search for: kvm_getprocs

...h disabled), and then subsequent connections are made 1:1 with remote client connections that are being forwarded. My agent implementation already knows how to look up the PID of the connected process (via SO_PEERCRED, getpeerucred, etc) and find its executable name and basic info (via procfs, kvm_getprocs etc) on the handful of OS that I care about, so this is what I'm thinking of doing: 1. Track connections per process by pid + process start time (so if the PID is re-used, the start time should be different and we'll treat it as new) 2. If the calling process' exec binary path e...

Any way to check if another proc has run or been run by a proc that is setuid or seteuid?