Struct SyscallEvent 

pub struct SyscallEvent {
    pub syscall: String,
    pub category: SyscallCategory,
    pub pid: u32,
    pub parent_pid: Option<u32>,
    pub path: Option<String>,
    pub host: Option<IpAddr>,
    pub port: Option<u16>,
    pub size: Option<u64>,
    pub argv: Option<Vec<String>>,
    pub denied: bool,
}

An intercepted syscall event observed by the seccomp supervisor.

Fields

syscall: String

Syscall name (e.g., “connect”, “openat”, “execve”, “clone”).

category: SyscallCategory

High-level category.

pid: u32

PID of the process that made the syscall.

parent_pid: Option<u32>

Parent PID (read from /proc/{pid}/stat).

path: Option<String>

Resolved filesystem path (for openat, execve, etc.).

host: Option<IpAddr>

Destination IP address (for connect, sendto).

port: Option<u16>

Destination port (for connect, sendto, bind).

size: Option<u64>

Size argument (for mmap, brk).

argv: Option<Vec<String>>

Command arguments (for execve/execveat).

denied: bool

Whether the supervisor denied this syscall.

Implementations

impl SyscallEvent

pub fn path_contains(&self, s: &str) -> bool

Check if the path contains a substring.

pub fn argv_contains(&self, s: &str) -> bool

Check if any argv element contains a substring.

Trait Implementations

impl Clone for SyscallEvent

fn clone(&self) -> SyscallEvent

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SyscallEvent

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.