Documentation
¶
Overview ¶
Package responseactuator executes the deliberately narrow endpoint response protocol.
Index ¶
- type Actuator
- type Registry
- func (r *Registry) Close() error
- func (r *Registry) ObserveProcess(assetID, bootID shared.ID, event detection.ProcessEvent)
- func (r *Registry) RestartProcess(ctx context.Context, entityID shared.ID) (alreadyRestarted bool, err error)
- func (r *Registry) StopProcess(ctx context.Context, entityID shared.ID) (bool, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Actuator ¶
type Actuator struct {
// contains filtered or unexported fields
}
Actuator maps a validated protocol command to a direct kernel/process API. It never executes the command's display argv and never invokes a shell.
func (*Actuator) ExecuteResponse ¶
func (a *Actuator) ExecuteResponse(ctx context.Context, command fleetagent.ResponseCommand) (ports.ResponseActuatorOutcome, error)
type Registry ¶
type Registry struct {
// contains filtered or unexported fields
}
Registry pins process identities as pidfds when their durable eBPF observations pass through the agent. It deliberately does not discover arbitrary /proc entries: without the original boot/start observation, a bare PID cannot be bound to a ProcessEntityID safely.
func NewRegistry ¶
func (*Registry) ObserveProcess ¶
func (r *Registry) ObserveProcess(assetID, bootID shared.ID, event detection.ProcessEvent)
ObserveProcess is called only after the canonical process observation is durable in the telemetry WAL.
func (*Registry) RestartProcess ¶
func (r *Registry) RestartProcess(ctx context.Context, entityID shared.ID) (alreadyRestarted bool, err error)
RestartProcess launches an executable only after this registry sent SIGTERM to its exact prior process identity and the pidfd reports that identity has exited. A successful return means exec started; it does not assert a telemetry or application-health post-condition.
Source Files