CyberMind-FR 19bcd10b2d perf(antirootkit): preload dpkg path index (O(1) is_backed) instead of dpkg -S per exec (ref #915) ... At ~150 execs/s a dpkg -S subprocess per event can't keep up; the scanner fell permanently behind and never reached recent execs. DpkgIndex loads all /var/lib/dpkg/info/*.list paths into a set once at startup. +2 tests. Co-Authored-By: Gerald KERMA <devel@cybermind.fr>		2026-07-28 12:07:53 +02:00
..
__init__.py
alerts.py	feat(antirootkit): alerting + IOC matching (Task 8)	2026-07-28 08:54:10 +02:00
alertstore.py	fix(antirootkit): make alertstore cross-process via SQLite (ref #915)	2026-07-28 09:49:30 +02:00
allowlist.py
cgroup.py
daemon.py	perf(antirootkit): preload dpkg path index (O(1) is_backed) instead of dpkg -S per exec (ref #915)	2026-07-28 12:07:53 +02:00
dpkg_backing.py	perf(antirootkit): preload dpkg path index (O(1) is_backed) instead of dpkg -S per exec (ref #915)	2026-07-28 12:07:53 +02:00
execlog.py	fix(antirootkit): /status uses ExecLog.count() instead of len(recent(limit=100))	2026-07-28 09:14:12 +02:00
execwatch.py	fix(antirootkit): broad execve audit rule + alert-only enforce policy + deploy fixes (ref #915)	2026-07-28 11:38:47 +02:00
heuristics.py	fix(antirootkit): Task 6 — stricter test assertion + type hints	2026-07-28 08:48:42 +02:00
integrity.py	feat(antirootkit): integrity-scanner wrappers for debsums/rkhunter + authkeys drift (task 7)	2026-07-28 08:51:05 +02:00
main.py	fix(antirootkit): make alertstore cross-process via SQLite (ref #915)	2026-07-28 09:49:30 +02:00
policy.py	fix(antirootkit): broad execve audit rule + alert-only enforce policy + deploy fixes (ref #915)	2026-07-28 11:38:47 +02:00
quarantine.py	fix(antirootkit): shlex.quote c2_ip and unit in quarantine plan (Task 9)	2026-07-28 09:01:41 +02:00