Skip to content

Canary process to check for silent failures #13

Description

@phunga003

In situations when the scanner cannot read /proc reliably anymore, there need to be a way for the operator to know that the scan result is no longer trustworthy. Implementation is simple:

  1. On surveyor, fork a child and construct a known memory/process profile (starttime, pid, random stuff in ram, etc)
  2. If surveyor see the child in /proc, compared against known info about the process
  3. If info does not match what we know about the child, or the process can't be found in /proc, write a flag into the wire transport that the data is not reliable, which should be handled downstream

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions