falco_event_schema/fields/
dynamic_params.rs

1use falco_schema_derive::dynamic_params;
2
3dynamic_params! {
4const struct ppm_param_info sockopt_dynamic_param[PPM_SOCKOPT_IDX_MAX] = {
5        [PPM_SOCKOPT_IDX_UNKNOWN] = {{0}, PT_BYTEBUF, PF_HEX, 0, 0},
6        [PPM_SOCKOPT_IDX_ERRNO] = {{0}, PT_ERRNO, PF_DEC, 0, 0},
7        [PPM_SOCKOPT_IDX_UINT32] = {{0}, PT_UINT32, PF_DEC, 0, 0},
8        [PPM_SOCKOPT_IDX_UINT64] = {{0}, PT_UINT64, PF_DEC, 0, 0},
9        [PPM_SOCKOPT_IDX_TIMEVAL] = {{0}, PT_RELTIME, PF_DEC, 0, 0},
10};
11
12const struct ppm_param_info ptrace_dynamic_param[PPM_PTRACE_IDX_MAX] = {
13        [PPM_PTRACE_IDX_UINT64] = {{0}, PT_UINT64, PF_HEX, 0, 0},
14        [PPM_PTRACE_IDX_SIGTYPE] = {{0}, PT_SIGTYPE, PF_DEC, 0, 0},
15};
16
17const struct ppm_param_info bpf_dynamic_param[PPM_BPF_IDX_MAX] = {
18        [PPM_BPF_IDX_FD] = {{0}, PT_FD, PF_DEC, 0, 0},
19        [PPM_BPF_IDX_RES] = {{0}, PT_ERRNO, PF_DEC, 0, 0},
20};
21}