Struct Notification

pub struct Notification {
    pub pid: u32,
    pub syscall: Sysno,
    pub args: [u64; 6],
    /* private fields */
}

Represents a notification from the seccomp system call.

This struct contains information about a system call that has been intercepted by seccomp. It includes the system call number (syscall), the arguments to the system call (args), and other relevant information such as the process ID (pid) and a file descriptor (fd).

Fields

pid: u32

The process ID that made the system call.

syscall: Sysno

The system call number.

args: [u64; 6]

The arguments to the system call.

Implementations

impl Notification

pub fn from_raw(notif: seccomp_notif, fd: RawFd) -> Self

Constructs a Notification from a raw seccomp_notif structure and a file descriptor.

This method takes a seccomp_notif structure and a file descriptor (RawFd) as input. It constructs a Notification instance by extracting the relevant fields from the seccomp_notif structure and the file descriptor.

Arguments

• notif - A raw seccomp_notif structure containing the notification data.
• fd - A file descriptor associated with the notification.

Returns

A Notification instance with the extracted data.

pub fn valid(&self) -> bool

Checks if the notification is valid.

This method checks the validity of the notification by calling seccomp_notify_id_valid with the file descriptor and the notification ID. It returns true if the notification is valid, and false otherwise.

Returns

true if the notification is valid, false otherwise.

pub unsafe fn open(&self) -> Result<File, Error>

Opens the memory file of the process associated with the notification.

This method attempts to open the memory file of the process identified by the notification’s process ID. It constructs the path to the memory file and attempts to open it with read and write permissions. If the notification is not valid (i.e., the process has quit), it returns an error indicating that the process has quit.

Safety

This method is unsafe because opening or reading the memory of a remote process is inherently prone to race conditions. While writing to remote memory is possible, it is never safe. Proceed with caution - here be demons!

Errors

Returns an io::Error if the memory file cannot be opened or if the notification is not valid.

Trait Implementations

impl Clone for Notification

fn clone(&self) -> Notification

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Notification

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Copy for Notification