mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-08 02:18:53 +00:00
c7355b19aa
Summary: Pull Request resolved: https://github.com/facebook/osquery/pull/5452 As suggested in another diff, this diff updates the language we use to describe the osquery licensing terms. We are changing all instances of //This source code is licensed as defined on the LICENSE file found in the root directory of this source tree.// to //This source code is licensed in accordance with the terms specified in the LICENSE file found in the root directory of this source tree.// We accomplish this with a codemod: $ codemod -md xplat/osquery/oss --extensions cpp,h,in,py,sh,mm,ps1 "(.\s+)This source code is licensed as defined on the LICENSE file found in the(.*)root directory of this source tree\." "\1This source code is licensed in accordance with the terms specified in\2the LICENSE file found in the root directory of this source tree." Reviewed By: fmanco Differential Revision: D14131290 fbshipit-source-id: 52c90da342263e2a80f5a678ecd760c19cf7513e
31 lines
956 B
C++
31 lines
956 B
C++
/**
|
|
* Copyright (c) 2014-present, Facebook, Inc.
|
|
* All rights reserved.
|
|
*
|
|
* This source code is licensed in accordance with the terms specified in
|
|
* the LICENSE file found in the root directory of this source tree.
|
|
*/
|
|
|
|
#include <osquery/events/linux/auditeventpublisher.h>
|
|
|
|
namespace osquery {
|
|
|
|
class AuditProcessEventSubscriber final
|
|
: public EventSubscriber<AuditEventPublisher> {
|
|
public:
|
|
/// The process event subscriber declares an audit event type subscription.
|
|
Status init() override;
|
|
|
|
/// Kernel events matching the event type will fire.
|
|
Status Callback(const ECRef& ec, const SCRef& sc);
|
|
|
|
/// Processes the updates received from the callback
|
|
static Status ProcessEvents(
|
|
std::vector<Row>& emitted_row_list,
|
|
const std::vector<AuditEvent>& event_list) noexcept;
|
|
|
|
/// Returns the set of syscalls that this subscriber can handle
|
|
static const std::set<int>& GetSyscallSet() noexcept;
|
|
};
|
|
} // namespace osquery
|