ebpf

package
v0.0.0-...-d4ca6f9 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 27, 2023 License: Apache-2.0 Imports: 51 Imported by: 0

Documentation

Index

Constants

View Source 
const (
	IterateShared int = iota
	Iterate
)
View Source 
const BPFMaxLogFileLen = 72 // BPF_MAX_LOG_FILE_LEN

Variables

This section is empty.

Functions

func FindingToEvent 

func FindingToEvent(f detect.Finding) (*trace.Event, error)

FindingToEvent converts a detect.Finding into a trace.Event This is used because the pipeline expects trace.Event, but the rule engine returns detect.Finding

func GetCaptureEventsList 

func GetCaptureEventsList(cfg Config) map[events.ID]eventConfig

GetCaptureEventsList sets events used to capture data

func GetEssentialEventsList 

func GetEssentialEventsList() map[events.ID]eventConfig

GetEssentialEventsList sets the default events used by tracee

func LoadKallsymsValues 

func LoadKallsymsValues(ksymsTable helpers.KernelSymbolTable, ksymbols []string) map[string]*helpers.KernelSymbol

func MergeErrors 

func MergeErrors(cs ...<-chan error) <-chan error

MergeErrors merges multiple channels of errors. Based on https://blog.golang.org/pipelines.

func SendKsymbolsToMap 

func SendKsymbolsToMap(bpfKsymsMap *libbpfgo.BPFMap, ksymbols map[string]*helpers.KernelSymbol) error

func ValidateKsymbolsTable 

func ValidateKsymbolsTable(ksyms helpers.KernelSymbolTable) bool

ValidateKsymbolsTable checks if the addresses in the table are valid by checking a specific symbol address. The reason for the addresses to be invalid is if the capabilities required to read the kallsyms file are not given. The chosen symbol used here is "security_file_open" because it is a must-have symbol for tracee to run.

Types

type BPFLog 

type BPFLog struct {
	// contains filtered or unexported fields
}

BPFLog struct contains aggregated data about a bpf log origin

func (BPFLog) CPU 

func (b BPFLog) CPU() uint32

func (BPFLog) Count 

func (b BPFLog) Count() uint32

func (*BPFLog) Decode 

func (b *BPFLog) Decode(rawBuffer []byte) error

func (BPFLog) Error 

func (b BPFLog) Error() string

func (BPFLog) File 

func (b BPFLog) File() []byte

func (BPFLog) FileAsString 

func (b BPFLog) FileAsString() string

func (BPFLog) ID 

func (b BPFLog) ID() uint32

func (BPFLog) Line 

func (b BPFLog) Line() uint32

func (BPFLog) LogLevel 

func (b BPFLog) LogLevel() logger.Level

func (BPFLog) Return 

func (b BPFLog) Return() int64

func (BPFLog) Size 

func (b BPFLog) Size() int

func (BPFLog) Type 

func (b BPFLog) Type() BPFLogType

type BPFLogType 

type BPFLogType uint32
const (
	BPFLogIDUnspec BPFLogType = iota // BPF_LOG_ID_UNSPEC

	// tracee functions
	BPFLogIDInitContext // BPF_LOG_ID_INIT_CONTEXT

	// bpf helpers functions
	BPFLogIDMapLookupElem  // BPF_LOG_ID_MAP_LOOKUP_ELEM
	BPFLogIDMapUpdateElem  // BPF_LOG_ID_MAP_UPDATE_ELEM
	BPFLogIDMapDeleteElem  // BPF_LOG_ID_MAP_DELETE_ELEM
	BPFLogIDGetCurrentComm // BPF_LOG_ID_GET_CURRENT_COMM
	BPFLogIDTailCall       // BPF_LOG_ID_TAIL_CALL
	BPFLogIDMemRead        // BPF_LOG_ID_MEM_READ
)

func (BPFLogType) String 

func (b BPFLogType) String() string

type CapabilitiesConfig 

type CapabilitiesConfig struct {
	BypassCaps bool
	AddCaps    []string
	DropCaps   []string
}

type CaptureConfig 

type CaptureConfig struct {
	OutputPath      string
	FileWrite       bool
	Module          bool
	FilterFileWrite []string
	Exec            bool
	Mem             bool
	Bpf             bool
	Net             pcaps.Config
}

type Config 

type Config struct {
	Policies           *policy.Policies
	Capture            *CaptureConfig
	Capabilities       *CapabilitiesConfig
	Output             *OutputConfig
	Cache              queue.CacheConfig
	PerfBufferSize     int
	BlobPerfBufferSize int

	BTFObjPath       string
	BPFObjBytes      []byte
	KernelConfig     *helpers.KernelConfig
	ChanEvents       chan trace.Event
	OSInfo           *helpers.OSInfo
	Sockets          runtime.Sockets
	ContainersEnrich bool
	EngineConfig     engine.Config
	MetricsEnabled   bool
	// contains filtered or unexported fields
}

Config is a struct containing user defined configuration of tracee

func (Config) Validate 

func (tc Config) Validate() error

Validate does static validation of the configuration

type InitValues 

type InitValues struct {
	// contains filtered or unexported fields
}

InitValues determines if to initialize values that might be needed by eBPF programs

type OutputConfig 

type OutputConfig struct {
	StackAddresses bool
	ExecEnv        bool
	RelativeTime   bool
	ExecHash       bool

	ParseArguments    bool
	ParseArgumentsFDs bool
	EventsSorting     bool
}

type Tracee 

type Tracee struct {
	OutDir *os.File // use utils.XXX functions to create or write to this file

	// BPF Maps
	StackAddressesMap *bpf.BPFMap
	FDArgPathMap      *bpf.BPFMap
	// contains filtered or unexported fields
}

Tracee traces system calls and system events using eBPF

func New 

func New(cfg Config) (*Tracee, error)

New creates a new Tracee instance based on a given valid Config. It is expected that it won't cause external system side effects (reads, writes, etc.)

func (*Tracee) AddReadyCallback 

func (t *Tracee) AddReadyCallback(f func(ctx gocontext.Context))

AddReadyCallback sets a callback function to be called when the tracee started all its probes and is ready to receive events

func (*Tracee) Close 

func (t *Tracee) Close()

Close cleans up created resources

func (*Tracee) GetTailCalls 

func (t *Tracee) GetTailCalls() ([]events.TailCall, error)

func (*Tracee) Init 

func (t *Tracee) Init() error

Init initialize tracee instance and it's various subsystems, potentially performing external system operations to initialize them. NOTE: any initialization logic, especially one that causes side effects, should go here and not New().

func (*Tracee) NewKernelSymbols 

func (t *Tracee) NewKernelSymbols() error

func (*Tracee) RegisterEventDerivation 

func (t *Tracee) RegisterEventDerivation(deriveFrom events.ID, deriveTo events.ID, deriveCondition func() bool, deriveLogic derive.DeriveFunction) error

RegisterEventDerivation registers an event derivation handler for tracee to use in the event pipeline

func (*Tracee) RegisterEventProcessor 

func (t *Tracee) RegisterEventProcessor(id events.ID, proc func(evt *trace.Event) error) error

RegisterEventProcessor registers a pipeline processing handler for an event

func (*Tracee) Run 

func (t *Tracee) Run(ctx gocontext.Context) error

Run starts the trace. it will run until ctx is cancelled

func (*Tracee) Running 

func (t *Tracee) Running() bool

Running returns true if the tracee is running

func (*Tracee) Stats 

func (t *Tracee) Stats() *metrics.Stats

func (*Tracee) UpdateBPFKsymbolsMap 

func (t *Tracee) UpdateBPFKsymbolsMap() error

func (*Tracee) UpdateKallsyms 

func (t *Tracee) UpdateKallsyms() error

func (*Tracee) UpdateKernelSymbols 

func (t *Tracee) UpdateKernelSymbols() error

func (*Tracee) WaitForPipeline 

func (t *Tracee) WaitForPipeline(errs ...<-chan error) error

WaitForPipeline waits for results from all error channels.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.