tracer

Documentation

Index

• Constants
• Variables
• func Trace(done <-chan struct{}, handler Handler, runner Runner, limits specs.ResLimit) (<-chan specs.TraceResult, error)
• func TraceRun(done <-chan struct{}, start chan<- struct{}, handler Handler, runner Runner, ...) (result specs.TraceResult, err error)
• type Context
  • func (c *Context) Arg0() uint
  • func (c *Context) Arg1() uint
  • func (c *Context) Arg2() uint
  • func (c *Context) Arg3() uint
  • func (c *Context) Arg4() uint
  • func (c *Context) Arg5() uint
  • func (c *Context) GetString(addr uintptr) string
  • func (c *Context) SetReturnValue(retval int)
  • func (c *Context) SyscallNo() uint
• type Handler
• type Runner
• type TraceAction

Constants

const (
	NT_PRSTATUS        = 1
	NT_ARM_SYSTEM_CALL = 0x404

	PTRACE_SET_SYSCALL = 23
)

const (
	MsgDisallow int16 = iota + 1
	MsgHandle
)

MsgDisallow, Msghandle defines the action needed when traped by seccomp filter

Variables

var (
	// UseVMReadv determine whether use ProcessVMReadv syscall to read str
	// initial true and becomes false if tried and failed with ENOSYS
	UseVMReadv = true
)

Functions

func Trace

func Trace(done <-chan struct{}, handler Handler, runner Runner, limits specs.ResLimit) (<-chan specs.TraceResult, error)

Trace starts new goroutine and trace runner with ptrace

func TraceRun

func TraceRun(done <-chan struct{}, start chan<- struct{},
	handler Handler, runner Runner, limits specs.ResLimit) (result specs.TraceResult, err error)

TraceRun start and traces all child process by runner in the calling goroutine parameter done used to cancel work, start is used notify child starts

Types

type Context

type Context struct {
	// Pid is current context process pid
	Pid int
	// contains filtered or unexported fields
}

Context is the context for current syscall trap used to retrive syscall number and arguments

func (*Context) Arg0

func (c *Context) Arg0() uint

Arg0 gets the arg0 for the current syscall

func (*Context) Arg1

func (c *Context) Arg1() uint

Arg1 gets the arg1 for the current syscall

func (*Context) Arg2

func (c *Context) Arg2() uint

Arg2 gets the arg2 for the current syscall

func (*Context) Arg3

func (c *Context) Arg3() uint

Arg3 gets the arg3 for the current syscall

func (*Context) Arg4

func (c *Context) Arg4() uint

Arg4 gets the arg4 for the current syscall

func (*Context) Arg5

func (c *Context) Arg5() uint

Arg5 gets the arg5 for the current syscall

func (*Context) GetString

func (c *Context) GetString(addr uintptr) string

GetString get the string from process data segment

func (*Context) SetReturnValue

func (c *Context) SetReturnValue(retval int)

SetReturnValue set the return value if skip the syscall

func (*Context) SyscallNo

func (c *Context) SyscallNo() uint

SyscallNo get current syscall no

type Handler

type Handler interface {
	Handle(*Context) TraceAction
	GetSyscallName(*Context) (string, error)

	Debug(v ...interface{})
	HandlerDisallow(string) error
}

Handler defines customized handler for traced syscall

type Runner

type Runner interface {
	// Starts starts the child process and return pid and error if failed
	Start() (int, error)
}

Runner represents the process runner

type TraceAction

type TraceAction int

TraceAction defines the action returned by TraceHandle

const (
	// TraceAllow does not do anything
	TraceAllow TraceAction = iota
	// TraceBan blocked the syscall and set the return code specified by SetReturnCode
	TraceBan
	// TraceKill refered as dangerous action have been detacted
	TraceKill
)