vivarium 0.4.2 → 0.5.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 0a0f8b6dfc29af71d39ff5fe1ebceca9040cf62a2c6147dba5c2a074b392cdc1
-  data.tar.gz: c9f10129e5b42fd51653dcda0a02ed0e7be8b4c2ad7daef4f48a9fa5c03dcf41
+  metadata.gz: 43539002d1068c28f470c91be68c64227c36312b72d4dc35a39ce89248cc0a97
+  data.tar.gz: 7f1d83e733fcedc3094897317b0273c26a8e5317428dda1917022facd58b02c6
 SHA512:
-  metadata.gz: 9530187d826e63976bd7e1c86872345f5cad281608b2ee06f0dbe20e6211455d8d050a18013822f6baecf4c0af18e9e01b58fec7fe13174d9631181df8660569
-  data.tar.gz: c3ee802cf168d5ca917c6d9de5cce25c9441ba46a35995bc5e5f78ce6c78055c1a4d8141bff7dd4e7763205d65c1a41344a789185dbea8fc65f4589ef8e90586
+  metadata.gz: b7ef0d3e7501bd259fd405a09870eb785e042c920b93bbe93f6efb1804fafba44a5538df9a20c809934732338c49ffc6c29a3fcff74b5395fe7e7b86449fd849
+  data.tar.gz: 250af21f03f00cb7cbec31b8bdced3b3b5effe618da48df1f0f83b1b5f42025085c35ec436506eef5ee60664f9bc7dfda6cb712e82fc18dfc9a3acd77893ba39

data/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2019 Uchio Kondo
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

data/lib/vivarium/api_server.rb

@@ -0,0 +1,214 @@
+# frozen_string_literal: true
+
+require "fileutils"
+require "socket"
+
+module Vivarium
+  # In-memory, sequence-numbered log of raw event_t records (#{Vivarium::EVENT_STRUCT_SIZE} bytes
+  # each) fed by the daemon's ring buffer poller and consumed by /events streams.
+  class EventLog
+    def initialize(capacity: 50_000)
+      @capacity = capacity
+      @mutex = Mutex.new
+      @cond = ConditionVariable.new
+      @records = []
+      @seq = 0
+    end
+
+    def append(bytes)
+      @mutex.synchronize do
+        @seq += 1
+        @records << [@seq, bytes]
+        overflow = @records.size - @capacity
+        @records.shift(overflow) if overflow.positive?
+        @cond.broadcast
+      end
+    end
+
+    def tail_seq
+      @mutex.synchronize { @seq }
+    end
+
+    # Returns records with seq > cursor. Blocks up to timeout seconds when nothing newer
+    # is available so callers can long-poll.
+    def read_after(cursor, timeout: 1.0)
+      @mutex.synchronize do
+        if @records.empty? || @records.last[0] <= cursor
+          @cond.wait(@mutex, timeout)
+        end
+        @records.select { |seq, _| seq > cursor }
+      end
+    end
+  end
+
+  # Wraps the daemon's live BPF target maps so the API can (un)register PIDs.
+  class Registry
+    def initialize(config_root_targets, config_spawned_targets)
+      @config_root_targets = config_root_targets
+      @config_spawned_targets = config_spawned_targets
+    end
+
+    def register(pid)
+      @config_root_targets[pid] = 1
+    end
+
+    def unregister(pid)
+      @config_root_targets.delete(pid)
+      @config_spawned_targets.clear
+    rescue KeyError
+      nil
+    end
+  end
+
+  # Minimal HTTP/1.1 server over a Unix domain socket exposing the daemon control API.
+  class ApiServer
+    STREAM_POLL_TIMEOUT = 1.0
+
+    def initialize(socket_path:, event_log:, registry:, daemon_pid: Process.pid)
+      @socket_path = socket_path
+      @event_log = event_log
+      @registry = registry
+      @daemon_pid = daemon_pid
+    end
+
+    def start
+      FileUtils.mkdir_p(File.dirname(@socket_path))
+      File.unlink(@socket_path) if File.exist?(@socket_path)
+      @server = UNIXServer.new(@socket_path)
+      File.chmod(0o666, @socket_path)
+      @thread = Thread.new { accept_loop }
+      self
+    end
+
+    def stop
+      @server&.close
+    rescue StandardError
+      nil
+    ensure
+      File.unlink(@socket_path) if @socket_path && File.exist?(@socket_path)
+    end
+
+    private
+
+    def accept_loop
+      loop do
+        conn = @server.accept
+        Thread.new(conn) { |c| handle(c) }
+      end
+    rescue IOError, Errno::EBADF
+      # server closed during shutdown
+    end
+
+    def handle(conn)
+      request_line = conn.gets
+      return if request_line.nil?
+
+      method, target, = request_line.split(" ")
+      drain_headers(conn)
+
+      path, query = target.to_s.split("?", 2)
+      route(conn, method, path, query)
+    rescue Errno::EPIPE, IOError
+      nil
+    rescue StandardError => e
+      warn "[vivariumd api] #{e.class}: #{e.message}"
+    ensure
+      begin
+        conn.close
+      rescue StandardError
+        nil
+      end
+    end
+
+    def drain_headers(conn)
+      while (line = conn.gets)
+        break if line == "\r\n" || line == "\n"
+      end
+    end
+
+    def route(conn, method, path, query)
+      target_match = path.to_s.match(%r{\A/targets/(\d+)\z})
+
+      if method == "GET" && path == "/healthz"
+        respond_json(conn, 200, { status: "ok", pid: @daemon_pid })
+      elsif method == "GET" && path == "/events"
+        stream_events(conn, query)
+      elsif method == "PUT" && target_match
+        pid = Integer(target_match[1], 10)
+        @registry.register(pid)
+        respond_json(conn, 200, { status: "registered", pid: pid })
+      elsif method == "DELETE" && target_match
+        pid = Integer(target_match[1], 10)
+        @registry.unregister(pid)
+        respond_json(conn, 200, { status: "unregistered", pid: pid })
+      else
+        respond_json(conn, 404, { error: "not_found" })
+      end
+    end
+
+    def stream_events(conn, query)
+      since = parse_since(query)
+      conn.write("HTTP/1.1 200 OK\r\n")
+      conn.write("Content-Type: application/octet-stream\r\n")
+      conn.write("Transfer-Encoding: chunked\r\n")
+      conn.write("\r\n")
+
+      cursor = since || @event_log.tail_seq
+      loop do
+        records = @event_log.read_after(cursor, timeout: STREAM_POLL_TIMEOUT)
+        records.each do |seq, bytes|
+          conn.write(format("%x\r\n", bytes.bytesize))
+          conn.write(bytes)
+          conn.write("\r\n")
+          cursor = seq
+        end
+      end
+    rescue Errno::EPIPE, Errno::ECONNRESET, IOError
+      # client disconnected
+    ensure
+      begin
+        conn.write("0\r\n\r\n")
+      rescue StandardError
+        nil
+      end
+    end
+
+    def parse_since(query)
+      return nil if query.nil? || query.empty?
+
+      query.split("&").each do |pair|
+        key, value = pair.split("=", 2)
+        return Integer(value, 10) if key == "since" && value
+      end
+      nil
+    rescue ArgumentError
+      nil
+    end
+
+    def respond_json(conn, status, payload)
+      body = json_encode(payload)
+      conn.write("HTTP/1.1 #{status} #{status_text(status)}\r\n")
+      conn.write("Content-Type: application/json\r\n")
+      conn.write("Content-Length: #{body.bytesize}\r\n")
+      conn.write("Connection: close\r\n")
+      conn.write("\r\n")
+      conn.write(body)
+    end
+
+    def status_text(status)
+      case status
+      when 200 then "OK"
+      when 404 then "Not Found"
+      else "Status"
+      end
+    end
+
+    def json_encode(hash)
+      pairs = hash.map do |key, value|
+        encoded = value.is_a?(Integer) ? value.to_s : %("#{value}")
+        %("#{key}":#{encoded})
+      end
+      "{#{pairs.join(',')}}"
+    end
+  end
+end

data/lib/vivarium/box.rb

@@ -12,21 +12,12 @@ module Vivarium
   #   result = box::MyClass.new.foo  # automatically traced if Vivarium.observe is active
   #
   class Box < Module
-    DEFAULT_FILTER = {
-      include_events: %w[
-        proc_fork proc_exec span_start span_stop
-        sock_connect dns_req odd_socket
-        ssl_write
-        dlopen mmap_exec
-        task_kill
-        setid_change capable_check bprm_creds
-      ]
-    }
+    DEFAULT_FILTER = Vivarium::DEFAULT_FILTER
 
-    def initialize(pin_dir: Vivarium.bpf_pin_dir, dest: $stdout, filter: DEFAULT_FILTER)
+    def initialize(socket_path: Vivarium.socket_path, dest: $stdout, filter: DEFAULT_FILTER)
       super()
       @inner_box = Ruby::Box.new
-      @pin_dir = pin_dir
+      @socket_path = socket_path
       @dest = dest
       @filter = filter
       @session = nil
@@ -124,7 +115,7 @@ module Vivarium
 
     def start_vivarium_observation
       puts "[debug] Starting Vivarium observation for Box method calls"
-      @session = Vivarium.top_observe(pin_dir: @pin_dir, dest: @dest, filter: @filter)
+      @session = Vivarium.top_observe(socket_path: @socket_path, dest: @dest, filter: @filter)
     end
 
     def stop_vivarium_observation

data/lib/vivarium/cli.rb

@@ -5,7 +5,7 @@ require "optparse"
 module Vivarium
   module CLI
     def self.run!(argv = ARGV)
-      options = { pin_dir: Vivarium.bpf_pin_dir, dest: $stdout }
+      options = { socket_path: Vivarium.socket_path, dest: $stdout }
       parser = OptionParser.new do |opts|
         opts.banner = "Usage: vivarium [options] <command> [args]"
         opts.separator ""
@@ -13,7 +13,7 @@ module Vivarium
         opts.separator "  load <script>    Load and observe a Ruby script"
         opts.separator ""
         opts.separator "Options:"
-        opts.on("--pin-dir PATH", "Pinned map directory") { |v| options[:pin_dir] = v }
+        opts.on("--socket PATH", "vivariumd Unix domain socket path") { |v| options[:socket_path] = v }
         opts.on("-o", "--output PATH", "Log output file (default: stdout)") { |v| options[:dest] = File.open(v, "a") }
       end
       parser.order!(argv)
@@ -32,7 +32,8 @@ module Vivarium
       abort "Usage: vivarium load <script>" unless script
       abort "File not found: #{script}" unless File.exist?(script)
 
-      Vivarium.observe(pin_dir: options[:pin_dir], dest: options[:dest]) do
+      Vivarium.observe(socket_path: options[:socket_path], dest: options[:dest],
+                       filter: Vivarium::DEFAULT_FILTER) do
         Kernel.load(File.expand_path(script))
       end
     end

data/lib/vivarium/correlator.rb

@@ -1,48 +1,34 @@
 # frozen_string_literal: true
 
-require "rbbcc"
 require "time"
 
 module Vivarium
+  # Client-side consumer of the vivariumd event stream. Connects to the daemon's
+  # Unix domain socket, reads chunked raw event_t records, accumulates them, and
+  # renders a tree on stop. It never touches BPF maps or the ring buffer directly.
   class Correlator
     RawEvent = Struct.new(
       :ktime_ns, :pid, :tid, :event_name, :payload, :dropped_since_last,
       keyword_init: true
     )
 
-    EVENT_C_TYPE = <<~C
-      struct event_t {
-        u64 ktime_ns;
-        u32 pid;
-        u32 tid;
-        char event_name[16];
-        char payload[256];
-        u64 dropped_since_last;
-      };
-    C
-
-    POLL_TIMEOUT_MS = 200
-
-    def initialize(pin_dir:, observer_pid:, main_tid:, filter: nil, dest: $stdout)
-      @pin_dir = pin_dir
+    # Grace period after stop to let trailing events drain through the stream.
+    DRAIN_SLEEP = 0.3
+
+    def initialize(socket_path: Vivarium.socket_path, observer_pid:, main_tid:,
+                   filter: nil, dest: $stdout)
+      @socket_path = socket_path
       @observer_pid = observer_pid
       @main_tid = main_tid
       @filter = filter
       @dest = dest
 
+      @client = DaemonClient.new(socket_path: socket_path)
       @events = []
       @events_mutex = Mutex.new
       @stop_flag = false
       @started = false
-
-      @ringbuf = RbBCC::RingBuf.from_pin(
-        File.join(@pin_dir, "events"),
-        EVENT_C_TYPE,
-        Vivarium::EVENTS_RINGBUF_PAGES
-      )
-      @ringbuf.open_ring_buffer do |_ctx, data, size|
-        capture_event(data, size)
-      end
+      @stopped = false
     end
 
     def start
@@ -50,6 +36,7 @@ module Vivarium
 
       @session_start_iso = Time.now.utc.iso8601(3)
       @session_start_ktime = Vivarium.monotonic_ktime_ns
+      @sock = @client.open_event_stream
       @thread = Thread.new { run }
       @started = true
     end
@@ -58,13 +45,13 @@ module Vivarium
       return unless @started
       return if @stopped
 
+      sleep DRAIN_SLEEP
       @stop_flag = true
-      @thread&.join(POLL_TIMEOUT_MS * 4 / 1000.0 + 1)
+      @sock&.close
+      @thread&.join(2)
       @session_stop_iso = Time.now.utc.iso8601(3)
       @session_stop_ktime = Vivarium.monotonic_ktime_ns
 
-      3.times { safe_poll(50) }
-
       events_snapshot = @events_mutex.synchronize { @events.dup }
       @stopped = true
 
@@ -85,18 +72,43 @@ module Vivarium
 
     def run
       until @stop_flag
-        safe_poll(POLL_TIMEOUT_MS)
+        size = read_chunk_size(@sock)
+        break if size.nil? || size.zero?
+
+        bytes = read_exactly(@sock, size)
+        break if bytes.nil?
+
+        @sock.read(2) # trailing CRLF after chunk data
+        capture_event(bytes)
       end
+    rescue IOError, Errno::EBADF, Errno::ECONNRESET
+      # socket closed on stop
+    rescue StandardError => e
+      warn "[vivarium correlator] stream error: #{e.class}: #{e.message}"
     end
 
-    def safe_poll(timeout_ms)
-      @ringbuf.ring_buffer_poll(timeout_ms)
-    rescue StandardError => e
-      warn "[vivarium correlator] poll error: #{e.class}: #{e.message}"
+    def read_chunk_size(sock)
+      line = sock.gets
+      return nil if line.nil?
+
+      Integer(line.strip, 16)
+    rescue ArgumentError
+      nil
     end
 
-    def capture_event(data, size)
-      bytes = data[0, size].to_s.b
+    def read_exactly(sock, size)
+      buffer = +""
+      while buffer.bytesize < size
+        chunk = sock.read(size - buffer.bytesize)
+        return nil if chunk.nil?
+
+        buffer << chunk
+      end
+      buffer
+    end
+
+    def capture_event(bytes)
+      bytes = bytes.to_s.b
       bytes = bytes.ljust(Vivarium::EVENT_STRUCT_SIZE, "\x00") if bytes.bytesize < Vivarium::EVENT_STRUCT_SIZE
 
       ktime_ns           = bytes[Vivarium::EVENT_TS_OFFSET,      Vivarium::EVENT_TS_SIZE].unpack1("Q<")
@@ -119,6 +131,5 @@ module Vivarium
     rescue StandardError => e
       warn "[vivarium correlator] capture error: #{e.class}: #{e.message}"
     end
-
   end
 end

data/lib/vivarium/daemon_client.rb

@@ -0,0 +1,80 @@
+# frozen_string_literal: true
+
+require "socket"
+
+module Vivarium
+  # HTTP-over-Unix-domain-socket client for talking to vivariumd. The client side
+  # never touches BPF maps or the ring buffer directly; everything goes through here.
+  class DaemonClient
+    def initialize(socket_path: Vivarium.socket_path)
+      @socket_path = socket_path
+    end
+
+    def healthy?
+      status, = simple_request("GET", "/healthz")
+      status == 200
+    rescue Error
+      false
+    end
+
+    def register(pid)
+      simple_request("PUT", "/targets/#{pid}")
+    end
+
+    def unregister(pid)
+      simple_request("DELETE", "/targets/#{pid}")
+    end
+
+    # Opens a dedicated streaming connection to GET /events, consumes the response
+    # headers, and returns the still-open socket positioned at the start of the
+    # chunked body. The caller is responsible for reading chunks and closing it.
+    def open_event_stream(since: nil)
+      sock = connect
+      path = since ? "/events?since=#{since}" : "/events"
+      sock.write("GET #{path} HTTP/1.1\r\n")
+      sock.write("Host: vivarium\r\n")
+      sock.write("Accept: application/octet-stream\r\n")
+      sock.write("\r\n")
+      read_response_headers(sock)
+      sock
+    end
+
+    private
+
+    def connect
+      UNIXSocket.new(@socket_path)
+    rescue Errno::ENOENT, Errno::ECONNREFUSED => e
+      raise Error, "cannot connect to vivariumd at #{@socket_path}: #{e.message} " \
+                   "(is vivariumd running?)"
+    end
+
+    def simple_request(method, path)
+      sock = connect
+      begin
+        sock.write("#{method} #{path} HTTP/1.1\r\n")
+        sock.write("Host: vivarium\r\n")
+        sock.write("Connection: close\r\n")
+        sock.write("\r\n")
+        status = read_status(sock)
+        body = sock.read
+        [status, body]
+      ensure
+        sock.close
+      end
+    end
+
+    def read_status(sock)
+      status_line = sock.gets
+      return nil if status_line.nil?
+
+      status_line.split(" ")[1].to_i
+    end
+
+    def read_response_headers(sock)
+      read_status(sock)
+      while (line = sock.gets)
+        break if line == "\r\n" || line == "\n"
+      end
+    end
+  end
+end

data/lib/vivarium/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Vivarium
-  VERSION = "0.4.2"
+  VERSION = "0.5.1"
 end

data/lib/vivarium.rb

@@ -6,6 +6,7 @@ require "net/http"
 require "optparse"
 require "pathname"
 require "rbbcc"
+require "set"
 require "socket"
 if defined?(Ruby) && defined?(Ruby::Box) && Ruby::Box.enabled?
   Ruby::Box.root.require "vivarium_usdt"
@@ -25,6 +26,8 @@ module Vivarium
   CONFIG_TARGETS_PIN = CONFIG_ROOT_TARGETS_PIN
   EVENTS_PIN = File.join(PIN_DIR, "events")
 
+  SOCKET_PATH = ENV.fetch("VIVARIUM_SOCKET_PATH", "/run/vivarium/vivariumd.sock")
+
   EVENT_NAME_SIZE = 16
   EVENT_PAYLOAD_SIZE = 256
   EVENT_TS_SIZE = 8
@@ -85,14 +88,31 @@ module Vivarium
     TCPSocket,
     UDPSocket,
     UNIXSocket,
-    File,
-    Dir,
     Signal,
     Process,
     Process::UID,
     Process::GID,
     Net::HTTP,
   ]
+
+  # File/Dir are deliberately NOT in SPAN_ALLOWCLASSES: tracing every method is
+  # far too noisy and read/query methods (exist?, basename, read, stat, ...) carry
+  # little security signal. Instead only the security-relevant methods below are
+  # turned into spans. Detection is done via tp.self (not tp.defined_class) so that
+  # e.g. File.open, whose method is owned by IO, is still matched. Kernel LSM events
+  # (path_open, file_chmod, file_rename, file_symlink, file_hardlink, file_getdents)
+  # already capture the underlying filesystem actions regardless of the Ruby method.
+  SPAN_FILE_METHODS = %i[
+    open new write binwrite
+    delete unlink rename truncate
+    chmod lchmod chown lchown
+    symlink link readlink
+    realpath realdirpath
+    mkfifo mknod utime
+  ].to_set.freeze
+  SPAN_DIR_METHODS = %i[
+    mkdir rmdir delete unlink chdir chroot glob
+  ].to_set.freeze
   SPAN_ALLOWLIST = [
     "Kernel#system",
     "Kernel#require",
@@ -121,6 +141,26 @@ module Vivarium
     dlopen
   ].freeze
 
+  # Default display filter applied by both `vivarium load` (CLI) and Vivarium::Box.
+  # path_open fires on every file open and is far too noisy to show in full, so it
+  # is restricted to opens under /etc and /proc (config/state that matters for
+  # security review). render_event_payload renders the path via String#inspect,
+  # so the matched target text looks like "/etc/passwd" (leading quote included).
+  DEFAULT_FILTER = {
+    include_events: %w[
+      proc_fork proc_exec span_start span_stop
+      path_open
+      sock_connect dns_req odd_socket
+      ssl_write
+      dlopen mmap_exec
+      task_kill
+      setid_change capable_check bprm_creds
+    ],
+    payload: {
+      "path_open" => %r{\A"?/(?:home|root|etc|proc)(?:/|"|\z)}
+    }
+  }.freeze
+
   CAPABILITY_NAMES = {
     0 => "CAP_CHOWN",
     1 => "CAP_DAC_OVERRIDE",
@@ -160,13 +200,18 @@ module Vivarium
   }.freeze
 
   @bpf_pin_dir = PIN_DIR
+  @socket_path = SOCKET_PATH
 
   class << self
-    attr_writer :bpf_pin_dir
+    attr_writer :bpf_pin_dir, :socket_path
 
     def bpf_pin_dir
       @bpf_pin_dir || PIN_DIR
     end
+
+    def socket_path
+      @socket_path || SOCKET_PATH
+    end
   end
 
   def self.c_string(bytes)
@@ -544,39 +589,6 @@ module Vivarium
     bytes[0, nul]
   end
 
-  class MapStore
-    def initialize(pin_dir: Vivarium.bpf_pin_dir)
-      @pin_dir = pin_dir
-      @config_root_targets = RbBCC::HashTable.from_pin(
-        File.join(@pin_dir, "config_root_targets"),
-        "unsigned int",
-        "unsigned char",
-        keysize: 4,
-        leafsize: 1
-      )
-      @config_spawned_targets = RbBCC::HashTable.from_pin(
-        File.join(@pin_dir, "config_spawned_targets"),
-        "unsigned int",
-        "unsigned char",
-        keysize: 4,
-        leafsize: 1
-      )
-    rescue StandardError => e
-      raise Error, "failed to open pinned maps under #{@pin_dir}: #{e.class}: #{e.message}"
-    end
-
-    def register_pid(pid)
-      @config_root_targets[pid] = 1
-    end
-
-    def unregister_pid(pid)
-      @config_root_targets.delete(pid)
-      @config_spawned_targets.clear
-    rescue KeyError
-      nil
-    end
-  end
-
   class Daemon
     BPF_PROGRAM_TEMPLATE = <<~CLANG
       #include <linux/socket.h>
@@ -1459,60 +1471,6 @@ module Vivarium
         return 0;
       }
 
-      int on_span_start(struct pt_regs *ctx)
-      {
-        u64 pid_tgid = bpf_get_current_pid_tgid();
-        u32 pid = pid_tgid >> 32;
-        u32 tid = (u32)pid_tgid;
-
-        if (!target_enabled(pid, tid)) {
-          return 0;
-        }
-
-        u64 method_str_ptr = 0;
-        u64 file_str_ptr = 0;
-        s64 lineno = 0;
-        bpf_usdt_readarg(1, ctx, &method_str_ptr);
-        bpf_usdt_readarg(2, ctx, &file_str_ptr);
-        bpf_usdt_readarg(3, ctx, &lineno);
-
-        struct event_t ev = {};
-        ev.pid = pid;
-        __builtin_memcpy(ev.event_name, "span_start", 11);
-        bpf_probe_read_user_str(&ev.payload[0], #{SPAN_METHOD_SIZE}, (void*)method_str_ptr);
-        bpf_probe_read_user_str(&ev.payload[#{SPAN_METHOD_SIZE}], #{SPAN_FILE_SIZE}, (void*)file_str_ptr);
-        __builtin_memcpy(&ev.payload[#{SPAN_LINENO_OFFSET}], &lineno, sizeof(lineno));
-        submit_event(&ev);
-        return 0;
-      }
-
-      int on_span_stop(struct pt_regs *ctx)
-      {
-        u64 pid_tgid = bpf_get_current_pid_tgid();
-        u32 pid = pid_tgid >> 32;
-        u32 tid = (u32)pid_tgid;
-
-        if (!target_enabled(pid, tid)) {
-          return 0;
-        }
-
-        u64 method_str_ptr = 0;
-        u64 file_str_ptr = 0;
-        s64 lineno = 0;
-        bpf_usdt_readarg(1, ctx, &method_str_ptr);
-        bpf_usdt_readarg(2, ctx, &file_str_ptr);
-        bpf_usdt_readarg(3, ctx, &lineno);
-
-        struct event_t ev = {};
-        ev.pid = pid;
-        __builtin_memcpy(ev.event_name, "span_stop", 10);
-        bpf_probe_read_user_str(&ev.payload[0], #{SPAN_METHOD_SIZE}, (void*)method_str_ptr);
-        bpf_probe_read_user_str(&ev.payload[#{SPAN_METHOD_SIZE}], #{SPAN_FILE_SIZE}, (void*)file_str_ptr);
-        __builtin_memcpy(&ev.payload[#{SPAN_LINENO_OFFSET}], &lineno, sizeof(lineno));
-        submit_event(&ev);
-        return 0;
-      }
-
       int on_ssl_write(struct pt_regs *ctx)
       {
         u64 pid_tgid = bpf_get_current_pid_tgid();
@@ -1648,8 +1606,67 @@ module Vivarium
         submit_env_event(pid, "clearenv", 8, 0);
         return 0;
       }
+    CLANG
 
-      int on_span_raise(struct pt_regs *ctx)
+    # USDT span handlers are generated per attached .so so each gets a unique
+    # fn_name. BCC emits _bpf_readarg_<fn_name>_<n> per USDT context, so sharing
+    # one fn_name across contexts triggers a redefinition error.
+    SPAN_PROBE_TEMPLATE = <<~CLANG
+      int on_span_start__SUFFIX__(struct pt_regs *ctx)
+      {
+        u64 pid_tgid = bpf_get_current_pid_tgid();
+        u32 pid = pid_tgid >> 32;
+        u32 tid = (u32)pid_tgid;
+
+        if (!target_enabled(pid, tid)) {
+          return 0;
+        }
+
+        u64 method_str_ptr = 0;
+        u64 file_str_ptr = 0;
+        s64 lineno = 0;
+        bpf_usdt_readarg(1, ctx, &method_str_ptr);
+        bpf_usdt_readarg(2, ctx, &file_str_ptr);
+        bpf_usdt_readarg(3, ctx, &lineno);
+
+        struct event_t ev = {};
+        ev.pid = pid;
+        __builtin_memcpy(ev.event_name, "span_start", 11);
+        bpf_probe_read_user_str(&ev.payload[0], #{SPAN_METHOD_SIZE}, (void*)method_str_ptr);
+        bpf_probe_read_user_str(&ev.payload[#{SPAN_METHOD_SIZE}], #{SPAN_FILE_SIZE}, (void*)file_str_ptr);
+        __builtin_memcpy(&ev.payload[#{SPAN_LINENO_OFFSET}], &lineno, sizeof(lineno));
+        submit_event(&ev);
+        return 0;
+      }
+
+      int on_span_stop__SUFFIX__(struct pt_regs *ctx)
+      {
+        u64 pid_tgid = bpf_get_current_pid_tgid();
+        u32 pid = pid_tgid >> 32;
+        u32 tid = (u32)pid_tgid;
+
+        if (!target_enabled(pid, tid)) {
+          return 0;
+        }
+
+        u64 method_str_ptr = 0;
+        u64 file_str_ptr = 0;
+        s64 lineno = 0;
+        bpf_usdt_readarg(1, ctx, &method_str_ptr);
+        bpf_usdt_readarg(2, ctx, &file_str_ptr);
+        bpf_usdt_readarg(3, ctx, &lineno);
+
+        struct event_t ev = {};
+        ev.pid = pid;
+        __builtin_memcpy(ev.event_name, "span_stop", 10);
+        bpf_probe_read_user_str(&ev.payload[0], #{SPAN_METHOD_SIZE}, (void*)method_str_ptr);
+        bpf_probe_read_user_str(&ev.payload[#{SPAN_METHOD_SIZE}], #{SPAN_FILE_SIZE}, (void*)file_str_ptr);
+        __builtin_memcpy(&ev.payload[#{SPAN_LINENO_OFFSET}], &lineno, sizeof(lineno));
+        submit_event(&ev);
+        return 0;
+      }
+
+      int on_span_raise__SUFFIX__(struct pt_regs *ctx)
       {
         u64 pid_tgid = bpf_get_current_pid_tgid();
         u32 pid = pid_tgid >> 32;
@@ -1680,14 +1697,18 @@ module Vivarium
       }
     CLANG
 
-    def initialize(pin_dir: Vivarium.bpf_pin_dir, ssl_trace: true, libssl_path: nil,
-                   dlopen_trace: true, env_trace: true, libc_path: nil)
-      @pin_dir      = pin_dir
-      @ssl_trace    = ssl_trace
-      @libssl_path  = libssl_path
-      @dlopen_trace = dlopen_trace
-      @env_trace    = env_trace
-      @libc_path    = libc_path
+    def initialize(pin_dir: Vivarium.bpf_pin_dir, socket_path: Vivarium.socket_path,
+                   ssl_trace: true, libssl_path: nil,
+                   dlopen_trace: true, env_trace: true, libc_path: nil,
+                   usdt_so_paths: nil)
+      @pin_dir        = pin_dir
+      @socket_path    = socket_path
+      @ssl_trace      = ssl_trace
+      @libssl_path    = libssl_path
+      @dlopen_trace   = dlopen_trace
+      @env_trace      = env_trace
+      @libc_path      = libc_path
+      @usdt_so_paths  = usdt_so_paths
     end
 
     def run
@@ -1700,13 +1721,11 @@ module Vivarium
         .gsub("__VIVARIUM_F_PATH_OFFSET__", f_path_offset.to_s)
         .gsub("__VIVARIUM_DENTRY_D_NAME_OFFSET__", d_name_offset.to_s)
 
-      usdt_so_path = ENV.fetch("VIVARIUM_USDT_SO_PATH") { Vivarium.locate_vivarium_usdt_so }
-      usdt = RbBCC::USDT.new(path: usdt_so_path)
-      usdt.enable_probe(probe: "start_probe", fn_name: "on_span_start")
-      usdt.enable_probe(probe: "stop_probe", fn_name: "on_span_stop")
-      usdt.enable_probe(probe: "raise_probe", fn_name: "on_span_raise")
+      usdt_so_paths = resolve_usdt_so_paths
+      usdt_contexts = build_usdt_contexts(usdt_so_paths)
+      program += build_span_probe_sources(usdt_contexts)
 
-      bpf = RbBCC::BCC.new(text: program, usdt_contexts: [usdt])
+      bpf = RbBCC::BCC.new(text: program, usdt_contexts: usdt_contexts.map(&:last))
 
       attach_ssl_write_uprobe(bpf) if @ssl_trace
       attach_dlopen_uprobe(bpf) if @dlopen_trace
@@ -1722,20 +1741,117 @@ module Vivarium
       pin_map(config_spawned_targets, File.join(@pin_dir, "config_spawned_targets"))
       pin_map(events_ringbuf, File.join(@pin_dir, "events"))
 
+      event_log = EventLog.new
+      registry = Registry.new(config_root_targets, config_spawned_targets)
+      start_ringbuf_poller(bpf, events_ringbuf, event_log)
+
+      @api_server = ApiServer.new(
+        socket_path: @socket_path,
+        event_log: event_log,
+        registry: registry,
+        daemon_pid: Process.pid
+      )
+      @api_server.start
+
       puts "[vivariumd] started"
       puts "[vivariumd] pinned maps in #{@pin_dir}"
       puts "[vivariumd] watching LSM file_open (f_path offset=#{f_path_offset})"
-      puts "[vivariumd] USDT attached via #{usdt_so_path}"
+      puts "[vivariumd] API listening on unix:#{@socket_path}"
 
       loop do
         sleep 1
       end
     rescue Interrupt
       puts "\n[vivariumd] stopping"
+    ensure
+      @api_server&.stop
     end
 
     private
 
+    USDT_PROBES = [
+      ["start_probe", "on_span_start"],
+      ["stop_probe", "on_span_stop"],
+      ["raise_probe", "on_span_raise"]
+    ].freeze
+
+    def resolve_usdt_so_paths
+      raw =
+        if @usdt_so_paths && !@usdt_so_paths.empty?
+          @usdt_so_paths
+        else
+          env = ENV["VIVARIUM_USDT_SO_PATH"]
+          if env && !env.empty?
+            env.split(File::PATH_SEPARATOR)
+          else
+            [Vivarium.locate_vivarium_usdt_so]
+          end
+        end
+
+      paths = raw.map(&:strip).reject(&:empty?).uniq
+      existing = paths.select do |p|
+        if File.exist?(p)
+          true
+        else
+          warn "[vivariumd] USDT .so not found, skipping: #{p}"
+          false
+        end
+      end
+
+      if existing.empty?
+        raise Error, "no USDT .so files to attach " \
+                     "(set --usdt-so PATH or VIVARIUM_USDT_SO_PATH)"
+      end
+
+      existing
+    end
+
+    # Returns an array of [suffix, usdt] pairs. Each context gets a unique suffix
+    # so its enabled probes map to distinct BPF fn_names, and build_span_probe_sources
+    # emits matching handler definitions for exactly these suffixes.
+    def build_usdt_contexts(paths)
+      contexts = paths.each_with_index.filter_map do |path, idx|
+        usdt = RbBCC::USDT.new(path: path)
+        USDT_PROBES.each do |probe, fn_name|
+          usdt.enable_probe(probe: probe, fn_name: "#{fn_name}_#{idx}")
+        end
+        puts "[vivariumd] USDT context attached via #{path}"
+        [idx, usdt]
+      rescue StandardError => e
+        warn "[vivariumd] USDT attach failed for #{path}: #{e.class}: #{e.message}"
+        nil
+      end
+
+      if contexts.empty?
+        raise Error, "failed to attach any USDT contexts"
+      end
+
+      contexts
+    end
+
+    def build_span_probe_sources(contexts)
+      contexts.map do |idx, _usdt|
+        SPAN_PROBE_TEMPLATE.gsub("__SUFFIX__", "_#{idx}")
+      end.join("\n")
+    end
+
+    def start_ringbuf_poller(bpf, events_ringbuf, event_log)
+      events_ringbuf.open_ring_buffer do |_ctx, data, size|
+        bytes = data[0, size].to_s.b
+        bytes = bytes.ljust(EVENT_STRUCT_SIZE, "\x00") if bytes.bytesize < EVENT_STRUCT_SIZE
+        event_log.append(bytes)
+        0
+      end
+
+      @ringbuf_thread = Thread.new do
+        loop do
+          bpf.ring_buffer_poll(50)
+        rescue StandardError => e
+          warn "[vivariumd] ringbuf poll error: #{e.class}: #{e.message}"
+        end
+      end
+    end
+
     def attach_ssl_write_uprobe(bpf)
       path = resolve_libssl_path
       unless path
@@ -1949,8 +2065,8 @@ module Vivarium
   end
 
   class ObservationSession
-    def initialize(store:, pid:, tracer:, correlator:)
-      @store = store
+    def initialize(client:, pid:, tracer:, correlator:)
+      @client = client
       @pid = pid
       @tracer = tracer
       @correlator = correlator
@@ -1962,58 +2078,58 @@ module Vivarium
 
       @stopped = true
       @tracer.disable
-      @store.unregister_pid(@pid)
+      @client.unregister(@pid)
       @correlator.stop
     end
   end
 
-  def self.observe(pin_dir: bpf_pin_dir, dest: $stdout, filter: nil, &block)
-    return scoped_observe(pin_dir: pin_dir, dest: dest, filter: filter, &block) if block_given?
+  def self.observe(socket_path: self.socket_path, dest: $stdout, filter: nil, &block)
+    if block_given?
+      return scoped_observe(socket_path: socket_path, dest: dest, filter: filter, &block)
+    end
 
-    top_observe(pin_dir: pin_dir, dest: dest, filter: filter)
+    top_observe(socket_path: socket_path, dest: dest, filter: filter)
   end
 
-  def self.top_observe(pin_dir: bpf_pin_dir, dest: $stdout, filter: nil)
-    store = MapStore.new(pin_dir: pin_dir)
+  def self.top_observe(socket_path: self.socket_path, dest: $stdout, filter: nil)
+    client = DaemonClient.new(socket_path: socket_path)
     pid = Process.pid
-    store.register_pid(pid)
-
     main_tid = gettid
 
     correlator = Correlator.new(
-      pin_dir: pin_dir,
+      socket_path: socket_path,
       observer_pid: pid,
       main_tid: main_tid,
       filter: filter,
       dest: dest
     )
     correlator.start
+    client.register(pid)
 
     tracer = build_observe_tracepoint
     tracer.enable
 
     session = ObservationSession.new(
-      store: store, pid: pid, tracer: tracer, correlator: correlator
+      client: client, pid: pid, tracer: tracer, correlator: correlator
     )
     at_exit { session.stop }
     session
   end
 
-  def self.scoped_observe(pin_dir:, dest:, filter: nil)
-    store = MapStore.new(pin_dir: pin_dir)
+  def self.scoped_observe(socket_path: self.socket_path, dest:, filter: nil)
+    client = DaemonClient.new(socket_path: socket_path)
     pid = Process.pid
-    store.register_pid(pid)
-
     main_tid = gettid
 
     correlator = Correlator.new(
-      pin_dir: pin_dir,
+      socket_path: socket_path,
       observer_pid: pid,
       main_tid: main_tid,
       filter: filter,
       dest: dest
     )
     correlator.start
+    client.register(pid)
 
     tracer = build_observe_tracepoint
     tracer.enable
@@ -2021,7 +2137,7 @@ module Vivarium
     yield
   ensure
     tracer&.disable
-    store&.unregister_pid(pid)
+    client&.unregister(pid)
     correlator&.stop
   end
 
@@ -2048,13 +2164,24 @@ module Vivarium
       else
         "#{tp.defined_class}##{tp.method_id}"
       end
-      is_target = allowlist.include?(signature) || \
+
+      recv = tp.self
+      mid = tp.method_id
+      file_dir_name =
+        if (recv.is_a?(Class) ? recv <= File : recv.is_a?(File)) && SPAN_FILE_METHODS.include?(mid)
+          "File"
+        elsif (recv.is_a?(Class) ? recv <= Dir : recv.is_a?(Dir)) && SPAN_DIR_METHODS.include?(mid)
+          "Dir"
+        end
+
+      is_target = !file_dir_name.nil? || \
+        allowlist.include?(signature) || \
         allow_classes.any? { |klass| tp.defined_class == klass } || \
         allow_classes.any? { |klass| tp.defined_class == klass.singleton_class }
       next unless is_target
 
       file_arg = tail_fit_string(tp.path, SPAN_FILE_ARG_MAX)
-      span_class_name = tp.self.equal?(ENV) ? "ENV" : tp.defined_class.to_s
+      span_class_name = tp.self.equal?(ENV) ? "ENV" : (file_dir_name || tp.defined_class.to_s)
       case tp.event
       when :call, :c_call
         Vivarium::Usdt.start(span_class_name, tp.method_id.to_s, file: file_arg, lineno: tp.lineno)
@@ -2089,13 +2216,18 @@ module Vivarium
   end
 
   def self.run_daemon!(argv = ARGV)
-    options = { pin_dir: bpf_pin_dir, ssl_trace: true, libssl_path: nil,
+    options = { pin_dir: bpf_pin_dir, socket_path: socket_path, ssl_trace: true, libssl_path: nil,
                 env_trace: true,
-                dlopen_trace: true, libc_path: nil }
+                dlopen_trace: true, libc_path: nil, usdt_so_paths: [] }
     OptionParser.new do |opts|
-      opts.banner = "Usage: vivariumd [--pin-dir PATH] [--no-ssl-trace] [--libssl PATH] " \
-                    "[--no-dlopen-trace] [--no-env-trace] [--libc PATH]"
+      opts.banner = "Usage: vivariumd [--pin-dir PATH] [--socket PATH] [--no-ssl-trace] [--libssl PATH] " \
+                    "[--no-dlopen-trace] [--no-env-trace] [--libc PATH] [--usdt-so PATH ...]"
+      opts.on("--usdt-so PATH", "USDT .so to attach (repeatable; " \
+                                "overrides VIVARIUM_USDT_SO_PATH)") do |v|
+        options[:usdt_so_paths] << v
+      end
       opts.on("--pin-dir PATH", "Pinned map directory") { |v| options[:pin_dir] = v }
+      opts.on("--socket PATH", "Unix domain socket path for the HTTP API") { |v| options[:socket_path] = v }
       opts.on("--[no-]ssl-trace", "Attach OpenSSL SSL_write uprobe (default: enabled)") do |v|
         options[:ssl_trace] = v
       end
@@ -2115,15 +2247,19 @@ module Vivarium
 
     Daemon.new(
       pin_dir: options[:pin_dir],
+      socket_path: options[:socket_path],
       ssl_trace: options[:ssl_trace],
       libssl_path: options[:libssl_path],
       dlopen_trace: options[:dlopen_trace],
       env_trace: options[:env_trace],
-      libc_path: options[:libc_path]
+      libc_path: options[:libc_path],
+      usdt_so_paths: options[:usdt_so_paths]
     ).run
   end
 end
 
+require_relative "vivarium/daemon_client"
+require_relative "vivarium/api_server"
 require_relative "vivarium/correlator"
 require_relative "vivarium/display_filter"
 require_relative "vivarium/tree_renderer"

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vivarium
 version: !ruby/object:Gem::Version
-  version: 0.4.2
+  version: 0.5.1
 platform: ruby
 authors:
 - Uchio Kondo
@@ -62,6 +62,7 @@ extensions: []
 extra_rdoc_files: []
 files:
 - CONTEXT.md
+- LICENSE
 - README.md
 - Rakefile
 - examples/box_demo.rb
@@ -81,9 +82,11 @@ files:
 - exe/vivariumd
 - image.png
 - lib/vivarium.rb
+- lib/vivarium/api_server.rb
 - lib/vivarium/box.rb
 - lib/vivarium/cli.rb
 - lib/vivarium/correlator.rb
+- lib/vivarium/daemon_client.rb
 - lib/vivarium/display_filter.rb
 - lib/vivarium/http_decoder.rb
 - lib/vivarium/tree_renderer.rb
@@ -91,7 +94,8 @@ files:
 - logo-simple.png
 - sig/vivarium.rbs
 homepage: https://github.com/udzura/vivarium
-licenses: []
+licenses:
+- Apache-2.0
 metadata:
   homepage_uri: https://github.com/udzura/vivarium
   source_code_uri: https://github.com/udzura/vivarium