in reverie-ptrace/src/trace/mod.rs [156:198]
fn from_ptrace_event(task: &Stopped, event: i32) -> Result<Self, Error> {
// Note that there is no danger in calling ptrace here because the
// process is guaranteed to be in a ptrace-stop state when this function
// is called.
match event {
libc::PTRACE_EVENT_FORK => {
// Get the pid of the child immediately since we almost always
// want that.
let child_pid = Pid::from_raw(task.getevent()? as i32);
Ok(Self::NewChild(ChildOp::Fork, Running(child_pid)))
}
libc::PTRACE_EVENT_VFORK => {
// Get the pid of the child immediately since we almost always
// want that.
let child_pid = Pid::from_raw(task.getevent()? as i32);
Ok(Self::NewChild(ChildOp::Vfork, Running(child_pid)))
}
libc::PTRACE_EVENT_CLONE => {
// Get the pid of the child immediately since we almost always
// want that.
let child_pid = Pid::from_raw(task.getevent()? as i32);
Ok(Self::NewChild(ChildOp::Clone, Running(child_pid)))
}
libc::PTRACE_EVENT_EXEC => {
// Get the pid of the thread group leader that this call to exec
// is replacing. This is not necessarily equal to `pid` since
// another thread besides the main thread can call `exec`. This
// information is necessary to track the "death" of a process.
let new_pid = Pid::from_raw(task.getevent()? as i32);
Ok(Self::Exec(new_pid))
}
libc::PTRACE_EVENT_VFORK_DONE => Ok(Self::VforkDone),
libc::PTRACE_EVENT_EXIT => {
// Note that we can get the exit status here using `getevent`,
// but that's almost never what we want to do. It is better to
// get that during the final exit event.
Ok(Self::Exit)
}
libc::PTRACE_EVENT_SECCOMP => Ok(Self::Seccomp),
libc::PTRACE_EVENT_STOP => Ok(Self::Stop),
_ => unreachable!("unknown ptrace event {:#x}", event),
}
}