proctree wip

aquasecurity · Jan 30, 2025 · b417b05 · b417b05
1 parent 4104407
commit b417b05
Show file tree

Hide file tree

Showing 4 changed files with 12 additions and 4 deletions.
diff --git a/pkg/proctree/proctree_feed.go b/pkg/proctree/proctree_feed.go
@@ -62,6 +62,7 @@ func (pt *ProcessTree) setParentFeed(
 	pt.PutTaskInfoFeedInPool(taskInfoFeed)
 
 	if pt.procfsQuery {
+		// why not to pass also the parent hash? create new API to pass the parent hash
 		pt.FeedFromProcFSAsync(forkFeed.ParentPid) // try to enrich ppid and name from procfs
 	}
 }
@@ -92,6 +93,7 @@ func (pt *ProcessTree) setLeaderFeed(
 	pt.PutTaskInfoFeedInPool(taskInfoFeed)
 
 	if pt.procfsQuery {
+		// why not to pass also the parent hash? create new API to pass the leader hash
 		pt.FeedFromProcFSAsync(forkFeed.LeaderPid) // try to enrich name from procfs if needed
 	}
 }
@@ -140,6 +142,7 @@ func (pt *ProcessTree) FeedFromFork(feed *ForkFeed) error {
 
 	// Update the parent process (might already exist)
 
+	// why not just call GetOrCreateProcessByHash
 	parent, found := pt.GetProcessByHash(feed.ParentHash) // always a real process
 	if !found {
 		parent = pt.GetOrCreateProcessByHash(feed.ParentHash)

diff --git a/pkg/proctree/proctree_procfs.go b/pkg/proctree/proctree_procfs.go
@@ -101,12 +101,12 @@ func getProcessByPID(pt *ProcessTree, givenPid int32) (*Process, error) {
 	if err != nil {
 		return nil, errfmt.Errorf("%v", err)
 	}
-	stat, err := proc.NewProcStat(givenPid)
+	stat, err := proc.NewProcStat(givenPid) // move stat to be the first call, since it's faster
 	if err != nil {
 		return nil, errfmt.Errorf("%v", err)
 	}
 
-	statusPid := status.GetPid()
+	statusPid := status.GetPid() // status can be removed since in this case it only checks the pid
 	statStartTime := stat.GetStartTime()
 
 	// hint for GC
@@ -128,7 +128,7 @@ func dealWithProc(pt *ProcessTree, givenPid int32) error {
 	if err != nil {
 		return errfmt.Errorf("%v", err)
 	}
-	stat, err := proc.NewProcStat(givenPid)
+	stat, err := proc.NewProcStat(givenPid) // move stat to be the first call, since it's faster
 	if err != nil {
 		return errfmt.Errorf("%v", err)
 	}
@@ -305,7 +305,7 @@ func dealWithThread(pt *ProcessTree, givenPid, givenTid int32) error {
 
 // dealWithProcFsEntry deals with a process from procfs.
 func dealWithProcFsEntry(pt *ProcessTree, givenPid int32) error {
-	_, err := os.Stat(fmt.Sprintf("/proc/%v", givenPid))
+	_, err := os.Stat(fmt.Sprintf("/proc/%v", givenPid)) // unnecessary, it's just enlarging the window of non-existence
 	if os.IsNotExist(err) {
 		return errfmt.Errorf("could not find process %v", givenPid)
 	}

diff --git a/pkg/utils/proc/parsers.go b/pkg/utils/proc/parsers.go
@@ -25,5 +25,6 @@ func ParseUint64(value string) (uint64, error) {
 }
 
 func parseString(value string) string {
+	// remove clone, leave it to the caller if needed
 	return strings.Clone(value) // clone it to avoid memory leak
 }
diff --git a/pkg/utils/proc/status.go b/pkg/utils/proc/status.go
@@ -44,6 +44,10 @@ import (
 //
 // ...
 
+const (
+	StatusReadFileInitialBufferSize = 1280 // greater than average size calculated from 10k status files
+)
+
 // ProcStatus represents the minimal required fields of the /proc status file.
 type ProcStatus struct {
 	name   string // up to 64 chars: https://elixir.bootlin.com/linux/v6.11.4/source/fs/proc/array.c#L99