ebpf

package
v0.20.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Feb 8, 2024 License: Apache-2.0 Imports: 54 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	IterateShared int = iota
	Iterate
)
View Source 
const BPFMaxLogFileLen = 72 // BPF_MAX_LOG_FILE_LEN
View Source 
const (
	ConfigMap = "config_map"
)

Variables

This section is empty.

Functions

func FindingToEvent added in v0.10.0 

func FindingToEvent(f *detect.Finding) (*trace.Event, error)

FindingToEvent converts a detect.Finding into a trace.Event This is used because the pipeline expects trace.Event, but the rule engine returns detect.Finding

func GetCaptureEventsList added in v0.8.0 

func GetCaptureEventsList(cfg config.Config) map[events.ID]events.EventState

GetCaptureEventsList sets events used to capture data.

func MergeErrors 

func MergeErrors(cs ...<-chan error) <-chan error

MergeErrors merges multiple channels of errors (https://blog.golang.org/pipelines)

Types

type BPFLog added in v0.11.0 

type BPFLog struct {
	// contains filtered or unexported fields
}

BPFLog struct contains aggregated data about a bpf log origin

func (BPFLog) CPU added in v0.11.0 

func (b BPFLog) CPU() uint32

func (BPFLog) Count added in v0.11.0 

func (b BPFLog) Count() uint32

func (*BPFLog) Decode added in v0.11.0 

func (b *BPFLog) Decode(rawBuffer []byte) error

func (BPFLog) Error added in v0.11.0 

func (b BPFLog) Error() string

func (BPFLog) File added in v0.11.0 

func (b BPFLog) File() []byte

func (BPFLog) FileAsString added in v0.11.0 

func (b BPFLog) FileAsString() string

func (BPFLog) ID added in v0.11.0 

func (b BPFLog) ID() uint32

func (BPFLog) Line added in v0.11.0 

func (b BPFLog) Line() uint32

func (BPFLog) LogLevel added in v0.11.0 

func (b BPFLog) LogLevel() logger.Level

func (BPFLog) Return added in v0.11.0 

func (b BPFLog) Return() int64

func (BPFLog) Size added in v0.11.0 

func (b BPFLog) Size() int

func (BPFLog) Type added in v0.11.0 

func (b BPFLog) Type() BPFLogType

type BPFLogType added in v0.11.0 

type BPFLogType uint32
const (
	BPFLogIDUnspec BPFLogType = iota // BPF_LOG_ID_UNSPEC

	// tracee functions
	BPFLogIDInitContext // BPF_LOG_ID_INIT_CONTEXT

	// bpf helpers functions
	BPFLogIDMapLookupElem  // BPF_LOG_ID_MAP_LOOKUP_ELEM
	BPFLogIDMapUpdateElem  // BPF_LOG_ID_MAP_UPDATE_ELEM
	BPFLogIDMapDeleteElem  // BPF_LOG_ID_MAP_DELETE_ELEM
	BPFLogIDGetCurrentComm // BPF_LOG_ID_GET_CURRENT_COMM
	BPFLogIDTailCall       // BPF_LOG_ID_TAIL_CALL
	BPFLogIDMemRead        // BPF_LOG_ID_MEM_READ
)

func (BPFLogType) String added in v0.11.0 

func (b BPFLogType) String() string

type Config 

type Config struct {
	TraceePid   uint32
	Options     uint32
	CgroupV1Hid uint32

	PoliciesVersion uint16
	PoliciesConfig  policy.PoliciesConfig
	// contains filtered or unexported fields
}

Config mirrors the C struct config_entry (config_entry_t).

Order of fields is important, as it is used as a value for the ConfigMap BPF map.

func (*Config) UpdateBPF added in v0.20.0 

func (c *Config) UpdateBPF(bpfModule *bpf.Module) error

UpdateBPF updates the ConfigMap BPF map with the current config.

type InitValues added in v0.8.1 

type InitValues struct {
	Kallsyms bool
}

type Tracee 

type Tracee struct {
	OutDir *os.File // use utils.XXX functions to create or write to this file

	// BPF Maps
	StackAddressesMap *bpf.BPFMap
	FDArgPathMap      *bpf.BPFMap
	// contains filtered or unexported fields
}

Tracee traces system calls and system events using eBPF

func New 

func New(cfg config.Config) (*Tracee, error)

New creates a new Tracee instance based on a given valid Config. It is expected that it won't cause external system side effects (reads, writes, etc).

func (*Tracee) AddReadyCallback added in v0.15.0 

func (t *Tracee) AddReadyCallback(f func(ctx gocontext.Context))

AddReadyCallback sets a callback function to be called when the tracee started all its probes and is ready to receive events

func (*Tracee) Close 

func (t *Tracee) Close()

Close cleans up created resources

func (*Tracee) DisableEvent added in v0.18.0 

func (t *Tracee) DisableEvent(eventName string) error

func (*Tracee) DisableRule added in v0.18.0 

func (t *Tracee) DisableRule(policyNames []string, ruleId string) error

DisableRule disables a rule in the specified policies

func (*Tracee) EnableEvent added in v0.18.0 

func (t *Tracee) EnableEvent(eventName string) error

func (*Tracee) EnableRule added in v0.18.0 

func (t *Tracee) EnableRule(policyNames []string, ruleId string) error

EnableRule enables a rule in the specified policies

func (*Tracee) Engine added in v0.20.0 

func (t *Tracee) Engine() *engine.Engine

func (*Tracee) Init added in v0.8.1 

func (t *Tracee) Init(ctx gocontext.Context) error

Init initialize tracee instance and it's various subsystems, potentially performing external system operations to initialize them. NOTE: any initialization logic, especially one that causes side effects, should go here and not New().

func (*Tracee) PrepareBuiltinDataSources added in v0.17.0 

func (t *Tracee) PrepareBuiltinDataSources() []detect.DataSource

PrepareBuiltinDataSources returns a list of all data sources tracee makes available built-in

func (*Tracee) RegisterEventDerivation added in v0.11.0 

func (t *Tracee) RegisterEventDerivation(deriveFrom events.ID, deriveTo events.ID, deriveCondition func() bool, deriveLogic derive.DeriveFunction) error

RegisterEventDerivation registers an event derivation handler for tracee to use in the event pipeline

func (*Tracee) RegisterEventProcessor added in v0.11.0 

func (t *Tracee) RegisterEventProcessor(id events.ID, proc func(evt *trace.Event) error)

RegisterEventProcessor registers a new event processor for a specific event id.

func (*Tracee) Run 

func (t *Tracee) Run(ctx gocontext.Context) error

Run starts the trace. it will run until ctx is cancelled

func (*Tracee) Running added in v0.8.1 

func (t *Tracee) Running() bool

Running returns true if the tracee is running

func (*Tracee) Stats 

func (t *Tracee) Stats() *metrics.Stats

func (*Tracee) Subscribe added in v0.18.0 

func (t *Tracee) Subscribe(policyNames []string) (*streams.Stream, error)

Subscribe returns a stream subscribed to selected policies

func (*Tracee) SubscribeAll added in v0.18.0 

func (t *Tracee) SubscribeAll() *streams.Stream

SubscribeAll returns a stream subscribed to all policies

func (*Tracee) Unsubscribe added in v0.18.0 

func (t *Tracee) Unsubscribe(s *streams.Stream)

Unsubscribe unsubscribes stream

func (*Tracee) UpdateKallsyms added in v0.11.0 

func (t *Tracee) UpdateKallsyms() error

func (*Tracee) WaitForPipeline 

func (t *Tracee) WaitForPipeline(errs ...<-chan error) error

WaitForPipeline waits for results from all error channels.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.