proc

Documentation

Overview

Package proc provides tools for inspecting proc.

Index

• Constants
• Variables
• func GetAppArmorProfile(pid int) string
• func GetCapabilities(pid int) (map[string][]string, error)
• func GetCmdline(pid int) []string
• func GetContainerID(tgid, pid int) string
• func GetCwd(pid int) string
• func GetEnviron(pid int) []string
• func GetNoNewPrivileges(pid int) bool
• func HasNamespace(ns string) (bool, error)
• func IsValidContainerRuntime(s string) bool
• type ContainerRuntime
  • func GetContainerRuntime(tgid, pid int) ContainerRuntime
• type SeccompMode
  • func GetSeccompEnforcingMode(pid int) SeccompMode
• type UserMapping
  • func GetUserNamespaceInfo(pid int) (bool, []UserMapping)

Constants

const (
	// RuntimeDocker is the string for the docker runtime.
	RuntimeDocker ContainerRuntime = "docker"
	// RuntimeRkt is the string for the rkt runtime.
	RuntimeRkt ContainerRuntime = "rkt"
	// RuntimeNspawn is the string for the systemd-nspawn runtime.
	RuntimeNspawn ContainerRuntime = "systemd-nspawn"
	// RuntimeLXC is the string for the lxc runtime.
	RuntimeLXC ContainerRuntime = "lxc"
	// RuntimeLXCLibvirt is the string for the lxc-libvirt runtime.
	RuntimeLXCLibvirt ContainerRuntime = "lxc-libvirt"
	// RuntimeOpenVZ is the string for the openvz runtime.
	RuntimeOpenVZ ContainerRuntime = "openvz"
	// RuntimeKubernetes is the string for the kubernetes runtime.
	RuntimeKubernetes ContainerRuntime = "kube"
	// RuntimeGarden is the string for the garden runtime.
	RuntimeGarden ContainerRuntime = "garden"
	// RuntimePodman is the string for the podman runtime.
	RuntimePodman ContainerRuntime = "podman"
	// RuntimeNotFound is the string for when no container runtime is found.
	RuntimeNotFound ContainerRuntime = "not-found"

	// SeccompModeDisabled is equivalent to "0" in the /proc/{pid}/status file.
	SeccompModeDisabled SeccompMode = "disabled"
	// SeccompModeStrict is equivalent to "1" in the /proc/{pid}/status file.
	SeccompModeStrict SeccompMode = "strict"
	// SeccompModeFiltering is equivalent to "2" in the /proc/{pid}/status file.
	SeccompModeFiltering SeccompMode = "filtering"
)

Variables

var (
	// ContainerRuntimes contains all the container runtimes.
	ContainerRuntimes = []ContainerRuntime{
		RuntimeDocker,
		RuntimeRkt,
		RuntimeNspawn,
		RuntimeLXC,
		RuntimeLXCLibvirt,
		RuntimeOpenVZ,
		RuntimeKubernetes,
		RuntimeGarden,
		RuntimePodman,
	}
)

Functions

func GetAppArmorProfile

func GetAppArmorProfile(pid int) string

GetAppArmorProfile determines the AppArmor profile for a process. If pid is less than one, it returns the AppArmor profile for "self".

func GetCapabilities

func GetCapabilities(pid int) (map[string][]string, error)

GetCapabilities returns the allowed capabilities for the process. If pid is less than one, it returns the capabilities for "self".

func GetCmdline

func GetCmdline(pid int) []string

GetCmdline returns the cmdline for a process. If pid is less than one, it returns the cmdline for "self".

func GetContainerID

func GetContainerID(tgid, pid int) string

GetContainerID returns the container ID for a process if it's running in a container. If pid is less than one, it returns the container ID for "self".

func GetCwd

func GetCwd(pid int) string

GetCwd returns the current working directory for the process. If pid is less than one, it returns the current working directory for "self".

func GetEnviron

func GetEnviron(pid int) []string

GetEnviron returns the environ for a process. If pid is less than one, it returns the environ for "self".

func GetNoNewPrivileges

func GetNoNewPrivileges(pid int) bool

GetNoNewPrivileges returns if no_new_privileges is set for a process. If pid is less than one, it returns if set for "self".

func HasNamespace

func HasNamespace(ns string) (bool, error)

HasNamespace determines if a container is using a particular namespace or the host namespace. The device number of an unnamespaced /proc/1/ns/{ns} is 4 and anything else is higher. Only works from inside a container.

func IsValidContainerRuntime

func IsValidContainerRuntime(s string) bool

IsValidContainerRuntime checks if a string is a valid container runtime.

Types

type ContainerRuntime

type ContainerRuntime string

ContainerRuntime is the type for the various container runtime strings.

func GetContainerRuntime

func GetContainerRuntime(tgid, pid int) ContainerRuntime

GetContainerRuntime returns the container runtime the process is running in. If pid is less than one, it returns the runtime for "self".

type SeccompMode

type SeccompMode string

SeccompMode is the type for the various seccomp mode strings.

func GetSeccompEnforcingMode

func GetSeccompEnforcingMode(pid int) SeccompMode

GetSeccompEnforcingMode returns the seccomp enforcing level (disabled, filtering, strict) for a process. If pid is less than one, it returns the seccomp enforcing mode for "self".

type UserMapping

type UserMapping struct {
	ContainerID int64
	HostID      int64
	Range       int64
}

UserMapping holds the values for a {uid,gid}_map.

func GetUserNamespaceInfo

func GetUserNamespaceInfo(pid int) (bool, []UserMapping)

GetUserNamespaceInfo determines if the process is running in a UserNamespace and returns the mappings if true. If pid is less than one, it returns the user namespace info for "self".