Struct Recording 

pub struct Recording {
    pub program: PathBuf,
    pub directory: PathBuf,
    pub seccomp: bool,
    /* private fields */
}

An external syscall recorder wrapping each command, with separate trace files.

Fields

program: PathBuf

The recorder’s program: strace, or qk itself, whose helper loads the eBPF recorder.

directory: PathBuf

seccomp: bool

Whether strace filters the traced calls in the kernel, with seccomp, so untraced calls run at full speed. strace 5.3 and later can.

Implementations

impl Recording

pub fn probe(directory: &Path) -> Result<Self>

The recorder QK_RECORDER picks: by default eBPF, where its helper can load it, else strace on PATH, checked to record child processes, with seccomp filtering where it supports it. Its trial traces go in directory.

pub fn backend(&self) -> &'static str

The same settings, with traces in directory. The recorder’s name, as reports give it: ebpf or strace.

pub fn in_directory(&self, directory: PathBuf) -> Self

pub fn resolving(self) -> Self

The same, recording an opened file’s path with what its links lead to, as a report of what a task read shows it. strace always does.

pub fn settle(&self) -> Result<()>

Ends the recordings of the commands that have run, once they have finished, so that their traces are whole. strace’s are as soon as it exits; the eBPF recorder’s once its helper has sent every event.

pub fn command(&self, index: usize, text: &str, cwd: &Path) -> Command

The same invocation is used by preflight and actual task commands, which start in cwd.

Trait Implementations

impl Clone for Recording

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Recording

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.