Mathieu Virbel
9d5d852860
Replace fs_usage (reports Mach thread IDs, requiring process name matching with false positives) with eslogger (Endpoint Security framework, reports real Unix PIDs via audit_token.pid plus fork events for process tree tracking). Key changes: - Daemon starts eslogger instead of fs_usage, with early-exit detection and clear Full Disk Access error messaging - New two-pass eslogger JSON parser: pass 1 builds PID tree from fork events, pass 2 filters filesystem events by PID set - Remove runtime PID polling (StartPIDTracking, pollDescendantPIDs) — process tree is now built post-hoc from the eslogger log - Platform-specific generateLearnedTemplatePlatform() for darwin/linux/stub - Refactor TraceResult and GenerateLearnedTemplate to be platform-agnostic
11 lines
299 B
Go
11 lines
299 B
Go
//go:build !linux && !darwin
|
|
|
|
package sandbox
|
|
|
|
import "fmt"
|
|
|
|
// generateLearnedTemplatePlatform returns an error on unsupported platforms.
|
|
func (m *Manager) generateLearnedTemplatePlatform(cmdName string) (string, error) {
|
|
return "", fmt.Errorf("learning mode is not supported on this platform")
|
|
}
|