linuxautomaton/linuxautomaton/sp.py

   1 #!/usr/bin/env python3
   2 #
   3 # The MIT License (MIT)
   4 #
   5 # Copyright (C) 2015 - Julien Desfossez <jdesfosez@efficios.com>
   6 #
   7 # Permission is hereby granted, free of charge, to any person obtaining a copy
   8 # of this software and associated documentation files (the "Software"), to deal
   9 # in the Software without restriction, including without limitation the rights
  10 # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  11 # copies of the Software, and to permit persons to whom the Software is
  12 # furnished to do so, subject to the following conditions:
  13 #
  14 # The above copyright notice and this permission notice shall be included in
  15 # all copies or substantial portions of the Software.
  16 #
  17 # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  18 # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  19 # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  20 # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  21 # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  22 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
  23 # SOFTWARE.
  24
  25
  26 class StateProvider:
  27     def process_event(self, ev):
  28         raise NotImplementedError()
  29
  30     def _register_cbs(self, cbs):
  31         self._cbs = cbs
  32
  33     def _process_event_cb(self, ev):
  34         name = ev.name
  35
  36         if name in self._cbs:
  37             self._cbs[name](ev)
  38         # for now we process all the syscalls at the same place
  39         if "syscall_entry" in self._cbs and \
  40                 (name.startswith("sys_") or name.startswith("syscall_entry_")):
  41             self._cbs["syscall_entry"](ev)
  42         if "syscall_exit" in self._cbs and \
  43                 (name.startswith("exit_syscall") or
  44                  name.startswith("syscall_exit_")):
  45             self._cbs["syscall_exit"](ev)