Add ctty to fork (#195)

Add ctty to fork

Since we don't track actual TTY changes, at least make sure a new process gets
the correct TTY, previously we were tracking it only on exec which is fine for
probably most cases.

GPL/Events/EbpfEventProto.h

@@ -213,6 +213,7 @@ struct ebpf_process_fork_event {
     struct ebpf_pid_info parent_pids;
     struct ebpf_pid_info child_pids;
     struct ebpf_cred_info creds;
+    struct ebpf_tty_dev ctty;
     char comm[TASK_COMM_LEN];
 
     // Variable length fields: pids_ss_cgroup_path

GPL/Events/Process/Probe.bpf.c

@@ -15,6 +15,7 @@
 
 #include "Helpers.h"
 #include "PathResolver.h"
+#include "State.h"
 #include "Varlen.h"
 
 /* tty_write */
@@ -56,6 +57,7 @@ int BPF_PROG(sched_process_fork, const struct task_struct *parent, const struct
     ebpf_pid_info__fill(&event->parent_pids, parent);
     ebpf_pid_info__fill(&event->child_pids, child);
     ebpf_cred_info__fill(&event->creds, parent);
+    ebpf_ctty__fill(&event->ctty, child);
     ebpf_comm__fill(event->comm, sizeof(event->comm), child);
 
     // Variable length fields

non-GPL/Events/EventsTrace/EventsTrace.c

@@ -752,6 +752,9 @@ static void out_process_fork(struct ebpf_process_fork_event *evt)
     out_cred_info("creds", &evt->creds);
     out_comma();
 
+    out_tty_dev("ctty", &evt->ctty);
+    out_comma();
+
     out_string("comm", evt->comm);
 
     struct ebpf_varlen_field *field;

testing/testrunner/utils.go

@@ -93,6 +93,7 @@ type ProcessForkEvent struct {
 	ParentPids PidInfo  `json:"parent_pids"`
 	ChildPids  PidInfo  `json:"child_pids"`
 	Creds      CredInfo `json:"creds"`
+	Ctty       TtyInfo  `json:"ctty"`
 }
 
 type ProcessExecEvent struct {