Struct GloballyLoadedLibrary 

pub struct GloballyLoadedLibrary {
    pub path: String,
    pub present_in_pid_count: usize,
    pub total_pids_checked: usize,
    pub prevalence: f64,
    pub elf_report: Option<ElfCapabilityReport>,
}

A shared library and how widely it is mapped across processes — the core signal for LD_PRELOAD-style rootkit detection: a malicious preload is injected into every process, so an unusually high prevalence is suspicious.

Fields

path: String

Filesystem path of the shared object (e.g. /usr/lib/evil.so).

present_in_pid_count: usize

Number of inspected PIDs that have this library mapped.

total_pids_checked: usize

Total number of PIDs inspected (the prevalence denominator).

prevalence: f64

Fraction of inspected processes mapping this library, in [0.0, 1.0].

elf_report: Option<ElfCapabilityReport>

Optional ELF capability analysis of the library, when available.

Trait Implementations

impl Debug for GloballyLoadedLibrary

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.