sysknife_daemon/actions/
processes.rs

1use super::{command_mechanism, ActionSpec};
2use sysknife_types::RiskLevel;
3
4pub fn specs() -> Vec<ActionSpec> {
5    vec![list_processes_spec(), signal_process(1234, "TERM")]
6}
7
8pub fn list_processes_spec() -> ActionSpec {
9    ActionSpec {
10        action_name: "ListProcesses",
11        mechanism: command_mechanism("ps", ["aux", "--sort=-%mem"]),
12        risk_level: RiskLevel::Low,
13        reboot_required: false,
14        rollback_available: false,
15    }
16}
17
18/// Send `signal` to process `pid`
19/// (`sudo /usr/lib/sysknife/action-steps signal <signal> <pid>`).
20///
21/// High risk: terminating an arbitrary process as root can take down services
22/// or lose in-flight work. The caller must have validated `signal` against the
23/// allowlist and rejected `pid < 2` (0 = whole process group, 1 = init) before
24/// calling. The helper checks both again, because its sudoers grant is also
25/// reachable without the daemon; a `kill -s *` grant could not refuse a target.
26pub fn signal_process(pid: u32, signal: &str) -> ActionSpec {
27    let pid_str = pid.to_string();
28    ActionSpec {
29        action_name: "SignalProcess",
30        mechanism: command_mechanism(
31            "sudo",
32            [
33                "/usr/lib/sysknife/action-steps",
34                "signal",
35                signal,
36                pid_str.as_str(),
37            ],
38        ),
39        risk_level: RiskLevel::High,
40        reboot_required: false,
41        rollback_available: false,
42    }
43}
sysknife_daemon/actions/processes.rs

sysknife_daemon/actions/
processes.rs
