
  • Figure out whether custom error types are needed

LICENSE

This code is licensed under MIT license (see LICENSE.md).