Kerala Cyber Warriors
KCW Uploader V1.1

needrestart - interpreter support
=================================

Needrestart checks running processes for using obsolete binaries. If no
obsolete binary was found needrestart scans for known interpreters.
There are special packages (NeedRestart::Interp::*) implementing the
source code file list extraction. The executable (/proc/<pid>/exec) is
used to detect the running interpreter.

Whenever source files where located their ctime values are retrieved. If
any of the source files has been changed after process creation time
a restart of the pid is triggered. This is no perfect valuation since
there are no inode information like for loaded binary objects nor has
needrestart any chance to get a verified list of sourced files..


NeedRestart::Interp::Java
-------------------------

Recognized binaries:	/.+/bin/java
Find source file by:	n/a

Try to detected loaded \.(class|jar) files by looking at open files. This
approach will not reliably detect loaded java files. Finding the original
command used to launch a java program is not that easy. Since there is no
shebang we will not find any data about the original command in /proc/$PID.

Running on systemd will allow us to find the service name due to the
cgroup name - seems to work for java daemons like tomcat6.


NeedRestart::Interp::Perl
-------------------------

Recognized binaries:	/usr/(local/)?bin/perl
Find source file by:	command line interpretation

We are using `Module::ScanDeps` to find used packages. This should work on
any static loaded packages, dynamic stuff will fail.


NeedRestart::Interp::Python
---------------------------

Recognized binaries:	/usr/(local/)?bin/python.*
Find source file by:	command line interpretation

The source file is scanned for 'import' and 'from' lines. All paths in
`sys.path` are scanned for the module files. This should work on any
static loaded modules.


NeedRestart::Interp::Ruby
-------------------------

Recognized binaries:	/usr/(local/)?bin/ruby.*
Find source file by:	command line interpretation

The source file is scanned for 'load' and 'require' lines. All paths in
`$:` are scanned for the module files. This should work on any
static loaded modules.