bump version

CMakeLists.txt

@@ -2,11 +2,12 @@ cmake_minimum_required(VERSION 3.10)
 set(CMAKE_CXX_STANDARD 17)
 set(CMAKE_CXX_STANDARD_REQUIRED ON)
 
-project(cgproxy VERSION 4.1)
+project(cgproxy VERSION 0.14)
 set(CMAKE_CXX_FLAGS  "${CMAKE_CXX_FLAGS} -Wno-unused-result")
 
-set(build_tools OFF)
-set(build_test  OFF)
+option(with_execsnoop "enable program level proxy control feature, need bcc installed" ON)
+option(build_tools OFF)
+option(build_test  OFF)
 
 set(basic_permission OWNER_READ OWNER_WRITE OWNER_EXECUTE GROUP_READ GROUP_EXECUTE WORLD_READ WORLD_EXECUTE)
 
@@ -19,8 +20,23 @@ if (build_test)
     add_subdirectory(test)
 endif()
 
+install(FILES cgproxyd DESTINATION /usr/bin PERMISSIONS ${basic_permission})
 install(FILES cgnoproxy DESTINATION /usr/bin PERMISSIONS ${basic_permission})
 install(FILES cgproxy.service DESTINATION /usr/lib/systemd/system/)
 install(FILES config.json DESTINATION /etc/cgproxy/)
-install(FILES cgroup-tproxy.sh DESTINATION /usr/share/cgproxy/scripts/)
+install(FILES cgroup-tproxy.sh DESTINATION /usr/share/cgproxy/scripts/ PERMISSIONS ${basic_permission})
 install(FILES readme.md DESTINATION /usr/share/doc/cgproxy/)
+
+# man pages
+set(man_gz
+${PROJECT_BINARY_DIR}/cgproxyd.1.gz
+${PROJECT_BINARY_DIR}/cgproxy.1.gz
+${PROJECT_BINARY_DIR}/cgnoproxy.1.gz
+)
+add_custom_target(man
+    COMMAND gzip -fk cgproxyd.1 cgproxy.1 cgnoproxy.1
+    COMMAND mv *.gz ${PROJECT_BINARY_DIR}
+    WORKING_DIRECTORY ${PROJECT_SOURCE_DIR}/man
+)
+add_dependencies(main man)
+install(FILES ${man_gz} DESTINATION /usr/share/man/man1/)

cgnoproxy

@@ -1,2 +1,2 @@
 #!/bin/sh
-/usr/bin/cgproxy --noproxy $@
+exec /usr/bin/cgproxy --noproxy $@

cgproxy.service

@@ -4,7 +4,7 @@ After=network.target
 
 [Service]
 Type=simple
-ExecStart=/usr/bin/cgproxyd
+ExecStart=/usr/bin/cgproxyd --execsnoop
 
 [Install]
 WantedBy=multi-user.target

cgproxyd

@@ -0,0 +1,2 @@
+#!/bin/sh
+exec /usr/bin/cgproxy --daemon $@

config.json

@@ -1,11 +1,13 @@
 {
+    "port": 12345,
+    "program_noproxy": ["v2ray", "qv2ray"],
+    "program_proxy": [],
     "cgroup_noproxy": ["/system.slice/v2ray.service"],
     "cgroup_proxy": [],
-    "enable_dns": true,
     "enable_gateway": false,
-    "enable_ipv4": true,
-    "enable_ipv6": true,
-    "enable_tcp": true,
+    "enable_dns": true,
     "enable_udp": true,
-    "port": 12345
+    "enable_tcp": true,
+    "enable_ipv4": true,
+    "enable_ipv6": true
 }

man/cgnoproxy.1

@@ -0,0 +1,16 @@
+.\" Manpage for cgproxyd
+.TH man 1 "19 May 2020" "1.0" "cgnoproxy man page"
+.SH NAME
+cgnoproxy \- Run program without proxy
+.SH SYNOPSIS
+cgnoproxy --help
+cgnoproxy [--debug] <CMD>
+cgnoproxy [--debug] --pid <PID>
+.SH ALIAS
+cgnoproxy = cgproxy --noproxy
+.SH DESCRIPTION
+cgnoproxy send current running process pid or specified pid to cgproxyd through unix socket, then pid is attached to non-proxied cgroup 
+.SH EXAMPLES
+cgnoproxy sudo v2ray -config config_file
+.SH SEE ALSO
+cgproxyd(1), cgproxy(1), cgnoproxy(1)

man/cgproxy.1

@@ -0,0 +1,14 @@
+.\" Manpage for cgproxyd
+.TH man 1 "19 May 2020" "1.0" "cgproxy man page"
+.SH NAME
+cgproxy \- Run program with proxy
+.SH SYNOPSIS
+cgproxy --help
+cgproxy [--debug] <CMD>
+cgproxy [--debug] --pid <PID>
+.SH DESCRIPTION
+cgproxy send current running process pid or specified pid to cgproxyd through unix socket, then pid is attached to proxied cgroup 
+.SH EXAMPLES
+cgproxy curl -vI https://www.google.com
+.SH SEE ALSO
+cgproxyd(1), cgproxy(1), cgnoproxy(1)

man/cgproxyd.1

@@ -0,0 +1,54 @@
+.\" Manpage for cgproxyd
+.TH man 1 "19 May 2020" "1.0" "cgproxyd man page"
+.SH NAME
+cgproxyd \- Start a daemon with unix socket to accept control from cgproxy/cgnoproxy
+.SH SYNOPSIS
+cgproxyd [--help] [--debug] [--execsnoop]
+.SH ALIAS
+cgproxyd = cgproxy --daemon
+.SH OPTIONS
+.B  --execsnoop
+enable execsnoop to support program level proxy, need python-bcc installed to actually work
+.SH CONFIGURATION
+.I /etc/cgproxy/config.json
+.br
+.B port 
+tproxy listenning port
+.br
+program level proxy controll, need `python-bcc` installed to work:
+.br
+.RS
+.B program_proxy
+program need to be proxied
+.br
+.B program_noproxy
+program that won't be proxied
+.RE
+.br
+cgroup level proxy control:
+.br
+.RS
+.B cgroup_noproxy
+cgroup array that no need to proxy, /noproxy.slice is preserved.
+.br
+.B cgroup_proxy
+cgroup array that need to proxy, /proxy.slice is preserved.
+.RE
+.br
+.B enable_gateway
+enable gateway proxy for local devices.
+.br
+.B enable_dns
+enable dns to go to proxy.
+.br
+.B enable_tcp
+.br
+.B enable_udp
+.br
+.B enable_ipv4 
+.br
+.B enable_ipv6
+.br
+.SH SEE ALSO
+cgproxyd(1), cgproxy(1), cgnoproxy(1)
+

pack/CMakeLists.txt

@@ -7,6 +7,7 @@ set(CPACK_PACKAGE_DESCRIPTION_SUMMARY "cgproxy will transparent proxy anything r
 set(CPACK_DEBIAN_PACKAGE_NAME "cgproxy")
 set(CPACK_DEBIAN_PACKAGE_ARCHITECTURE "x86_64")
 set(CPACK_DEBIAN_PACKAGE_DEPENDS "systemd")
+set(CPACK_DEBIAN_PACKAGE_SUGGESTS "python-bcc")
 set(CPACK_DEBIAN_PACKAGE_SECTION "network")
 set(CPACK_DEBIAN_PACKAGE_PRIORITY "Optional")
 set(CPACK_DEBIAN_PACKAGE_HOMEPAGE "https://github.com/springzfx/cgproxy")
@@ -16,6 +17,7 @@ set(CPACK_DEBIAN_PACKAGE_CONTROL_EXTRA "${CMAKE_CURRENT_SOURCE_DIR}/postinst;${C
 ## rpm pack
 set(CPACK_RPM_PACKAGE_ARCHITECTURE, "x86_64")
 set(CPACK_RPM_PACKAGE_REQUIRES "systemd")
+set(CPACK_RPM_PACKAGE_SUGGESTS "python-bcc")
 set(CPACK_RPM_PACKAGE_GROUP "network")
 set(CPACK_RPM_PACKAGE_URL "https://github.com/springzfx/cgproxy")
 set(CPACK_RPM_POST_INSTALL_SCRIPT_FILE "${CMAKE_CURRENT_SOURCE_DIR}/postinst")

readme.md

@@ -1,16 +1,22 @@
 
 
-# Transparent Proxy with cgroup v2
+# Transparent Proxy powered with cgroup v2
 
 
 
 ## Introduction
 
-cgproxy will transparent proxy anything running in specific cgroup. It resembles with *proxychains* and *tsock*, but without their disadvantages, and more powerfull.
+cgproxy will transparent proxy anything running in specific cgroup. It resembles with *proxychains* and *tsock*s in default setting. 
 
-It aslo supports global transparent proxy and gateway proxy. See [Global transparent proxy](#global-transparent-proxy) and  [Gateway proxy](#gateway-proxy).
+Main feature:
+
+- supports cgroup/program level proxy control. 
+- supports global transparent proxy and gateway proxy. 
+
+## Contents
 
 <!--ts-->
+
    * [Transparent Proxy with cgroup v2](#transparent-proxy-with-cgroup-v2)
       * [Introduction](#introduction)
       * [Prerequest](#prerequest)
@@ -40,6 +46,12 @@ It aslo supports global transparent proxy and gateway proxy. See [Global transpa
 
   A process listening on port (e.g.  12345)  to accept iptables TPROXY, for example v2ray's dokodemo-door in tproxy mode.
 
+- Iptables
+
+  Iptables version should be at least 1.6.0, run `iptables --version` to check.
+
+  ubuntu 16.04, debian 9, fedora 27 and later are desired
+
 ## How to install
 
 ```bash
@@ -81,28 +93,51 @@ Config file: **/etc/cgproxy/config.json**
 
 ```json
 {
+    "port": 12345,
+    "program_noproxy": ["v2ray", "qv2ray"],
+    "program_proxy": [ ],
     "cgroup_noproxy": ["/system.slice/v2ray.service"],
-    "cgroup_proxy": [],
-    "enable_dns": true,
+    "cgroup_proxy": [ ],
     "enable_gateway": false,
-    "enable_ipv4": true,
-    "enable_ipv6": true,
-    "enable_tcp": true,
+    "enable_dns": true,
     "enable_udp": true,
-    "port": 12345
+    "enable_tcp": true,
+    "enable_ipv4": true,
+    "enable_ipv6": true
 }
 ```
 
 - **port** tproxy listenning port
-- **cgroup_noproxy** cgroup array that no need to proxy, `/noproxy.slice` is preserved
-- **cgroup_proxy** cgroup array that need to proxy, `/proxy.slice` is preserved
+
+- program level proxy control, need `python-bcc` installed to work
+
+  - **program_proxy**  program need to be proxied
+  - **program_noproxy** program that won't be proxied
+
+- cgroup level proxy control:
+
+  - **cgroup_noproxy** cgroup array that no need to proxy, `/noproxy.slice` is preserved
+  - **cgroup_proxy** cgroup array that need to proxy, `/proxy.slice` is preserved
+
 - **enable_gateway** enable gateway proxy for local devices
+
 - **enable_dns** enable dns to go to proxy
+
 - **enable_tcp**
+
 - **enable_udp**
+
 - **enable_ipv4**
+
 - **enable_ipv6**
 
+- options priority
+
+  ```
+  program_noproxy > program_proxy > cgroup_noproxy > cgroup_proxy
+  enable_ipv6 > enable_ipv4 > enable_tcp > enable_udp > enable_dns
+  ```
+
 **Note**: cgroup in configuration need to be exist, otherwise ignored
 
 If you changed config, remember to restart service
@@ -123,8 +158,10 @@ sudo systemctl restart cgproxy.service
     
     example: `cgnoproxy qv2ray`
     
-  - passive way,  set it's cgroup in configuration,  very useful for service
+  - passive way,  persistent config
   
+      example:  `"program_noproxy":["v2ray" ,"qv2ray"]`
+      
       example:  `"cgroup_noproxy":["/system.slice/v2ray.service"]`
   
 - Finally, restart cgproxy service, that's all
@@ -140,16 +177,21 @@ sudo systemctl restart cgproxy.service
 - `cgnoproxy` run program wihout proxy, very useful in global transparent proxy
 
   ```bash
-  cgnoproxy [--debug] <CMD> 
+  cgnoproxy [--debug] <CMD>
+  cgnoproxy [--debug] --pid <PID>
   ```
   
-- `cgattach` attach specific process pid to specific cgroup which will create if not exist , cgroup can be only one level down exist cgroup, otherwise created fail.
+- `cgattach` attach specific process pid to specific cgroup which will create if not exist , cgroup can be only one level down exist cgroup, otherwise created fail. 
 
+  You need to set `set(build_tools ON)` in *CmakeLists.txt* to build this.
+  
   ```bash
   cgattch <pid> <cgroup>
   # example
   cgattch 9999 /proxy.slice
   ```
+  
+- For more detail command usage, see `man cgproxyd`  `man cgproxy`  `man cgnoproxy` 
 
 ## NOTES
 

src/CMakeLists.txt

@@ -3,10 +3,17 @@ find_package(nlohmann_json REQUIRED)
 include_directories(${PROJECT_SOURCE_DIR})
 include_directories(${CMAKE_CURRENT_SOURCE_DIR})
 
-add_executable(cgproxyd cgproxyd.cpp)
-add_executable(cgproxy cgproxy.cpp)
-target_link_libraries(cgproxyd PRIVATE Threads::Threads nlohmann_json::nlohmann_json)
-target_link_libraries(cgproxy PRIVATE nlohmann_json::nlohmann_json)
+if (with_execsnoop)
+add_library(execsnoop MODULE execsnoop.cpp common.cpp)
+target_link_libraries(execsnoop bcc)
+install(TARGETS execsnoop DESTINATION /usr/lib/cgproxy/ PERMISSIONS ${basic_permission})
+endif()
 
-install(TARGETS cgproxyd  DESTINATION /usr/bin PERMISSIONS ${basic_permission})
-install(TARGETS cgproxy   DESTINATION /usr/bin PERMISSIONS ${basic_permission})
+add_executable(main main.cpp
+                    common.cpp config.cpp cgroup_attach.cpp
+                    socket_client.cpp socket_server.cpp)
+target_link_libraries(main PRIVATE nlohmann_json::nlohmann_json Threads::Threads dl)
+set_target_properties(main PROPERTIES LINKER_LANGUAGE CXX)
+set_target_properties(main PROPERTIES OUTPUT_NAME cgproxy)
+
+install(TARGETS main DESTINATION /usr/bin PERMISSIONS ${basic_permission})

src/cgproxy.cpp

@@ -1,49 +0,0 @@
-#include "common.hpp"
-#include "socket_client.hpp"
-#include <nlohmann/json.hpp>
-using json = nlohmann::json;
-using namespace CGPROXY;
-
-bool print_help = false, proxy = true;
-void print_usage() {
-  fprintf(stdout, "Usage: cgproxy [--help] [--debug] [--noproxy] <CMD>\n");
-  fprintf(stdout, "Alias: cgnoproxy = cgproxy --noproxy\n");
-}
-
-void processArgs(const int argc, char *argv[], int &shift) {
-  for (int i = 1; i < argc; i++) {
-    if (strcmp(argv[i], "--noproxy") == 0) { proxy = false; }
-    if (strcmp(argv[i], "--debug") == 0) { enable_debug = true; }
-    if (strcmp(argv[i], "--help") == 0) { print_help = true; }
-    if (argv[i][0] != '-') { break; }
-    shift += 1;
-  }
-}
-
-bool attach2cgroup(pid_t pid, bool proxy) {
-  json j;
-  j["type"] = proxy ? MSG_TYPE_PROXY_PID : MSG_TYPE_NOPROXY_PID;
-  j["data"] = pid;
-  int status;
-  SOCKET::send(j.dump(), status);
-  return status == 0;
-}
-
-int main(int argc, char *argv[]) {
-  int shift = 1;
-  processArgs(argc, argv, shift);
-
-  if (argc == shift || print_help) {
-    print_usage();
-    exit(0);
-  }
-
-  pid_t pid = getpid();
-  if (!attach2cgroup(pid, proxy)) {
-    error("attach process failed");
-    exit(EXIT_FAILURE);
-  }
-
-  string s = join2str(argc - shift, argv + shift, ' ');
-  return system(s.c_str());
-}

src/cgproxy.hpp

@@ -0,0 +1,84 @@
+#include "common.h"
+#include "config.h"
+#include "socket_client.h"
+#include <cstdlib>
+#include <nlohmann/json.hpp>
+#include <unistd.h>
+using json = nlohmann::json;
+using namespace CGPROXY;
+using namespace CGPROXY::CONFIG;
+
+namespace CGPROXY::CGPROXY {
+
+bool print_help = false, proxy = true;
+bool attach_pid = false;
+string arg_pid;
+inline void print_usage() {
+  if (proxy) {
+    cout << "Run program with proxy" << endl;
+    cout << "Usage: cgproxy [--help] [--debug] <CMD>" << endl;
+  } else {
+    cout << "Run program without proxy" << endl;
+    cout << "Usage: cgpnoroxy [--help] [--debug] <CMD>" << endl;
+    cout << "Alias: cgnoproxy = cgproxy --noproxy" << endl;
+  }
+}
+
+bool processArgs(const int argc, char *argv[], int &shift) {
+  int i;
+  for (i = 1; i < argc; i++) {
+    if (strcmp(argv[i], "--pid") == 0) {
+      attach_pid = true;
+      i++;
+      if (i == argc) return false;
+      arg_pid = argv[i];
+      if (!validPid(arg_pid)) return false;
+      continue;
+    }
+    if (strcmp(argv[i], "--noproxy") == 0) { proxy = false; }
+    if (strcmp(argv[i], "--debug") == 0) { enable_debug = true; }
+    if (strcmp(argv[i], "--help") == 0) { print_help = true; }
+    if (argv[i][0] != '-') { break; }
+  }
+  shift = i;
+  return true;
+}
+
+void send_pid(const pid_t pid, bool proxy, int &status) {
+  json j;
+  j["type"] = proxy ? MSG_TYPE_PROXY_PID : MSG_TYPE_NOPROXY_PID;
+  j["data"] = pid;
+  SOCKET::send(j.dump(), status);
+}
+
+int main(int argc, char *argv[]) {
+  int shift = -1;
+  if (!processArgs(argc, argv, shift)) {
+    error("parameter error");
+    exit(EXIT_FAILURE);
+  }
+
+  if (print_help) {
+    print_usage();
+    exit(0);
+  }
+
+  if (!attach_pid && argc == shift) {
+    error("no program specified");
+    exit(EXIT_FAILURE);
+  }
+
+  int status = -1;
+  send_pid(attach_pid ? stoi(arg_pid) : getpid(), proxy, status);
+  if (status != 0) {
+    error("attach process failed");
+    if (status == 1) error("maybe cgproxy.service not running");
+    exit(EXIT_FAILURE);
+  }
+  // if just attach pid, return here
+  if (attach_pid) return 0;
+
+  string s = join2str(argc - shift, argv + shift, ' ');
+  return system(s.c_str());
+}
+} // namespace CGPROXY::CGPROXY

src/cgproxyd.cpp

@@ -1,184 +0,0 @@
-#include "cgroup_attach.hpp"
-#include "common.hpp"
-#include "config.hpp"
-#include "socket_server.hpp"
-#include <csignal>
-#include <errno.h>
-#include <fstream>
-#include <iostream>
-#include <nlohmann/json.hpp>
-#include <pthread.h>
-#include <sstream>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string>
-#include <sys/file.h>
-
-using namespace std;
-using json = nlohmann::json;
-using namespace CGPROXY::SOCKET;
-using namespace CGPROXY::CONFIG;
-using namespace CGPROXY::CGROUP;
-
-namespace CGPROXY {
-
-class cgproxyd {
-  thread_arg arg_t;
-  Config config;
-  pthread_t socket_thread_id = -1;
-
-  static cgproxyd *instance;
-  static int handle_msg_static(char *msg) {
-    if (!instance) {
-      error("no cgproxyd instance assigned");
-      return ERROR;
-    }
-    return instance->handle_msg(msg);
-  }
-
-  static void signalHandler(int signum) {
-    debug("Signal %d received.", signum);
-    if (!instance) {
-      error("no cgproxyd instance assigned");
-    } else {
-      instance->stop();
-    }
-    exit(signum);
-  }
-
-  // single process instance
-  int lock_fd;
-  void lock() {
-    lock_fd = open(PID_LOCK_FILE, O_CREAT | O_RDWR, 0666);
-    int rc = flock(lock_fd, LOCK_EX | LOCK_NB);
-    if (rc == -1) {
-      perror(PID_LOCK_FILE);
-      error("maybe another cgproxyd is running");
-      exit(EXIT_FAILURE);
-    } else {
-      ofstream ofs(PID_LOCK_FILE);
-      ofs << getpid() << endl;
-      ofs.close();
-    }
-  }
-  void unlock() {
-    close(lock_fd);
-    unlink(PID_LOCK_FILE);
-  }
-
-  int handle_msg(char *msg) {
-    debug("received msg: %s", msg);
-    json j;
-    try {
-      j = json::parse(msg);
-    } catch (exception &e) {
-      debug("msg paser error");
-      return MSG_ERROR;
-    }
-
-    int type, status;
-    int pid, cgroup_target;
-    try {
-      type = j.at("type").get<int>();
-      switch (type) {
-      case MSG_TYPE_JSON:
-        status = config.loadFromJson(j.at("data"));
-        if (status == SUCCESS) status = applyConfig(&config);
-        return status;
-        break;
-      case MSG_TYPE_CONFIG_PATH:
-        status = config.loadFromFile(j.at("data").get<string>());
-        if (status == SUCCESS) status = applyConfig(&config);
-        return status;
-        break;
-      case MSG_TYPE_PROXY_PID:
-        pid = j.at("data").get<int>();
-        status = attach(pid, config.cgroup_proxy_preserved);
-        return status;
-        break;
-      case MSG_TYPE_NOPROXY_PID:
-        pid = j.at("data").get<int>();
-        status = attach(pid, config.cgroup_noproxy_preserved);
-        return status;
-        break;
-      default: return MSG_ERROR; break;
-      };
-    } catch (out_of_range &e) { return MSG_ERROR; } catch (exception &e) {
-      return ERROR;
-    }
-  }
-
-  pthread_t startSocketListeningThread() {
-    arg_t.handle_msg = &handle_msg_static;
-    pthread_t thread_id;
-    int status = pthread_create(&thread_id, NULL, &SocketServer::startThread, &arg_t);
-    if (status != 0) error("socket thread create failed");
-    return thread_id;
-  }
-
-  void assignStaticInstance() { instance = this; }
-
-public:
-  int start() {
-    lock();
-    signal(SIGINT, &signalHandler);
-    signal(SIGTERM, &signalHandler);
-    signal(SIGHUP, &signalHandler);
-
-    config.loadFromFile(DEFAULT_CONFIG_FILE);
-    applyConfig(&config);
-
-    assignStaticInstance();
-    socket_thread_id = startSocketListeningThread();
-    pthread_join(socket_thread_id, NULL);
-    return 0;
-  }
-  int applyConfig(Config *c) {
-    system(TPROXY_IPTABLS_CLEAN);
-    c->toEnv();
-    system(TPROXY_IPTABLS_START);
-    // no need to track running status
-    return 0;
-  }
-
-  void stop() {
-    debug("stopping");
-    system(TPROXY_IPTABLS_CLEAN);
-    unlock();
-  }
-
-  ~cgproxyd() { stop(); }
-};
-
-cgproxyd *cgproxyd::instance = NULL;
-
-} // namespace CGPROXY
-
-bool print_help = false;
-
-void print_usage() { printf("cgproxyd [--help] [--debug]\n"); }
-
-void processArgs(const int argc, char *argv[]) {
-  for (int i = 1; i < argc; i++) {
-    if (strcmp(argv[i], "--debug") == 0) { enable_debug = true; }
-    if (strcmp(argv[i], "--help") == 0) { print_help = true; }
-    if (argv[i][0] != '-') { break; }
-  }
-}
-
-int main(int argc, char *argv[]) {
-  processArgs(argc, argv);
-  if (print_help) {
-    print_usage();
-    exit(0);
-  }
-
-  if (getuid() != 0) {
-    error("permission denied, need root");
-    print_usage();
-    exit(EXIT_FAILURE);
-  }
-
-  CGPROXY::cgproxyd d;
-  return d.start();
-}

src/cgproxyd.hpp

@@ -0,0 +1,305 @@
+#ifndef CGPROXYD_HPP
+#define CGPROXYD_HPP
+
+#include "cgroup_attach.h"
+#include "common.h"
+#include "config.h"
+#include "execsnoop.h"
+#include "socket_server.h"
+#include <algorithm>
+#include <csignal>
+#include <cstdlib>
+#include <dlfcn.h>
+#include <exception>
+#include <fstream>
+#include <functional>
+#include <nlohmann/json.hpp>
+#include <pthread.h>
+#include <sched.h>
+#include <sys/file.h>
+#include <unistd.h>
+
+using namespace std;
+using json = nlohmann::json;
+using namespace ::CGPROXY::SOCKET;
+using namespace ::CGPROXY::CONFIG;
+using namespace ::CGPROXY::CGROUP;
+// using namespace ::CGPROXY::EXECSNOOP;
+
+namespace CGPROXY::EXECSNOOP {
+typedef void *(*startThread_t)(void *arg);
+startThread_t _startThread;
+bool loadExecsnoopLib() {
+  try {
+    info("loading %s", LIBEXECSNOOP_SO);
+    void *handle_dl = dlopen(LIBEXECSNOOP_SO, RTLD_NOW);
+    if (handle_dl == NULL) {
+      error("dlopen %s failed: %s", LIBEXECSNOOP_SO, dlerror());
+      return false;
+    }
+    _startThread = reinterpret_cast<startThread_t>(dlsym(handle_dl, "_startThread"));
+    if (_startThread == NULL) {
+      error("dlsym startThread failed: %s", dlerror());
+      return false;
+    }
+    info("dlsym startThread success");
+    return true;
+  } catch (exception &e) { return false; }
+}
+} // namespace CGPROXY::EXECSNOOP
+
+namespace CGPROXY::CGPROXYD {
+
+bool print_help = false;
+bool enable_socketserver = true;
+bool enable_execsnoop = false;
+
+class cgproxyd {
+  SOCKET::thread_arg socketserver_thread_arg;
+  pthread_t socket_thread_id = THREAD_UNDEF;
+
+  EXECSNOOP::thread_arg execsnoop_thread_arg;
+  pthread_t execsnoop_thread_id = THREAD_UNDEF;
+
+  Config config;
+
+  static cgproxyd *instance;
+  static int handle_msg_static(char *msg) {
+    if (!instance) {
+      error("no cgproxyd instance assigned");
+      return ERROR;
+    }
+    return instance->handle_msg(msg);
+  }
+
+  static int handle_pid_static(int pid) {
+    if (!instance) {
+      error("no cgproxyd instance assigned");
+      return ERROR;
+    }
+    return instance->handle_pid(pid);
+  }
+
+  int handle_pid(int pid) {
+    auto path = realpath(to_str("/proc/", pid, "/exe").c_str(), NULL);
+    if (path == NULL) {
+      debug("pid %d live life too short", pid);
+      return 0;
+    }
+    debug("execsnoop: %d %s", pid, path);
+
+    vector<string> v;
+
+    v = config.program_noproxy;
+    if (find(v.begin(), v.end(), path) != v.end()) {
+      info("execsnoop noproxy: %d %s", pid, path);
+      free(path);
+      return attach(pid, config.cgroup_noproxy_preserved);
+    }
+    v = config.program_proxy;
+    if (find(v.begin(), v.end(), path) != v.end()) {
+      info("execsnoop proxied: %d %s", pid, path);
+      free(path);
+      return attach(pid, config.cgroup_proxy_preserved);
+    }
+    free(path);
+    return 0;
+  }
+
+  static void signalHandler(int signum) {
+    debug("Signal %d received.", signum);
+    if (!instance) {
+      error("no cgproxyd instance assigned");
+    } else {
+      instance->stop();
+    }
+    exit(0);
+  }
+
+  // single process instance
+  int lock_fd;
+  void lock() {
+    lock_fd = open(PID_LOCK_FILE, O_CREAT | O_RDWR, 0666);
+    int rc = flock(lock_fd, LOCK_EX | LOCK_NB);
+    if (rc == -1) {
+      perror(PID_LOCK_FILE);
+      error("maybe another cgproxyd is running");
+      exit(EXIT_FAILURE);
+    } else {
+      ofstream ofs(PID_LOCK_FILE);
+      ofs << getpid() << endl;
+      ofs.close();
+    }
+  }
+  void unlock() {
+    close(lock_fd);
+    unlink(PID_LOCK_FILE);
+  }
+
+  int handle_msg(char *msg) {
+    debug("received msg: %s", msg);
+    json j;
+    try {
+      j = json::parse(msg);
+    } catch (exception &e) {
+      debug("msg paser error");
+      return MSG_ERROR;
+    }
+
+    int type, status;
+    int pid, cgroup_target;
+    try {
+      type = j.at("type").get<int>();
+      switch (type) {
+      case MSG_TYPE_CONFIG_JSON:
+        status = config.loadFromJsonStr(j.at("data").dump());
+        if (status == SUCCESS) status = applyConfig();
+        return status;
+        break;
+      case MSG_TYPE_CONFIG_PATH:
+        status = config.loadFromFile(j.at("data").get<string>());
+        if (status == SUCCESS) status = applyConfig();
+        return status;
+        break;
+      case MSG_TYPE_PROXY_PID:
+        pid = j.at("data").get<int>();
+        status = attach(pid, config.cgroup_proxy_preserved);
+        return status;
+        break;
+      case MSG_TYPE_NOPROXY_PID:
+        pid = j.at("data").get<int>();
+        status = attach(pid, config.cgroup_noproxy_preserved);
+        return status;
+        break;
+      default: return MSG_ERROR; break;
+      };
+    } catch (out_of_range &e) { return MSG_ERROR; } catch (exception &e) {
+      return ERROR;
+    }
+  }
+
+  pthread_t startSocketListeningThread() {
+    socketserver_thread_arg.handle_msg = &handle_msg_static;
+    pthread_t thread_id;
+    int status =
+        pthread_create(&thread_id, NULL, &SOCKET::startThread, &socketserver_thread_arg);
+    if (status != 0) {
+      error("socket thread create failed");
+      return THREAD_UNDEF;
+    }
+    return thread_id;
+  }
+
+  pthread_t startExecsnoopThread() {
+    if (!EXECSNOOP::loadExecsnoopLib() || EXECSNOOP::_startThread == NULL) {
+      error("execsnoop start failed, maybe bcc not installed");
+      return THREAD_UNDEF;
+    }
+
+    execsnoop_thread_arg.handle_pid = &handle_pid_static;
+    pthread_t thread_id;
+    int status =
+        pthread_create(&thread_id, NULL, EXECSNOOP::_startThread, &execsnoop_thread_arg);
+    if (status != 0) {
+      error("execsnoop thread create failed");
+      return THREAD_UNDEF;
+    }
+    return thread_id;
+  }
+
+  void processRunningProgram() {
+    debug("process running program") for (auto &path :
+                                          config.program_noproxy) for (auto &pid :
+                                                                       bash_pidof(path)) {
+      int status = attach(pid, config.cgroup_noproxy_preserved);
+      if (status == 0) info("noproxy running process %d %s", pid, path.c_str());
+    }
+    for (auto &path : config.program_proxy)
+      for (auto &pid : bash_pidof(path)) {
+        int status = attach(pid, config.cgroup_proxy_preserved);
+        if (status == 0) info("proxied running process %d %s", pid, path.c_str());
+      }
+  }
+
+  void assignStaticInstance() { instance = this; }
+
+public:
+  int start() {
+    lock();
+    signal(SIGINT, &signalHandler);
+    signal(SIGTERM, &signalHandler);
+    signal(SIGHUP, &signalHandler);
+
+    assignStaticInstance();
+
+    config.loadFromFile(DEFAULT_CONFIG_FILE);
+    applyConfig();
+    processRunningProgram();
+
+    if (enable_socketserver) {
+      socket_thread_id = startSocketListeningThread();
+      if (socket_thread_id > 0) info("socket server listening thread started");
+    }
+    if (enable_execsnoop) {
+      execsnoop_thread_id = startExecsnoopThread();
+      if (execsnoop_thread_id > 0) info("execsnoop thread started");
+    }
+    cout << flush;
+
+    pthread_join(socket_thread_id, NULL);
+    pthread_join(execsnoop_thread_id, NULL);
+    return 0;
+  }
+  int applyConfig() {
+    system(TPROXY_IPTABLS_CLEAN);
+    config.print_summary();
+    config.toEnv();
+    system(TPROXY_IPTABLS_START);
+    // no need to track running status
+    return 0;
+  }
+
+  void stop() {
+    debug("stopping");
+    system(TPROXY_IPTABLS_CLEAN);
+    unlock();
+  }
+
+  ~cgproxyd() { stop(); }
+};
+
+cgproxyd *cgproxyd::instance = NULL;
+
+void print_usage() {
+  cout << "Start a daemon with unix socket to accept control" << endl;
+  cout << "Usage: cgproxyd [--help] [--debug]" << endl;
+  cout << "Alias: cgproxyd = cgproxy --daemon" << endl;
+}
+
+void processArgs(const int argc, char *argv[]) {
+  for (int i = 1; i < argc; i++) {
+    if (strcmp(argv[i], "--debug") == 0) { enable_debug = true; }
+    if (strcmp(argv[i], "--help") == 0) { print_help = true; }
+    if (strcmp(argv[i], "--execsnoop") == 0) { enable_execsnoop = true; }
+    if (argv[i][0] != '-') { break; }
+  }
+}
+
+int main(int argc, char *argv[]) {
+  setbuf(stdout, NULL);
+  processArgs(argc, argv);
+  if (print_help) {
+    print_usage();
+    exit(0);
+  }
+
+  if (getuid() != 0) {
+    error("permission denied, need root");
+    exit(EXIT_FAILURE);
+  }
+
+  cgproxyd d;
+  return d.start();
+}
+} // namespace CGPROXY::CGPROXYD
+#endif

src/cgroup_attach.cpp

@@ -1,7 +1,5 @@
-#ifndef CGPROUP_ATTACH_H
-#define CGPROUP_ATTACH_H
-
-#include "common.hpp"
+#include "cgroup_attach.h"
+#include "common.h"
 #include <errno.h>
 #include <fstream>
 #include <iostream>
@@ -12,52 +10,50 @@
 #include <sys/stat.h>
 #include <sys/types.h>
 #include <unistd.h>
-using namespace std;
 
 namespace CGPROXY::CGROUP {
 
+string cgroup2_mount_point = get_cgroup2_mount_point();
+
 bool exist(string path) {
   struct stat st;
   if (stat(path.c_str(), &st) != -1) { return S_ISDIR(st.st_mode); }
   return false;
 }
 
+string get_cgroup2_mount_point() {
+  stringstream buffer;
+  FILE *fp = popen("findmnt -t cgroup2 -n -o TARGET", "r");
+  if (!fp) return "";
+  char buf[64];
+  while (fgets(buf, 64, fp) != NULL) { buffer << buf; }
+  pclose(fp);
+  string s = buffer.str();
+  s.pop_back(); // remove newline character
+  return s;
+}
+
 bool validate(string pid, string cgroup) {
   bool pid_v = validPid(pid);
   bool cg_v = validCgroup(cgroup);
   if (pid_v && cg_v) return true;
 
   error("attach paramater validate error");
-  return_error
-}
-
-string get_cgroup2_mount_point(int &status) {
-  char cgroup2_mount_point[100] = "";
-  FILE *fp = popen("findmnt -t cgroup2 -n -o TARGET", "r");
-  int count = fscanf(fp, "%s", cgroup2_mount_point);
-  fclose(fp);
-  if (count == 0) {
-    error("cgroup2 not supported");
-    status = -1;
-    return NULL;
-  }
-  status = 0;
-  return cgroup2_mount_point;
+  return_error;
 }
 
 int attach(const string pid, const string cgroup_target) {
   if (getuid() != 0) {
     error("need root to attach cgroup");
-    return_error
+    return_error;
   }
 
   debug("attaching %s to %s", pid.c_str(), cgroup_target.c_str());
 
   int status;
-  if (!validate(pid, cgroup_target))
-    return_error string cgroup_mount_point = get_cgroup2_mount_point(status);
-  if (status != 0)
-    return_error string cgroup_target_path = cgroup_mount_point + cgroup_target;
+  if (!validate(pid, cgroup_target)) return_error;
+  if (cgroup2_mount_point.empty()) return_error;
+  string cgroup_target_path = cgroup2_mount_point + cgroup_target;
   string cgroup_target_procs = cgroup_target_path + "/cgroup.procs";
 
   // check if exist, we will create it if not exist
@@ -67,7 +63,7 @@ int attach(const string pid, const string cgroup_target) {
       debug("created cgroup %s success", cgroup_target.c_str());
     } else {
       error("created cgroup %s failed, errno %d", cgroup_target.c_str(), errno);
-      return_error
+      return_error;
     }
     // error("cgroup %s not exist",cgroup_target.c_str());
     // return_error
@@ -77,7 +73,7 @@ int attach(const string pid, const string cgroup_target) {
   ofstream procs(cgroup_target_procs, ofstream::app);
   if (!procs.is_open()) {
     error("open file %s failed", cgroup_target_procs.c_str());
-    return_error
+    return_error;
   }
   procs << pid.c_str() << endl;
   procs.close();
@@ -86,15 +82,13 @@ int attach(const string pid, const string cgroup_target) {
   if (!procs) {
     error("write %s to %s failed, maybe process %s not exist", pid.c_str(),
           cgroup_target_procs.c_str(), pid.c_str());
-    return_error
+    return_error;
   }
-  return_success
+  return_success;
 }
 
 int attach(const int pid, const string cgroup_target) {
   return attach(to_str(pid), cgroup_target);
 }
 
-} // namespace CGPROXY::CGROUP
-
-#endif
+} // namespace CGPROXY::CGROUP

src/cgroup_attach.h

@@ -0,0 +1,18 @@
+#ifndef CGPROUP_ATTACH_H
+#define CGPROUP_ATTACH_H
+
+#include <stdlib.h>
+#include <string>
+using namespace std;
+
+namespace CGPROXY::CGROUP {
+extern string cgroup2_mount_point;
+bool exist(string path);
+bool validate(string pid, string cgroup);
+string get_cgroup2_mount_point();
+int attach(const string pid, const string cgroup_target);
+int attach(const int pid, const string cgroup_target);
+
+} // namespace CGPROXY::CGROUP
+
+#endif

src/common.cpp

@@ -0,0 +1,95 @@
+#include "common.h"
+#include <fstream>
+#include <limits.h>
+#include <linux/limits.h>
+#include <regex>
+#include <sys/stat.h>
+#include <unistd.h>
+
+bool enable_debug = false;
+bool enable_info = true;
+
+string join2str(const vector<string> t, const char delm) {
+  string s;
+  for (const auto &e : t) e != *(t.end() - 1) ? s += e + delm : s += e;
+  return s;
+}
+
+string join2str(const int argc, char **argv, const char delm) {
+  string s;
+  for (int i = 0; i < argc; i++) {
+    s += argv[i];
+    if (i != argc - 1) s += delm;
+  }
+  return s;
+}
+
+bool validCgroup(const string cgroup) {
+  return regex_match(cgroup, regex("^/[a-zA-Z0-9\\-_./@]*$"));
+}
+
+bool validCgroup(const vector<string> cgroup) {
+  for (auto &e : cgroup) {
+    if (!regex_match(e, regex("^/[a-zA-Z0-9\\-_./@]*$"))) { return false; }
+  }
+  return true;
+}
+
+bool validPid(const string pid) { return regex_match(pid, regex("^[0-9]+$")); }
+
+bool validPort(const int port) { return port > 0; }
+
+bool fileExist(const string &path) {
+  struct stat st;
+  return (stat(path.c_str(), &st) == 0 && S_ISREG(st.st_mode));
+}
+
+bool dirExist(const string &path) {
+  struct stat st;
+  return (stat(path.c_str(), &st) == 0 && S_ISDIR(st.st_mode));
+}
+
+vector<int> bash_pidof(const string &path) {
+  vector<int> pids;
+  FILE *fp = popen(to_str("pidof ", path).c_str(), "r");
+  if (!fp) return pids;
+  int pid;
+  char buf[64];
+  while (fscanf(fp, "%d", &pid) != EOF) { pids.push_back(pid); }
+  pclose(fp);
+  return pids;
+}
+
+string bash_which(const string &name) {
+  stringstream buffer;
+  FILE *fp = popen(to_str("which ", name).c_str(), "r");
+  if (!fp) return "";
+  char buf[64];
+  while (fgets(buf, 64, fp) != NULL) { buffer << buf; }
+  pclose(fp);
+  string s = buffer.str();
+  s.pop_back(); // remove newline character
+  return s;
+}
+
+string bash_readlink(const string &path) {
+  stringstream buffer;
+  FILE *fp = popen(to_str("readlink -e ", path).c_str(), "r");
+  if (!fp) return "";
+  char buf[64];
+  while (fgets(buf, 64, fp) != NULL) { buffer << buf; }
+  pclose(fp);
+  string s = buffer.str();
+  s.pop_back(); // remove newline character
+  return s;
+}
+
+string getRealExistPath(const string &name) {
+  if (name[0] == '/' && fileExist(name)) return name;
+  string path;
+  path = bash_which(name);
+  if (path.empty()) return "";
+  path = bash_readlink(path);
+  if (!fileExist(path)) return "";
+  return path;
+}

src/common.h

@@ -1,9 +1,16 @@
 #ifndef COMMON_H
 #define COMMON_H 1
 
-#define TPROXY_IPTABLS_START "sh /usr/share/cgproxy/scripts/cgroup-tproxy.sh"
-#define TPROXY_IPTABLS_CLEAN "sh /usr/share/cgproxy/scripts/cgroup-tproxy.sh stop"
+#include <iostream>
+#include <sstream>
+#include <string>
+#include <vector>
+using namespace std;
 
+#define TPROXY_IPTABLS_START "/usr/share/cgproxy/scripts/cgroup-tproxy.sh"
+#define TPROXY_IPTABLS_CLEAN "/usr/share/cgproxy/scripts/cgroup-tproxy.sh stop"
+
+#define LIBEXECSNOOP_SO "/usr/lib/cgproxy/libexecsnoop.so"
 #define PID_LOCK_FILE "/var/run/cgproxyd.pid"
 #define SOCKET_PATH "/tmp/cgproxy_unix_socket"
 #define LISTEN_BACKLOG 64
@@ -12,7 +19,9 @@
 #define CGROUP_PROXY_PRESVERED "/proxy.slice"
 #define CGROUP_NOPROXY_PRESVERED "/noproxy.slice"
 
-#define MSG_TYPE_JSON 1
+#define THREAD_UNDEF 0
+
+#define MSG_TYPE_CONFIG_JSON 1
 #define MSG_TYPE_CONFIG_PATH 2
 #define MSG_TYPE_PROXY_PID 3
 #define MSG_TYPE_NOPROXY_PID 4
@@ -28,26 +37,32 @@
 #define CGROUP_ERROR 6
 #define FILE_ERROR 7
 
-#include <iostream>
-#include <regex>
-#include <sstream>
-#include <string>
-using namespace std;
-
-static bool enable_debug = false;
+extern bool enable_debug;
+extern bool enable_info;
 
 #define error(...)                                                                       \
   {                                                                                      \
+    fprintf(stderr, "error: ");                                                          \
     fprintf(stderr, __VA_ARGS__);                                                        \
     fprintf(stderr, "\n");                                                               \
   }
+
 #define debug(...)                                                                       \
   if (enable_debug) {                                                                    \
+    fprintf(stdout, "debug: ");                                                          \
     fprintf(stdout, __VA_ARGS__);                                                        \
     fprintf(stdout, "\n");                                                               \
   }
-#define return_error return -1;
-#define return_success return 0;
+
+#define info(...)                                                                        \
+  if (enable_info) {                                                                     \
+    fprintf(stdout, "info: ");                                                           \
+    fprintf(stdout, __VA_ARGS__);                                                        \
+    fprintf(stdout, "\n");                                                               \
+  }
+
+#define return_error return -1
+#define return_success return 0
 
 template <typename... T> string to_str(T... args) {
   stringstream ss;
@@ -57,34 +72,19 @@ template <typename... T> string to_str(T... args) {
   return ss.str();
 }
 
-string join2str(const vector<string> t, const char delm = ' ') {
-  string s;
-  for (const auto &e : t) e != *(t.end() - 1) ? s += e + delm : s += e;
-  return s;
-}
+string join2str(const vector<string> t, const char delm = ' ');
+string join2str(const int argc, char **argv, const char delm = ' ');
 
-string join2str(const int argc, char **argv, const char delm = ' ') {
-  string s;
-  for (int i = 0; i < argc; i++) {
-    s += argv[i];
-    if (i != argc - 1) s += delm;
-  }
-  return s;
-}
+bool validCgroup(const string cgroup);
+bool validCgroup(const vector<string> cgroup);
+bool validPid(const string pid);
+bool validPort(const int port);
 
-bool validCgroup(const string cgroup) {
-  return regex_match(cgroup, regex("^/[a-zA-Z0-9\\-_./@]*$"));
-}
-
-bool validCgroup(const vector<string> cgroup) {
-  for (auto &e : cgroup) {
-    if (!regex_match(e, regex("^/[a-zA-Z0-9\\-_./@]*$"))) { return false; }
-  }
-  return true;
-}
-
-bool validPid(const string pid) { return regex_match(pid, regex("^[0-9]+$")); }
-
-bool validPort(const int port) { return port > 0; }
+bool fileExist(const string &path);
+bool dirExist(const string &path);
+vector<int> bash_pidof(const string &path);
+string bash_which(const string &name);
+string bash_readlink(const string &path);
+string getRealExistPath(const string &name);
 
 #endif

src/config.cpp

@@ -0,0 +1,154 @@
+#include "config.h"
+#include "common.h"
+#include <fstream>
+#include <iomanip>
+#include <nlohmann/json.hpp>
+#include <set>
+#include <vector>
+using json = nlohmann::json;
+
+#define add2json(v) j[#v] = v;
+#define tryassign(v)                                                                     \
+  try {                                                                                  \
+    j.at(#v).get_to(v);                                                                  \
+  } catch (exception & e) {}
+#define merge(v)                                                                         \
+  {                                                                                      \
+    v.erase(std::remove(v.begin(), v.end(), v##_preserved), v.end());                    \
+    v.insert(v.begin(), v##_preserved);                                                  \
+  }
+
+namespace CGPROXY::CONFIG {
+
+void Config::toEnv() {
+  mergeReserved();
+  setenv("program_proxy", join2str(program_proxy, ':').c_str(), 1);
+  setenv("program_noproxy", join2str(program_noproxy, ':').c_str(), 1);
+  setenv("cgroup_proxy", join2str(cgroup_proxy, ':').c_str(), 1);
+  setenv("cgroup_noproxy", join2str(cgroup_noproxy, ':').c_str(), 1);
+  setenv("enable_gateway", to_str(enable_gateway).c_str(), 1);
+  setenv("port", to_str(port).c_str(), 1);
+  setenv("enable_dns", to_str(enable_dns).c_str(), 1);
+  setenv("enable_tcp", to_str(enable_tcp).c_str(), 1);
+  setenv("enable_udp", to_str(enable_udp).c_str(), 1);
+  setenv("enable_ipv4", to_str(enable_ipv4).c_str(), 1);
+  setenv("enable_ipv6", to_str(enable_ipv6).c_str(), 1);
+}
+
+int Config::saveToFile(const string f) {
+  ofstream o(f);
+  if (!o.is_open()) return FILE_ERROR;
+  string js = toJsonStr();
+  o << setw(4) << js << endl;
+  o.close();
+  return 0;
+}
+
+string Config::toJsonStr() {
+  json j;
+  add2json(program_proxy);
+  add2json(program_noproxy);
+  add2json(cgroup_proxy);
+  add2json(cgroup_noproxy);
+  add2json(enable_gateway);
+  add2json(port);
+  add2json(enable_dns);
+  add2json(enable_tcp);
+  add2json(enable_udp);
+  add2json(enable_ipv4);
+  add2json(enable_ipv6);
+  return j.dump();
+}
+
+int Config::loadFromFile(const string f) {
+  debug("loading config: %s", f.c_str());
+  ifstream ifs(f);
+  if (ifs.is_open()) {
+    string js = to_str(ifs.rdbuf());
+    ifs.close();
+    return loadFromJsonStr(js);
+  } else {
+    error("open failed: %s", f.c_str());
+    return FILE_ERROR;
+  }
+}
+
+int Config::loadFromJsonStr(const string js) {
+  if (!validateJsonStr(js)) {
+    error("json validate fail");
+    return PARAM_ERROR;
+  }
+  json j = json::parse(js);
+  tryassign(program_proxy);
+  tryassign(program_noproxy);
+  tryassign(cgroup_proxy);
+  tryassign(cgroup_noproxy);
+  tryassign(enable_gateway);
+  tryassign(port);
+  tryassign(enable_dns);
+  tryassign(enable_tcp);
+  tryassign(enable_udp);
+  tryassign(enable_ipv4);
+  tryassign(enable_ipv6);
+
+  // e.g. v2ray -> /usr/bin/v2ray -> /usr/lib/v2ray/v2ray
+  toRealProgramPath(program_noproxy);
+  toRealProgramPath(program_proxy);
+
+  return 0;
+}
+
+void Config::mergeReserved() {
+  merge(cgroup_proxy);
+  merge(cgroup_noproxy);
+}
+
+bool Config::validateJsonStr(const string js) {
+  json j = json::parse(js);
+  bool status = true;
+  const set<string> boolset = {"enable_gateway", "enable_dns",  "enable_tcp",
+                               "enable_udp",     "enable_ipv4", "enable_ipv6"};
+  const set<string> allowset = {"program_proxy", "program_noproxy"};
+  for (auto &[key, value] : j.items()) {
+    if (key == "cgroup_proxy" || key == "cgroup_noproxy") {
+      if (value.is_string() && !validCgroup((string)value)) status = false;
+      // TODO what if vector<int> etc.
+      if (value.is_array() && !validCgroup((vector<string>)value)) status = false;
+      if (!value.is_string() && !value.is_array()) status = false;
+    } else if (key == "port") {
+      if (!validPort(value)) status = false;
+    } else if (boolset.find(key) != boolset.end()) {
+      if (!value.is_boolean()) status = false;
+    } else if (allowset.find(key) != allowset.end()) {
+
+    } else {
+      error("unknown key: %s", key.c_str());
+      return false;
+    }
+    if (!status) {
+      error("invalid value for key: %s", key.c_str());
+      return false;
+    }
+  }
+  return true;
+}
+
+void Config::print_summary() {
+  info("noproxy program: %s", join2str(program_noproxy).c_str());
+  info("proxied program: %s", join2str(program_proxy).c_str());
+  info("noproxy cgroup: %s", join2str(cgroup_noproxy).c_str());
+  info("proxied cgroup: %s", join2str(cgroup_proxy).c_str());
+}
+
+void Config::toRealProgramPath(vector<string> &v) {
+  vector<string> tmp;
+  for (auto &p : v) {
+    auto rpath = getRealExistPath(p);
+    if (!rpath.empty()) tmp.push_back(rpath);
+    else
+      error("%s not exist or broken link", p.c_str());
+  }
+  v = tmp;
+}
+
+} // namespace CGPROXY::CONFIG

src/config.h

@@ -0,0 +1,42 @@
+#ifndef CONFIG_H
+#define CONFIG_H
+#include "common.h"
+#include <stdlib.h>
+#include <string>
+#include <vector>
+using namespace std;
+
+namespace CGPROXY::CONFIG {
+
+class Config {
+public:
+  const string cgroup_proxy_preserved = CGROUP_PROXY_PRESVERED;
+  const string cgroup_noproxy_preserved = CGROUP_NOPROXY_PRESVERED;
+
+  vector<string> program_proxy;
+  vector<string> program_noproxy;
+  vector<string> cgroup_proxy;
+  vector<string> cgroup_noproxy;
+  bool enable_gateway = false;
+  int port = 12345;
+  bool enable_dns = true;
+  bool enable_tcp = true;
+  bool enable_udp = true;
+  bool enable_ipv4 = true;
+  bool enable_ipv6 = true;
+
+  void toEnv();
+  int saveToFile(const string f);
+  string toJsonStr();
+  int loadFromFile(const string f);
+  int loadFromJsonStr(const string js);
+  void print_summary();
+
+private:
+  void mergeReserved();
+  bool validateJsonStr(const string js);
+  void toRealProgramPath(vector<string> &v);
+};
+
+} // namespace CGPROXY::CONFIG
+#endif

src/config.hpp

@@ -1,155 +0,0 @@
-#ifndef CONFIG_H
-#define CONFIG_H
-#include "common.hpp"
-#include <fstream>
-#include <iomanip>
-#include <iostream>
-#include <nlohmann/json.hpp>
-#include <set>
-#include <sstream>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string>
-#include <vector>
-using namespace std;
-using json = nlohmann::json;
-
-namespace CGPROXY::CONFIG {
-
-struct Config {
-public:
-  const string cgroup_proxy_preserved = CGROUP_PROXY_PRESVERED;
-  const string cgroup_noproxy_preserved = CGROUP_NOPROXY_PRESVERED;
-
-private:
-  vector<string> cgroup_proxy;
-  vector<string> cgroup_noproxy;
-  bool enable_gateway = false;
-  int port = 12345;
-  bool enable_dns = true;
-  bool enable_tcp = true;
-  bool enable_udp = true;
-  bool enable_ipv4 = true;
-  bool enable_ipv6 = true;
-
-public:
-  void toEnv() {
-    mergeReserved();
-    setenv("cgroup_proxy", join2str(cgroup_proxy, ':').c_str(), 1);
-    setenv("cgroup_noproxy", join2str(cgroup_noproxy, ':').c_str(), 1);
-    setenv("enable_gateway", to_str(enable_gateway).c_str(), 1);
-    setenv("port", to_str(port).c_str(), 1);
-    setenv("enable_dns", to_str(enable_dns).c_str(), 1);
-    setenv("enable_tcp", to_str(enable_tcp).c_str(), 1);
-    setenv("enable_udp", to_str(enable_udp).c_str(), 1);
-    setenv("enable_ipv4", to_str(enable_ipv4).c_str(), 1);
-    setenv("enable_ipv6", to_str(enable_ipv6).c_str(), 1);
-  }
-
-  int saveToFile(const string f) {
-    ofstream o(f);
-    if (!o.is_open()) return FILE_ERROR;
-    json j = toJson();
-    o << setw(4) << j << endl;
-    o.close();
-    return 0;
-  }
-
-#define add2json(v) j[#v] = v;
-  json toJson() {
-    json j;
-    add2json(cgroup_proxy);
-    add2json(cgroup_noproxy);
-    add2json(enable_gateway);
-    add2json(port);
-    add2json(enable_dns);
-    add2json(enable_tcp);
-    add2json(enable_udp);
-    add2json(enable_ipv4);
-    add2json(enable_ipv6);
-    return j;
-  }
-#undef add2json
-
-  int loadFromFile(const string f) {
-    debug("loading config: %s", f.c_str());
-    ifstream ifs(f);
-    if (ifs.is_open()) {
-      json j;
-      try {
-        ifs >> j;
-      } catch (exception &e) {
-        error("parse error: %s", f.c_str());
-        ifs.close();
-        return PARSE_ERROR;
-      }
-      ifs.close();
-      return loadFromJson(j);
-    } else {
-      error("open failed: %s", f.c_str());
-      return FILE_ERROR;
-    }
-  }
-
-#define tryassign(v)                                                                     \
-  try {                                                                                  \
-    j.at(#v).get_to(v);                                                                  \
-  } catch (exception & e) {}
-  int loadFromJson(const json &j) {
-    if (!validateJson(j)) {
-      error("json validate fail");
-      return PARAM_ERROR;
-    }
-    tryassign(cgroup_proxy);
-    tryassign(cgroup_noproxy);
-    tryassign(enable_gateway);
-    tryassign(port);
-    tryassign(enable_dns);
-    tryassign(enable_tcp);
-    tryassign(enable_udp);
-    tryassign(enable_ipv4);
-    tryassign(enable_ipv6);
-    return 0;
-  }
-#undef assign
-
-#define merge(v)                                                                         \
-  {                                                                                      \
-    v.erase(std::remove(v.begin(), v.end(), v##_preserved), v.end());                    \
-    v.insert(v.begin(), v##_preserved);                                                  \
-  }
-  void mergeReserved() {
-    merge(cgroup_proxy);
-    merge(cgroup_noproxy);
-  }
-#undef merge
-
-  bool validateJson(const json &j) {
-    bool status = true;
-    const set<string> boolset = {"enable_gateway", "enable_dns",  "enable_tcp",
-                                 "enable_udp",     "enable_ipv4", "enable_ipv6"};
-    for (auto &[key, value] : j.items()) {
-      if (key == "cgroup_proxy" || key == "cgroup_noproxy") {
-        if (value.is_string() && !validCgroup((string)value)) status = false;
-        // TODO what if vector<int> etc.
-        if (value.is_array() && !validCgroup((vector<string>)value)) status = false;
-        if (!value.is_string() && !value.is_array()) status = false;
-      } else if (key == "port") {
-        if (!validPort(value)) status = false;
-      } else if (boolset.find(key) != boolset.end()) {
-        if (!value.is_boolean()) status = false;
-      } else {
-        error("unknown key: %s", key.c_str());
-        return false;
-      }
-      if (!status) {
-        error("invalid value for key: %s", key.c_str());
-        return false;
-      }
-    }
-    return true;
-  }
-};
-
-} // namespace CGPROXY::CONFIG
-#endif

src/execsnoop.cpp

@@ -0,0 +1,102 @@
+#include "execsnoop.h"
+#include "bcc/BPF.h"
+#include "common.h"
+#include <bcc/libbpf.h>
+#include <fstream>
+#include <functional>
+#include <iostream>
+#include <string>
+#include <unistd.h>
+using namespace std;
+
+namespace CGPROXY::EXECSNOOP {
+
+const string BPF_PROGRAM = R"(
+#include <linux/fs.h>
+#include <linux/sched.h>
+#include <uapi/linux/ptrace.h>
+
+struct data_t {
+    int pid;
+};
+
+BPF_PERF_OUTPUT(events);
+
+int syscall_execve(struct pt_regs *ctx,
+    const char __user *filename,
+    const char __user *const __user *__argv,
+    const char __user *const __user *__envp)
+{
+    struct data_t data = {};
+    data.pid = bpf_get_current_pid_tgid();
+    events.perf_submit(ctx, &data, sizeof(struct data_t));
+    return 0;
+}
+
+int ret_syscall_execve(struct pt_regs *ctx){
+    struct data_t data = {};
+    data.pid = bpf_get_current_pid_tgid();
+    int retval = PT_REGS_RC(ctx);
+    if (retval==0)
+      events.perf_submit(ctx, &data, sizeof(struct data_t));
+    return 0;
+}
+)";
+
+struct data_t {
+  int pid;
+};
+
+function<int(int)> callback = NULL;
+
+void handle_events(void *cb_cookie, void *data, int data_size) {
+  auto event = static_cast<data_t *>(data);
+  int pid = event->pid;
+
+  if (callback) callback(pid);
+}
+
+int execsnoop() {
+  debug("starting execsnoop");
+  ebpf::BPF bpf;
+  auto init_res = bpf.init(BPF_PROGRAM);
+  if (init_res.code() != 0) {
+    std::cerr << init_res.msg() << std::endl;
+    return 1;
+  }
+
+  string execve_fnname = bpf.get_syscall_fnname("execve");
+  // auto attach_res = bpf.attach_kprobe(execve_fnname, "syscall_execve");
+  auto attach_res =
+      bpf.attach_kprobe(execve_fnname, "ret_syscall_execve", 0, BPF_PROBE_RETURN);
+  if (attach_res.code() != 0) {
+    std::cerr << attach_res.msg() << std::endl;
+    return 1;
+  }
+
+  auto open_res = bpf.open_perf_buffer("events", &handle_events);
+  if (open_res.code() != 0) {
+    std::cerr << open_res.msg() << std::endl;
+    return 1;
+  }
+
+  if (bpf.free_bcc_memory()) {
+    std::cerr << "Failed to free llvm/clang memory" << std::endl;
+    return 1;
+  }
+
+  while (true) bpf.poll_perf_buffer("events");
+
+  return 0;
+}
+
+void *startThread(void *arg) {
+  thread_arg *p = (thread_arg *)arg;
+  callback = p->handle_pid;
+  execsnoop();
+  return (void *)0;
+}
+
+} // namespace CGPROXY::EXECSNOOP
+
+extern "C" void *_startThread(void *arg) { return CGPROXY::EXECSNOOP::startThread(arg); }

src/execsnoop.h

@@ -0,0 +1,22 @@
+#ifndef EXECSNOOP_HPP
+#define EXECSNOOP_HPP 1
+
+#include <functional>
+#include <string>
+using namespace std;
+
+namespace CGPROXY::EXECSNOOP {
+
+extern const string BPF_PROGRAM;
+struct data_t;
+extern function<int(int)> callback;
+void handle_events(void *cb_cookie, void *data, int data_size);
+int execsnoop();
+
+struct thread_arg {
+  function<int(int)> handle_pid;
+};
+void *startThread(void *arg);
+
+} // namespace CGPROXY::EXECSNOOP
+#endif

src/main.cpp

@@ -0,0 +1,17 @@
+#include "cgproxy.hpp"
+#include "cgproxyd.hpp"
+
+bool as_cgproxyd = false;
+void processArgs(const int argc, char *argv[]) {
+  for (int i = 1; i < argc; i++) {
+    if (strcmp(argv[i], "--daemon") == 0) { as_cgproxyd = true; }
+    if (argv[i][0] != '-') { break; }
+  }
+}
+
+int main(int argc, char *argv[]) {
+  processArgs(argc, argv);
+  if (as_cgproxyd) ::CGPROXY::CGPROXYD::main(argc, argv);
+  else
+    ::CGPROXY::CGPROXY::main(argc, argv);
+}

src/socket_client.cpp

@@ -1,20 +1,9 @@
-#ifndef SOCKET_CLIENT_H
-#define SOCKET_CLIENT_H
-
-#include "common.hpp"
-#include <iostream>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string>
+#include "socket_client.h"
+#include "common.h"
 #include <sys/socket.h>
-#include <sys/types.h>
 #include <sys/un.h>
 #include <unistd.h>
 
-using namespace std;
-
-namespace CGPROXY::SOCKET {
-
 #define return_if_error(flag, msg)                                                       \
   if (flag == -1) {                                                                      \
     perror(msg);                                                                         \
@@ -23,6 +12,8 @@ namespace CGPROXY::SOCKET {
     return;                                                                              \
   }
 
+namespace CGPROXY::SOCKET {
+
 void send(const char *msg, int &status) {
   debug("send msg: %s", msg);
   status = UNKNOWN_ERROR;
@@ -59,5 +50,4 @@ void send(const string msg, int &status) {
   debug("return status: %d", status);
 }
 
-} // namespace CGPROXY::SOCKET
-#endif
+} // namespace CGPROXY::SOCKET

src/socket_client.h

@@ -0,0 +1,14 @@
+#ifndef SOCKET_CLIENT_H
+#define SOCKET_CLIENT_H
+
+#include <stdlib.h>
+#include <string>
+using namespace std;
+
+namespace CGPROXY::SOCKET {
+
+void send(const char *msg, int &status);
+void send(const string msg, int &status);
+
+} // namespace CGPROXY::SOCKET
+#endif

src/socket_server.cpp

@@ -0,0 +1,65 @@
+#include "socket_server.h"
+#include "common.h"
+#include <filesystem>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
+namespace fs = std::filesystem;
+
+namespace CGPROXY::SOCKET {
+
+void SocketServer::socketListening(function<int(char *)> callback) {
+  debug("starting socket listening");
+  sfd = socket(AF_UNIX, SOCK_STREAM, 0);
+
+  if (fs::exists(SOCKET_PATH) && unlink(SOCKET_PATH) == -1) {
+    error("%s exist, and can't unlink", SOCKET_PATH);
+    return;
+  }
+  memset(&unix_socket, '\0', sizeof(struct sockaddr_un));
+  unix_socket.sun_family = AF_UNIX;
+  strncpy(unix_socket.sun_path, SOCKET_PATH, sizeof(unix_socket.sun_path) - 1);
+
+  bind(sfd, (struct sockaddr *)&unix_socket, sizeof(struct sockaddr_un));
+
+  listen(sfd, LISTEN_BACKLOG);
+  chmod(SOCKET_PATH, S_IRWXU | S_IRWXG | S_IRWXO);
+
+  while (true) {
+    close(cfd);
+    cfd = accept(sfd, NULL, NULL);
+    continue_if_error(cfd, "accept");
+    debug("accept connection: %d", cfd);
+
+    // read length
+    int msg_len;
+    flag = read(cfd, &msg_len, sizeof(int));
+    continue_if_error(flag, "read length");
+    // read msg
+    char msg[msg_len];
+    flag = read(cfd, msg, msg_len * sizeof(char));
+    continue_if_error(flag, "read msg");
+    msg[msg_len] = '\0';
+    // handle msg
+    int status = callback(msg);
+    // send back flag
+    flag = write(cfd, &status, sizeof(int));
+    continue_if_error(flag, "write back");
+  }
+}
+
+void *startThread(void *arg) {
+  thread_arg *p = (thread_arg *)arg;
+  SocketServer server;
+  server.socketListening(p->handle_msg);
+  return (void *)0;
+}
+
+SocketServer::~SocketServer() {
+  close(sfd);
+  close(cfd);
+  unlink(SOCKET_PATH);
+}
+
+} // namespace CGPROXY::SOCKET

src/socket_server.h

@@ -0,0 +1,33 @@
+#ifndef SOCKET_SERVER_H
+#define SOCKET_SERVER_H
+
+#include <functional>
+#include <stdlib.h>
+#include <sys/un.h>
+using namespace std;
+
+namespace CGPROXY::SOCKET {
+
+#define continue_if_error(flag, msg)                                                     \
+  if (flag == -1) {                                                                      \
+    perror(msg);                                                                         \
+    continue;                                                                            \
+  }
+
+struct thread_arg {
+  function<int(char *)> handle_msg;
+};
+void *startThread(void *arg);
+
+class SocketServer {
+public:
+  int sfd = -1, cfd = -1, flag = -1;
+  struct sockaddr_un unix_socket;
+
+  void socketListening(function<int(char *)> callback);
+  ~SocketServer();
+};
+
+} // namespace CGPROXY::SOCKET
+
+#endif

src/socket_server.hpp

@@ -1,93 +0,0 @@
-#ifndef SOCKET_SERVER_H
-#define SOCKET_SERVER_H
-
-#include "common.hpp"
-#include <filesystem>
-#include <functional>
-#include <iostream>
-#include <signal.h>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string>
-#include <sys/socket.h>
-#include <sys/stat.h>
-#include <sys/types.h>
-#include <sys/un.h>
-#include <unistd.h>
-using namespace std;
-namespace fs = std::filesystem;
-
-namespace CGPROXY::SOCKET {
-
-#define continue_if_error(flag, msg)                                                     \
-  if (flag == -1) {                                                                      \
-    perror(msg);                                                                         \
-    continue;                                                                            \
-  }
-
-struct thread_arg {
-  function<int(char *)> handle_msg;
-};
-
-class SocketServer {
-public:
-  int sfd = -1, cfd = -1, flag = -1;
-  struct sockaddr_un unix_socket;
-
-  void socketListening(function<int(char *)> callback) {
-    debug("starting socket listening");
-    sfd = socket(AF_UNIX, SOCK_STREAM, 0);
-
-    if (fs::exists(SOCKET_PATH) && unlink(SOCKET_PATH) == -1) {
-      error("%s exist, and can't unlink", SOCKET_PATH);
-      return;
-    }
-    memset(&unix_socket, '\0', sizeof(struct sockaddr_un));
-    unix_socket.sun_family = AF_UNIX;
-    strncpy(unix_socket.sun_path, SOCKET_PATH, sizeof(unix_socket.sun_path) - 1);
-
-    bind(sfd, (struct sockaddr *)&unix_socket, sizeof(struct sockaddr_un));
-
-    listen(sfd, LISTEN_BACKLOG);
-    chmod(SOCKET_PATH, S_IRWXU | S_IRWXG | S_IRWXO);
-
-    while (true) {
-      close(cfd);
-      cfd = accept(sfd, NULL, NULL);
-      continue_if_error(cfd, "accept");
-      debug("accept connection: %d", cfd);
-
-      // read length
-      int msg_len;
-      flag = read(cfd, &msg_len, sizeof(int));
-      continue_if_error(flag, "read length");
-      // read msg
-      char msg[msg_len];
-      flag = read(cfd, msg, msg_len * sizeof(char));
-      continue_if_error(flag, "read msg");
-      msg[msg_len] = '\0';
-      // handle msg
-      int status = callback(msg);
-      // send back flag
-      flag = write(cfd, &status, sizeof(int));
-      continue_if_error(flag, "write back");
-    }
-  }
-
-  ~SocketServer() {
-    close(sfd);
-    close(cfd);
-    unlink(SOCKET_PATH);
-  }
-
-  static void *startThread(void *arg) {
-    thread_arg *p = (thread_arg *)arg;
-    SocketServer server;
-    server.socketListening(p->handle_msg);
-    return (void *)0;
-  }
-};
-
-} // namespace CGPROXY::SOCKET
-
-#endif

test/CMakeLists.txt

@@ -2,5 +2,6 @@ include_directories(${PROJECT_SOURCE_DIR})
 include_directories(${PROJECT_SOURCE_DIR}/src)
 
 find_package(nlohmann_json REQUIRED)
-add_executable(client_test socket_client_test.cpp)
+add_executable(client_test socket_client_test.cpp
+        ../src/socket_client.cpp ../src/common.cpp ../src/config.cpp)
 target_link_libraries(client_test nlohmann_json::nlohmann_json)

test/socket_client_test.cpp

@@ -1,48 +1,48 @@
-#include "socket_client.hpp"
+#include "common.h"
+#include "config.h"
+#include "socket_client.h"
 #include <nlohmann/json.hpp>
 
 using namespace std;
 using json = nlohmann::json;
 using namespace CGPROXY;
+using namespace CGPROXY::CONFIG;
 
-void test_json() {
+void send_config(Config &config, int &status) {
   json j;
-  j["type"] = MSG_TYPE_JSON;
-  j["data"]["cgroup_proxy"] = "/";
-  j["data"]["enable_dns"] = false;
-  int status;
+  j["type"] = MSG_TYPE_CONFIG_JSON;
+  j["data"] = config.toJsonStr();
   SOCKET::send(j.dump(), status);
 }
 
-void test_json_array() {
-  json j;
-  j["type"] = MSG_TYPE_JSON;
-  j["data"]["cgroup_proxy"] = "/proxy.slice";
-  j["data"]["cgroup_noproxy"] = {"/noproxy.slice", "/system.slice/v2ray.service"};
-  int status;
-  SOCKET::send(j.dump(), status);
-}
-
-void test_file() {
+void send_config_path(const string s, int &status) {
   json j;
   j["type"] = MSG_TYPE_CONFIG_PATH;
-  j["data"] = "/etc/cgproxy.conf";
-  int status;
+  j["data"] = s;
   SOCKET::send(j.dump(), status);
 }
 
-void test_pid() {
+void send_pid(const pid_t pid, bool proxy, int &status) {
   json j;
-  j["type"] = MSG_TYPE_PROXY_PID;
-  j["data"] = "9999";
-  int status;
+  j["type"] = proxy ? MSG_TYPE_PROXY_PID : MSG_TYPE_NOPROXY_PID;
+  j["data"] = pid;
   SOCKET::send(j.dump(), status);
 }
 
+void test_config() {
+  Config config;
+  config.cgroup_proxy = {"/"};
+  int status;
+  send_config(config, status);
+}
+
+void test_config_path() {
+  string path = "/etc/cgproxy/config.json";
+  int status;
+  send_config_path(path, status);
+}
+
 int main() {
-  test_json_array();
-  test_file();
-  test_json();
-  test_pid();
+  test_config();
   return 0;
 }

test/test.cpp

@@ -1,18 +0,0 @@
-// #include "common.h"
-#include "config.hpp"
-#include <fstream>
-#include <iostream>
-#include <pthread.h>
-#include <sstream>
-#include <stdio.h>
-#include <stdlib.h>
-#include <string>
-#include <vector>
-using namespace std;
-using namespace CGPROXY::CONFIG;
-
-int main() {
-  Config c;
-  c.saveToFile("./config.json");
-  return 0;
-}

tools/CMakeLists.txt

@@ -1,4 +1,12 @@
 include_directories(${PROJECT_SOURCE_DIR})
 include_directories(${PROJECT_SOURCE_DIR}/src)
-add_executable(cgattach cgattach.cpp)
-install(TARGETS cgattach  DESTINATION /usr/bin PERMISSIONS ${basic_permission})
+
+add_executable(cgattach cgattach.cpp ../src/cgroup_attach.cpp ../src/common.cpp)
+install(TARGETS cgattach  DESTINATION /usr/bin PERMISSIONS ${basic_permission})
+
+if (with_execsnoop)
+add_executable(execsnoop_exec execsnoop.cpp ../src/common.cpp ../src/execsnoop.cpp)
+set_target_properties(execsnoop_exec PROPERTIES OUTPUT_NAME execsnoop)
+target_link_libraries(execsnoop_exec bcc)
+install(TARGETS execsnoop_exec  DESTINATION /usr/bin PERMISSIONS ${basic_permission})
+endif()

tools/cgattach.cpp

@@ -1,6 +1,7 @@
-#include "cgroup_attach.hpp"
-#include "common.hpp"
+#include "cgroup_attach.h"
+#include "common.h"
 #include <cstdlib>
+#include <unistd.h>
 using namespace std;
 
 void print_usage() { fprintf(stdout, "usage: cgattach <pid> <cgroup>\n"); }

tools/execsnoop.cpp

@@ -0,0 +1,24 @@
+#include "execsnoop.h"
+#include "common.h"
+#include <unistd.h>
+using namespace std;
+using namespace CGPROXY::EXECSNOOP;
+
+#define PATH_MAX_LEN 128
+
+int handle_pid(int pid) {
+  char path[PATH_MAX_LEN];
+  auto size = readlink(to_str("/proc/", pid, "/exe").c_str(), path, PATH_MAX_LEN);
+  if (size == -1) error("readlink: %s", to_str("/proc/", pid, "/exe").c_str());
+  path[size] = '\0';
+  info("%d %s", pid, path);
+  return 0;
+}
+
+int main() {
+  enable_debug = true;
+  enable_info = true;
+  callback = handle_pid;
+  execsnoop();
+  return 0;
+}

v2ray_config/v2ray.service

@@ -7,7 +7,7 @@ Wants=network-online.target
 [Service]
 Type=exec
 ExecStart=/usr/lib/v2ray/v2ray -config /etc/v2ray/config.json
-User=nobody
+DynamicUser=yes
 AmbientCapabilities=CAP_NET_ADMIN CAP_NET_BIND_SERVICE
 NoNewPrivileges=yes
 Restart=on-failure
@@ -15,4 +15,4 @@ Restart=on-failure
 RestartPreventExitStatus=23
 
 [Install]
-WantedBy=multi-user.target
+WantedBy=multi-user.target