In situations when the scanner cannot read /proc reliably anymore, there need to be a way for the operator to know that the scan result is no longer trustworthy. Implementation is simple:
- On surveyor, fork a child and construct a known memory/process profile (starttime, pid, random stuff in ram, etc)
- If surveyor see the child in /proc, compared against known info about the process
- If info does not match what we know about the child, or the process can't be found in /proc, write a flag into the wire transport that the data is not reliable, which should be handled downstream
In situations when the scanner cannot read /proc reliably anymore, there need to be a way for the operator to know that the scan result is no longer trustworthy. Implementation is simple: