Context
No detection of debugger attachment via /proc/<pid>/status TracerPid field. Trivial addition to daemon watchdog.
Work
- New
daemon/debugger_detect.{h,c}: owl_check_tracer_pid(pid_t) reads /proc/<pid>/status, parses TracerPid: line. Returns tracer PID (0 if none).
- New
tests/test_debugger_detect.c
- Modify
daemon/main.c: call from watchdog loop (5s). Emit OWL_EVENT_PTRACE_ATTEMPT with source=DAEMON when TracerPid > 0.
Tests
6 unit tests (parse valid TracerPid, TracerPid zero, malformed status, null input, missing field, large PID).
Part of v2.0.0
Context
No detection of debugger attachment via
/proc/<pid>/statusTracerPid field. Trivial addition to daemon watchdog.Work
daemon/debugger_detect.{h,c}:owl_check_tracer_pid(pid_t)reads/proc/<pid>/status, parsesTracerPid:line. Returns tracer PID (0 if none).tests/test_debugger_detect.cdaemon/main.c: call from watchdog loop (5s). EmitOWL_EVENT_PTRACE_ATTEMPTwith source=DAEMON when TracerPid > 0.Tests
6 unit tests (parse valid TracerPid, TracerPid zero, malformed status, null input, missing field, large PID).
Part of v2.0.0