Skip to content

Conversation

devzbysiu
Copy link
Contributor

Changes:

  • JobMonitorFileshareProcess replaced with NetlinkProcessMonitor - based on netlink Process Events Connector API:
    • monitor listens for EXIT and EXEC events from the kernel
    • EXEC event handler verifies that the process created is a fileshare process by getting PID from the event and reading /proc VFS to check the process path
    • if it's confirmed that the created process is a fileshare process, then we save its PID and allow fileshare port
    • on EXIT, we compare the PID and if it does match then we are blocking fileshare because it means that fileshare process exited - no matter how (was killed or stopped)
  • the monitor is enabled only when meshnet is on

@devzbysiu devzbysiu force-pushed the fileshare-monitoring branch from 95a7f9e to df68940 Compare December 17, 2024 07:42
@devzbysiu devzbysiu changed the title Initial implementation of fileshare monitoring Add fileshare process monitoring Dec 17, 2024
@devzbysiu
Copy link
Contributor Author

The Process Event Connector mechanism is not working on docker because of process and user namespaces mismatch and it's not reporting errors to user-space. I'm dropping this approach.

@devzbysiu devzbysiu closed this Dec 18, 2024
@devzbysiu devzbysiu deleted the fileshare-monitoring branch March 5, 2025 13:09
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants