Struct google_api_proto::google::cloud::securitycenter::v2::KernelRootkit

pub struct KernelRootkit {
    pub name: String,
    pub unexpected_code_modification: bool,
    pub unexpected_read_only_data_modification: bool,
    pub unexpected_ftrace_handler: bool,
    pub unexpected_kprobe_handler: bool,
    pub unexpected_kernel_code_pages: bool,
    pub unexpected_system_call_handler: bool,
    pub unexpected_interrupt_handler: bool,
    pub unexpected_processes_in_runqueue: bool,
}

Kernel mode rootkit signatures.

Fields

name: String

Rootkit name, when available.

unexpected_code_modification: bool

True if unexpected modifications of kernel code memory are present.

unexpected_read_only_data_modification: bool

True if unexpected modifications of kernel read-only data memory are present.

unexpected_ftrace_handler: bool

True if ftrace points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

unexpected_kprobe_handler: bool

True if kprobe points are present with callbacks pointing to regions that are not in the expected kernel or module code range.

unexpected_kernel_code_pages: bool

True if kernel code pages that are not in the expected kernel or module code regions are present.

unexpected_system_call_handler: bool

True if system call handlers that are are not in the expected kernel or module code regions are present.

unexpected_interrupt_handler: bool

True if interrupt handlers that are are not in the expected kernel or module code regions are present.

unexpected_processes_in_runqueue: bool

True if unexpected processes in the scheduler run queue are present. Such processes are in the run queue, but not in the process task list.

Trait Implementations

impl Clone for KernelRootkit

fn clone(&self) -> KernelRootkit

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for KernelRootkit

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Default for KernelRootkit

fn default() -> Self

Returns the “default value” for a type.

impl Message for KernelRootkit

fn encoded_len(&self) -> usize

Returns the encoded length of the message without a length delimiter.

fn clear(&mut self)

Clears the message, resetting all fields to their default.

fn encode(&self, buf: &mut impl BufMut) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message to a buffer.

fn encode_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message to a newly allocated buffer.

fn encode_length_delimited( &self, buf: &mut impl BufMut, ) -> Result<(), EncodeError>

where Self: Sized,

Encodes the message with a length-delimiter to a buffer.

fn encode_length_delimited_to_vec(&self) -> Vec<u8>

where Self: Sized,

Encodes the message with a length-delimiter to a newly allocated buffer.

fn decode(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes an instance of the message from a buffer.

fn decode_length_delimited(buf: impl Buf) -> Result<Self, DecodeError>

where Self: Default,

Decodes a length-delimited instance of the message from the buffer.

fn merge(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes an instance of the message from a buffer, and merges it into self.

fn merge_length_delimited(&mut self, buf: impl Buf) -> Result<(), DecodeError>

where Self: Sized,

Decodes a length-delimited instance of the message from buffer, and merges it into self.

impl PartialEq for KernelRootkit

fn eq(&self, other: &KernelRootkit) -> bool

This method tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

This method tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for KernelRootkit