src/detection/processes/processes_linux.c


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

#include "processes.h"

#include "common/io.h"
#include "common/strutil.h"

const char* ffDetectProcesses(uint32_t* result) {
    FF_AUTO_CLOSE_DIR DIR* dir = opendir("/proc");
    if (dir == NULL) {
        return "opendir(\"/proc\") failed";
    }

    uint32_t num = 0;

    struct dirent* entry;
    while ((entry = readdir(dir)) != NULL) {
        if (
#ifdef _DIRENT_HAVE_D_TYPE
            (entry->d_type == DT_DIR || entry->d_type == DT_UNKNOWN) &&
#endif
            ffCharIsDigit(entry->d_name[0]))
            ++num;
    }

    *result = num;

    return NULL;
}