예제 #1
0
    def calculate(self):
        linux_common.set_plugin_members(self)

        cache = linux_slabinfo(self._config).get_kmem_cache("dentry", self._config.UNALLOCATED)

        # support for old kernels 
        if cache == []:
            cache = linux_slabinfo(self._config).get_kmem_cache("dentry_cache", self._config.UNALLOCATED, struct_name = "dentry")

        for dentry in cache:
            path = linux_common.get_partial_path(dentry)
            bodyline = self.make_body(path, dentry)

            yield bodyline
예제 #2
0
    def calculate(self):
        linux_common.set_plugin_members(self)

        cache = linux_slabinfo(self._config).get_kmem_cache(
            "dentry", self._config.UNALLOCATED)

        # support for old kernels
        if cache == []:
            cache = linux_slabinfo(self._config).get_kmem_cache(
                "dentry_cache", self._config.UNALLOCATED, struct_name="dentry")

        for dentry in cache:
            path = linux_common.get_partial_path(dentry)
            bodyline = self.make_body(path, dentry)

            yield bodyline
    def calculate(self):
        linux_common.set_plugin_members(self)        
        
        has_owner = self.profile.obj_has_member("mm_struct", "owner")

        cache = linux_slabinfo(self._config).get_kmem_cache("vm_area_struct", self._config.UNALLOCATED)
        
        for vm in cache:
            start = vm.vm_start
            end   = vm.vm_end
            
            if has_owner and vm.vm_mm and vm.vm_mm.is_valid():
                task = vm.vm_mm.owner
                (task_name, pid) = (task.comm, task.pid)
            else:
                (task_name, pid) = ("", "")
            
            if vm.vm_file and vm.vm_file.is_valid():
                path = linux_common.get_partial_path(vm.vm_file.dentry)
            else:
                path = ""

            yield task_name, pid, start, end, path
예제 #4
0
    def calculate(self):
        linux_common.set_plugin_members(self)

        has_owner = self.profile.obj_has_member("mm_struct", "owner")

        cache = linux_slabinfo(self._config).get_kmem_cache(
            "vm_area_struct", self._config.UNALLOCATED)

        for vm in cache:
            start = vm.vm_start
            end = vm.vm_end

            if has_owner and vm.vm_mm and vm.vm_mm.is_valid():
                task = vm.vm_mm.owner
                (task_name, pid) = (task.comm, task.pid)
            else:
                (task_name, pid) = ("", "")

            if vm.vm_file and vm.vm_file.is_valid():
                path = linux_common.get_partial_path(vm.vm_file.dentry)
            else:
                path = ""

            yield task_name, pid, start, end, path