filemon exec: Use imgp->execpath rather than vn_fullpath(9).
This will be more accurate as the actual name is provided if ran from an absolute path in do_execve(). MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
This commit is contained in:
parent
ce4cda0143
commit
506c645640
@ -102,24 +102,17 @@ filemon_event_process_exec(void *arg __unused, struct proc *p,
|
|||||||
struct image_params *imgp)
|
struct image_params *imgp)
|
||||||
{
|
{
|
||||||
struct filemon *filemon;
|
struct filemon *filemon;
|
||||||
char *fullpath, *freepath;
|
|
||||||
size_t len;
|
size_t len;
|
||||||
|
|
||||||
if ((filemon = filemon_proc_get(p)) != NULL) {
|
if ((filemon = filemon_proc_get(p)) != NULL) {
|
||||||
fullpath = "<unknown>";
|
|
||||||
freepath = NULL;
|
|
||||||
|
|
||||||
vn_fullpath(curthread, imgp->vp, &fullpath, &freepath);
|
|
||||||
|
|
||||||
len = snprintf(filemon->msgbufr,
|
len = snprintf(filemon->msgbufr,
|
||||||
sizeof(filemon->msgbufr), "E %d %s\n",
|
sizeof(filemon->msgbufr), "E %d %s\n",
|
||||||
p->p_pid, fullpath);
|
p->p_pid,
|
||||||
|
imgp->execpath != NULL ? imgp->execpath : "<unknown>");
|
||||||
|
|
||||||
filemon_output(filemon, filemon->msgbufr, len);
|
filemon_output(filemon, filemon->msgbufr, len);
|
||||||
|
|
||||||
filemon_drop(filemon);
|
filemon_drop(filemon);
|
||||||
|
|
||||||
free(freepath, M_TEMP);
|
|
||||||
}
|
}
|
||||||
}
|
}
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user