Context
Events capture parent_pid but no ancestry tree is maintained. Needed for correlation engine (WP5) to detect cheat processes spawned near the game.
Work
- New
daemon/process_tree.{h,c}: hash map PID -> {parent_pid, comm, birth_time}. Fed by existing fork/exec/exit events. owl_ptree_is_descendant(), owl_ptree_get_chain().
- New
tests/test_process_tree.c
- Modify
daemon/main.c, daemon/event_pipeline.c
Tests
8 unit tests (add process, lookup parent, build chain, is_descendant, remove on exit, capacity, null inputs, re-insert after exit).
Blocks
WP5 (event correlation engine) depends on this.
Part of v2.0.0
Context
Events capture parent_pid but no ancestry tree is maintained. Needed for correlation engine (WP5) to detect cheat processes spawned near the game.
Work
daemon/process_tree.{h,c}: hash map PID -> {parent_pid, comm, birth_time}. Fed by existing fork/exec/exit events.owl_ptree_is_descendant(),owl_ptree_get_chain().tests/test_process_tree.cdaemon/main.c,daemon/event_pipeline.cTests
8 unit tests (add process, lookup parent, build chain, is_descendant, remove on exit, capacity, null inputs, re-insert after exit).
Blocks
WP5 (event correlation engine) depends on this.
Part of v2.0.0