feat: detect attach trigger files

src/main/java/dev/rhueno/antiagent/AgentCheck.java

@@ -60,6 +60,11 @@ static Result inspect() {
             dynamicAgentDisabled = true;
         }
 
+        boolean attachTriggerObserved = observeAttachTrigger();
+        if (attachTriggerObserved) {
+            findings.add("attach trigger file observed");
+        }
+
         return new Result(
                 javaAgent,
                 nativeAgent,
@@ -68,6 +73,7 @@ static Result inspect() {
                 attachDisabled,
                 dynamicAgentDisabled,
                 attachListenerRequested,
+                attachTriggerObserved,
                 observeAttachListener(),
                 Collections.unmodifiableList(new ArrayList<String>(findings))
         );
@@ -141,6 +147,28 @@ private static boolean observeAttachListener() {
         return new File("/tmp", ".java_pid" + pid).exists();
     }
 
+    private static boolean observeAttachTrigger() {
+        if (!isUnixLike()) {
+            return false;
+        }
+
+        String pid = pid();
+        if (pid == null) {
+            return false;
+        }
+
+        String name = ".attach_pid" + pid;
+        if (new File(name).exists()) {
+            return true;
+        }
+
+        String temporary = System.getProperty("java.io.tmpdir");
+        if (temporary != null && new File(temporary, name).exists()) {
+            return true;
+        }
+        return new File("/tmp", name).exists();
+    }
+
     static String pid() {
         try {
             Class<?> processHandle = Class.forName("java.lang.ProcessHandle");
@@ -182,17 +210,19 @@ static final class Result {
         final boolean attachDisabled;
         final boolean dynamicAgentDisabled;
         final boolean attachListenerRequested;
+        final boolean attachTriggerObserved;
         final boolean attachListenerObserved;
         final List<String> findings;
 
-        Result(boolean javaAgent, boolean nativeAgent, boolean dynamicAgentEnabled, boolean selfAttachEnabled, boolean attachDisabled, boolean dynamicAgentDisabled, boolean attachListenerRequested, boolean attachListenerObserved, List<String> findings) {
+        Result(boolean javaAgent, boolean nativeAgent, boolean dynamicAgentEnabled, boolean selfAttachEnabled, boolean attachDisabled, boolean dynamicAgentDisabled, boolean attachListenerRequested, boolean attachTriggerObserved, boolean attachListenerObserved, List<String> findings) {
             this.javaAgent = javaAgent;
             this.nativeAgent = nativeAgent;
             this.dynamicAgentEnabled = dynamicAgentEnabled;
             this.selfAttachEnabled = selfAttachEnabled;
             this.attachDisabled = attachDisabled;
             this.dynamicAgentDisabled = dynamicAgentDisabled;
             this.attachListenerRequested = attachListenerRequested;
+            this.attachTriggerObserved = attachTriggerObserved;
             this.attachListenerObserved = attachListenerObserved;
             this.findings = findings;
         }

src/main/java/dev/rhueno/antiagent/AntiAgent.java

@@ -169,7 +169,7 @@ private static void refresh() {
         if (integrity.unsupported) {
             state = State.UNSUPPORTED;
         }
-        if (check.dynamicAgentEnabled || check.selfAttachEnabled || check.attachListenerRequested || attachListenerPresentAtInstall || attachListenerAppeared || runtimeTransformation || monitorFailed) {
+        if (check.dynamicAgentEnabled || check.selfAttachEnabled || check.attachListenerRequested || check.attachTriggerObserved || attachListenerPresentAtInstall || attachListenerAppeared || runtimeTransformation || monitorFailed) {
             state = State.SUSPICIOUS;
         }
         if (check.javaAgent || check.nativeAgent || agentEvent || coreRuntimeTransformation || (!integrity.intact && !integrity.unsupported)) {
@@ -180,6 +180,7 @@ private static void refresh() {
         environmentToken ^= check.attachDisabled ? 0x243f6a8885a308d3L : 0x13198a2e03707344L;
         environmentToken ^= check.dynamicAgentDisabled ? 0xa4093822299f31d0L : 0x082efa98ec4e6c89L;
         environmentToken ^= check.attachListenerRequested ? 0x299f31d0082efa98L : 0xec4e6c89452821e6L;
+        environmentToken ^= check.attachTriggerObserved ? 0xd4e12c77a96b53f1L : 0x5a1f9c2d8e7034b6L;
         environmentToken ^= monitorActive ? 0x452821e638d01377L : 0xbe5466cf34e90c6cL;
         environmentToken ^= monitorFailed ? 0x3f84d5b5b5470917L : 0x9216d5d98979fb1bL;
         environmentToken ^= agentEvent ? 0xd1310ba698dfb5acL : 0x2ffd72dbd01adfb7L;