proc

Documentation

Overview

Package proc provides functionality for retrieving kallsyms, modules and executable mappings via /proc.

Index

• func GetKallsyms(kallsymsPath string) (*libpf.SymbolMap, error)
• func GetKernelModules(modulesPath string, kernelSymbols *libpf.SymbolMap) (*libpf.SymbolMap, error)
• func IsPIDLive(pid libpf.PID) (bool, error)
• func ListPIDs() ([]libpf.PID, error)

Functions

func GetKallsyms

func GetKallsyms(kallsymsPath string) (*libpf.SymbolMap, error)

GetKallsyms returns SymbolMap for kernel symbols from /proc/kallsyms.

func GetKernelModules

func GetKernelModules(modulesPath string,
	kernelSymbols *libpf.SymbolMap) (*libpf.SymbolMap, error)

GetKernelModules returns SymbolMap for kernel modules from /proc/modules.

func IsPIDLive

func IsPIDLive(pid libpf.PID) (bool, error)

IsPIDLive checks if a PID belongs to a live process. It will never produce a false negative but may produce a false positive (e.g. due to permissions) in which case an error will also be returned.

func ListPIDs

func ListPIDs() ([]libpf.PID, error)

ListPIDs from the proc filesystem mount point and return a list of util.PID to be processed