Documentation ¶
Overview ¶
Package activitytree holds activitytree related files
Package activitytree holds activitytree related files ¶
Package activitytree holds activitytree related files ¶
Package activitytree holds activitytree related files ¶
Package activitytree holds activitytree related files ¶
Package activitytree holds activitytree related files ¶
Package activitytree holds activitytree related files ¶
Package activitytree holds activitytree related files ¶
Package activitytree holds activitytree related files ¶
Package activitytree holds activitytree related files ¶
Package activitytree holds activitytree related files ¶
Package activitytree holds activitytree related files ¶
Package activitytree holds activitytree related files
Index ¶
- Constants
- Variables
- func AppendIfNotPresent(slice []string, toAdd string) ([]string, bool)
- func ExtractFirstParent(path string) (string, int)
- func GetNextAncestorBinaryOrArgv0(entry *model.ProcessContext) *model.ProcessCacheEntry
- func ProtoDecodeActivityTree(dest *ActivityTree, nodes []*adproto.ProcessActivityNode)
- func ProtoDecodeTimestamp(nanos uint64) time.Time
- func TimestampToProto(t *time.Time) uint64
- func ToProto(at *ActivityTree) []*adproto.ProcessActivityNode
- type ActivityTree
- func (at *ActivityTree) AppendChild(node *ProcessNode)
- func (at *ActivityTree) AppendImageTag(_ string)
- func (at *ActivityTree) ComputeActivityTreeStats()
- func (at *ActivityTree) ComputeSyscallsList() []uint32
- func (at *ActivityTree) Contains(event *model.Event, insertMissingProcesses bool, imageTag string, ...) (bool, error)
- func (at *ActivityTree) CreateProcessNode(entry *model.ProcessCacheEntry, imageTag string, ...) (*ProcessNode, bool, error)
- func (at *ActivityTree) Debug(w io.Writer)
- func (at *ActivityTree) DifferentiateArgs()
- func (at *ActivityTree) EvictImageTag(imageTag string)
- func (at *ActivityTree) ExtractPaths(_, fimEnabled, lineageEnabled bool) (map[string][]string, map[string][]string)
- func (at *ActivityTree) ExtractSyscalls(arch string) []string
- func (at *ActivityTree) FindMatchingRootNodes(arg0 string) []*ProcessNode
- func (at *ActivityTree) GetChildren() *[]*ProcessNode
- func (at *ActivityTree) GetParent() ProcessNodeParent
- func (at *ActivityTree) GetSiblings() *[]*ProcessNode
- func (at *ActivityTree) Insert(event *model.Event, insertMissingProcesses bool, imageTag string, ...) (bool, error)
- func (at *ActivityTree) IsEmpty() bool
- func (at *ActivityTree) PrepareGraphData(title string, resolver *process.EBPFResolver) utils.Graph
- func (at *ActivityTree) ScrubProcessArgsEnvs(resolver *process.EBPFResolver)
- func (at *ActivityTree) SendStats(client statsd.ClientInterface) error
- func (at *ActivityTree) Snapshot(newEvent func() *model.Event)
- func (at *ActivityTree) TagAllNodes(imageTag string)
- type BindNode
- type DNSNode
- type FileNode
- type IMDSNode
- type NodeDroppedReason
- type NodeGenerationType
- type OpenNode
- type Owner
- type PathsReducer
- type PatternReducer
- type ProcessNode
- func (pn *ProcessNode) AppendChild(node *ProcessNode)
- func (pn *ProcessNode) AppendImageTag(imageTag string)
- func (pn *ProcessNode) EvictImageTag(imageTag string, DNSNames *utils.StringKeys, SyscallsMask map[int]int) bool
- func (pn *ProcessNode) GetChildren() *[]*ProcessNode
- func (pn *ProcessNode) GetParent() ProcessNodeParent
- func (pn *ProcessNode) GetSiblings() *[]*ProcessNode
- func (pn *ProcessNode) InsertBindEvent(evt *model.Event, imageTag string, generationType NodeGenerationType, ...) bool
- func (pn *ProcessNode) InsertDNSEvent(evt *model.Event, imageTag string, generationType NodeGenerationType, ...) bool
- func (pn *ProcessNode) InsertFileEvent(fileEvent *model.FileEvent, event *model.Event, imageTag string, ...) bool
- func (pn *ProcessNode) InsertIMDSEvent(evt *model.Event, imageTag string, generationType NodeGenerationType, ...) bool
- func (pn *ProcessNode) InsertSyscalls(e *model.Event, imageTag string, syscallMask map[int]int, stats *Stats, ...) bool
- func (pn *ProcessNode) Matches(entry *model.Process, matchArgs bool, normalize bool) bool
- func (pn *ProcessNode) TagAllNodes(imageTag string)
- type ProcessNodeParent
- type SocketNode
- type Stats
- type SyscallNode
Constants ¶
const CookieToProcessNodeCacheSize = 128
CookieToProcessNodeCacheSize defines the "cookie to process" node cache size
const MaxMmapedFiles = 128
MaxMmapedFiles defines the max mmaped files
Variables ¶
var ( // ErrBrokenLineage is returned when the given process don't have a full lineage ErrBrokenLineage = errors.New("broken lineage") // ErrNotValidRootNode is returned when trying to insert a process with an invalide root node ErrNotValidRootNode = errors.New("root node not valid") )
Functions ¶
func AppendIfNotPresent ¶
AppendIfNotPresent append a token to a slice only if the token is not already present
func ExtractFirstParent ¶
ExtractFirstParent extracts first parent
func GetNextAncestorBinaryOrArgv0 ¶
func GetNextAncestorBinaryOrArgv0(entry *model.ProcessContext) *model.ProcessCacheEntry
GetNextAncestorBinaryOrArgv0 returns the first ancestor with a different binary, or a different argv0 in the case of busybox processes
func ProtoDecodeActivityTree ¶
func ProtoDecodeActivityTree(dest *ActivityTree, nodes []*adproto.ProcessActivityNode)
ProtoDecodeActivityTree decodes an ActivityTree structure
func ProtoDecodeTimestamp ¶
ProtoDecodeTimestamp decodes a nanosecond representation of a timestamp
func TimestampToProto ¶
TimestampToProto encode a timestamp
func ToProto ¶
func ToProto(at *ActivityTree) []*adproto.ProcessActivityNode
ToProto encodes an activity tree to its protobuf representation
Types ¶
type ActivityTree ¶
type ActivityTree struct { Stats *Stats DNSMatchMaxDepth int CookieToProcessNode *simplelru.LRU[cookieSelector, *ProcessNode] ProcessNodes []*ProcessNode `json:"-"` // top level lists used to summarize the content of the tree DNSNames *utils.StringKeys SyscallsMask map[int]int // contains filtered or unexported fields }
ActivityTree contains a process tree and its activities. This structure has no locks.
func NewActivityTree ¶
func NewActivityTree(validator Owner, pathsReducer *PathsReducer, treeType string) *ActivityTree
NewActivityTree returns a new ActivityTree instance
func (*ActivityTree) AppendChild ¶
func (at *ActivityTree) AppendChild(node *ProcessNode)
AppendChild appends a new root node in the ActivityTree
func (*ActivityTree) AppendImageTag ¶
func (at *ActivityTree) AppendImageTag(_ string)
AppendImageTag appends the given image tag
func (*ActivityTree) ComputeActivityTreeStats ¶
func (at *ActivityTree) ComputeActivityTreeStats()
ComputeActivityTreeStats computes the initial counts of the activity tree stats
func (*ActivityTree) ComputeSyscallsList ¶
func (at *ActivityTree) ComputeSyscallsList() []uint32
ComputeSyscallsList computes the top level list of syscalls
func (*ActivityTree) Contains ¶
func (at *ActivityTree) Contains(event *model.Event, insertMissingProcesses bool, imageTag string, generationType NodeGenerationType, resolvers *resolvers.EBPFResolvers) (bool, error)
Contains looks up the event in the activity tree
func (*ActivityTree) CreateProcessNode ¶
func (at *ActivityTree) CreateProcessNode(entry *model.ProcessCacheEntry, imageTag string, generationType NodeGenerationType, dryRun bool, resolvers *resolvers.EBPFResolvers) (*ProcessNode, bool, error)
CreateProcessNode looks up or inserts the provided entry in the tree
func (*ActivityTree) Debug ¶
func (at *ActivityTree) Debug(w io.Writer)
Debug dumps the content of an activity tree
func (*ActivityTree) DifferentiateArgs ¶
func (at *ActivityTree) DifferentiateArgs()
DifferentiateArgs enables the args differentiation feature
func (*ActivityTree) EvictImageTag ¶
func (at *ActivityTree) EvictImageTag(imageTag string)
EvictImageTag will remove every trace of the given image tag from the tree
func (*ActivityTree) ExtractPaths ¶
func (at *ActivityTree) ExtractPaths(_, fimEnabled, lineageEnabled bool) (map[string][]string, map[string][]string)
ExtractPaths returns the exec / fim, exec / parent paths
func (*ActivityTree) ExtractSyscalls ¶
func (at *ActivityTree) ExtractSyscalls(arch string) []string
ExtractSyscalls return the syscalls present in an activity tree
func (*ActivityTree) FindMatchingRootNodes ¶
func (at *ActivityTree) FindMatchingRootNodes(arg0 string) []*ProcessNode
FindMatchingRootNodes finds and returns the matching root nodes
func (*ActivityTree) GetChildren ¶
func (at *ActivityTree) GetChildren() *[]*ProcessNode
GetChildren returns the list of root ProcessNodes from the ActivityTree
func (*ActivityTree) GetParent ¶
func (at *ActivityTree) GetParent() ProcessNodeParent
GetParent returns nil for the ActivityTree
func (*ActivityTree) GetSiblings ¶
func (at *ActivityTree) GetSiblings() *[]*ProcessNode
GetSiblings returns the list of siblings of the current node
func (*ActivityTree) Insert ¶
func (at *ActivityTree) Insert(event *model.Event, insertMissingProcesses bool, imageTag string, generationType NodeGenerationType, resolvers *resolvers.EBPFResolvers) (bool, error)
Insert inserts the event in the activity tree
func (*ActivityTree) IsEmpty ¶
func (at *ActivityTree) IsEmpty() bool
IsEmpty returns true if the tree is empty
func (*ActivityTree) PrepareGraphData ¶
func (at *ActivityTree) PrepareGraphData(title string, resolver *process.EBPFResolver) utils.Graph
PrepareGraphData returns a graph from the activity tree
func (*ActivityTree) ScrubProcessArgsEnvs ¶
func (at *ActivityTree) ScrubProcessArgsEnvs(resolver *process.EBPFResolver)
ScrubProcessArgsEnvs scrubs and retains process args and envs
func (*ActivityTree) SendStats ¶
func (at *ActivityTree) SendStats(client statsd.ClientInterface) error
SendStats sends the tree statistics
func (*ActivityTree) Snapshot ¶
func (at *ActivityTree) Snapshot(newEvent func() *model.Event)
Snapshot uses procfs to snapshot the nodes of the tree
func (*ActivityTree) TagAllNodes ¶
func (at *ActivityTree) TagAllNodes(imageTag string)
TagAllNodes tags all the activity tree's nodes with the given image tag
type BindNode ¶
type BindNode struct { MatchedRules []*model.MatchedRule ImageTags []string GenerationType NodeGenerationType Port uint16 IP string Protocol uint16 }
BindNode is used to store a bind node
type DNSNode ¶
type DNSNode struct { MatchedRules []*model.MatchedRule ImageTags []string GenerationType NodeGenerationType Requests []model.DNSEvent }
DNSNode is used to store a DNS node
func NewDNSNode ¶
func NewDNSNode(event *model.DNSEvent, rules []*model.MatchedRule, generationType NodeGenerationType, imageTag string) *DNSNode
NewDNSNode returns a new DNSNode instance
type FileNode ¶
type FileNode struct { MatchedRules []*model.MatchedRule Name string ImageTags []string IsPattern bool File *model.FileEvent GenerationType NodeGenerationType FirstSeen time.Time Open *OpenNode Children map[string]*FileNode }
FileNode holds a tree representation of a list of files
func NewFileNode ¶
func NewFileNode(fileEvent *model.FileEvent, event *model.Event, name string, imageTag string, generationType NodeGenerationType, reducedFilePath string, resolvers *resolvers.EBPFResolvers) *FileNode
NewFileNode returns a new FileActivityNode instance
func (*FileNode) InsertFileEvent ¶
func (fn *FileNode) InsertFileEvent(fileEvent *model.FileEvent, event *model.Event, remainingPath string, imageTag string, generationType NodeGenerationType, stats *Stats, dryRun bool, reducedPath string, resolvers *resolvers.EBPFResolvers) bool
InsertFileEvent inserts an event in a FileNode. This function returns true if a new entry was added, false if the event was dropped.
type IMDSNode ¶
type IMDSNode struct { MatchedRules []*model.MatchedRule ImageTags []string GenerationType NodeGenerationType Event model.IMDSEvent }
IMDSNode is used to store a IMDS node
func NewIMDSNode ¶
func NewIMDSNode(event *model.IMDSEvent, rules []*model.MatchedRule, generationType NodeGenerationType, imageTag string) *IMDSNode
NewIMDSNode returns a new IMDSNode instance
type NodeDroppedReason ¶
type NodeDroppedReason byte
NodeDroppedReason is used to list the reasons to drop a node
func (NodeDroppedReason) String ¶
func (reason NodeDroppedReason) String() string
func (NodeDroppedReason) Tag ¶
func (reason NodeDroppedReason) Tag() string
Tag returns the metric tag associated with this dropped reason, it's basically fmt.Sprintf("reason:%s", reason)
type NodeGenerationType ¶
type NodeGenerationType byte
NodeGenerationType is used to indicate if a node was generated by a runtime or snapshot event IMPORTANT: IT MUST STAY IN SYNC WITH `adproto.GenerationType`
const ( // Unknown is a node that was added at an unknown time Unknown NodeGenerationType = 0 // Runtime is a node that was added at runtime Runtime NodeGenerationType = 1 // Snapshot is a node that was added during the snapshot Snapshot NodeGenerationType = 2 // ProfileDrift is a node that was added because of a drift from a security profile ProfileDrift NodeGenerationType = 3 // WorkloadWarmup is a node that was added of a drift in a warming up profile WorkloadWarmup NodeGenerationType = 4 // MaxNodeGenerationType is the maximum node type MaxNodeGenerationType NodeGenerationType = 4 )
func (NodeGenerationType) String ¶
func (genType NodeGenerationType) String() string
func (NodeGenerationType) Tag ¶
func (genType NodeGenerationType) Tag() string
Tag returns the metric tag associated with this generation type, it's basically fmt.Sprintf("generation_type:%s", genType)
type OpenNode ¶
type OpenNode struct { model.SyscallEvent Flags uint32 Mode uint32 }
OpenNode contains the relevant fields of an Open event on which we might want to write a profiling rule
type Owner ¶
type Owner interface { MatchesSelector(entry *model.ProcessCacheEntry) bool IsEventTypeValid(evtType model.EventType) bool NewProcessNodeCallback(p *ProcessNode) }
Owner is used to communicate with the owner of the activity tree
type PathsReducer ¶
type PathsReducer struct {
// contains filtered or unexported fields
}
PathsReducer is used to reduce the paths in an activity tree according to predefined heuristics
func NewPathsReducer ¶
func NewPathsReducer() *PathsReducer
NewPathsReducer returns a new PathsReducer
func (*PathsReducer) ReducePath ¶
func (r *PathsReducer) ReducePath(path string, fileEvent *model.FileEvent, node *ProcessNode) string
ReducePath reduces a path according to the predefined heuristics
type PatternReducer ¶
type PatternReducer struct { Pattern *regexp.Regexp Hint string PreCheck func(fileEvent *model.FileEvent) bool Callback func(ctx *callbackContext) }
PatternReducer is used to reduce the paths in an activity tree according to a given pattern
type ProcessNode ¶
type ProcessNode struct { Process model.Process Parent ProcessNodeParent GenerationType NodeGenerationType ImageTags []string MatchedRules []*model.MatchedRule Files map[string]*FileNode DNSNames map[string]*DNSNode IMDSEvents map[model.IMDSEvent]*IMDSNode Sockets []*SocketNode Syscalls []*SyscallNode Children []*ProcessNode }
ProcessNode holds the activity of a process
func NewProcessNode ¶
func NewProcessNode(entry *model.ProcessCacheEntry, generationType NodeGenerationType, resolvers *resolvers.EBPFResolvers) *ProcessNode
NewProcessNode returns a new ProcessNode instance
func (*ProcessNode) AppendChild ¶
func (pn *ProcessNode) AppendChild(node *ProcessNode)
AppendChild appends a new root node in the ActivityTree
func (*ProcessNode) AppendImageTag ¶
func (pn *ProcessNode) AppendImageTag(imageTag string)
AppendImageTag appends the given image tag to the list
func (*ProcessNode) EvictImageTag ¶
func (pn *ProcessNode) EvictImageTag(imageTag string, DNSNames *utils.StringKeys, SyscallsMask map[int]int) bool
EvictImageTag will remmove every trace of this image tag, and returns true if the process node should be removed also, recompute the list of dnsnames and syscalls
func (*ProcessNode) GetChildren ¶
func (pn *ProcessNode) GetChildren() *[]*ProcessNode
GetChildren returns the list of children from the ProcessNode
func (*ProcessNode) GetParent ¶
func (pn *ProcessNode) GetParent() ProcessNodeParent
GetParent returns nil for the ActivityTree
func (*ProcessNode) GetSiblings ¶
func (pn *ProcessNode) GetSiblings() *[]*ProcessNode
GetSiblings returns the list of siblings of the current node
func (*ProcessNode) InsertBindEvent ¶
func (pn *ProcessNode) InsertBindEvent(evt *model.Event, imageTag string, generationType NodeGenerationType, stats *Stats, dryRun bool) bool
InsertBindEvent inserts a bind event in a process node
func (*ProcessNode) InsertDNSEvent ¶
func (pn *ProcessNode) InsertDNSEvent(evt *model.Event, imageTag string, generationType NodeGenerationType, stats *Stats, DNSNames *utils.StringKeys, dryRun bool, dnsMatchMaxDepth int) bool
InsertDNSEvent inserts a DNS event in a process node
func (*ProcessNode) InsertFileEvent ¶
func (pn *ProcessNode) InsertFileEvent(fileEvent *model.FileEvent, event *model.Event, imageTag string, generationType NodeGenerationType, stats *Stats, dryRun bool, reducer *PathsReducer, resolvers *resolvers.EBPFResolvers) bool
InsertFileEvent inserts the provided file event in the current node. This function returns true if a new entry was added, false if the event was dropped.
func (*ProcessNode) InsertIMDSEvent ¶
func (pn *ProcessNode) InsertIMDSEvent(evt *model.Event, imageTag string, generationType NodeGenerationType, stats *Stats, dryRun bool) bool
InsertIMDSEvent inserts an IMDS event in a process node
func (*ProcessNode) InsertSyscalls ¶
func (pn *ProcessNode) InsertSyscalls(e *model.Event, imageTag string, syscallMask map[int]int, stats *Stats, dryRun bool) bool
InsertSyscalls inserts the syscall of the process in the dump
func (*ProcessNode) Matches ¶
Matches return true if the process fields used to generate the dump are identical with the provided model.Process
func (*ProcessNode) TagAllNodes ¶
func (pn *ProcessNode) TagAllNodes(imageTag string)
TagAllNodes tags this process, its files/dns/socks and childrens with the given image tag
type ProcessNodeParent ¶
type ProcessNodeParent interface { GetParent() ProcessNodeParent GetChildren() *[]*ProcessNode GetSiblings() *[]*ProcessNode AppendChild(node *ProcessNode) AppendImageTag(imageTag string) }
ProcessNodeParent is an interface used to identify the parent of a process node
type SocketNode ¶
type SocketNode struct { Family string GenerationType NodeGenerationType Bind []*BindNode }
SocketNode is used to store a Socket node and associated events
func NewSocketNode ¶
func NewSocketNode(family string, generationType NodeGenerationType) *SocketNode
NewSocketNode returns a new SocketNode instance
func (*SocketNode) InsertBindEvent ¶
func (sn *SocketNode) InsertBindEvent(evt *model.BindEvent, imageTag string, generationType NodeGenerationType, rules []*model.MatchedRule, dryRun bool) bool
InsertBindEvent inserts a bind even inside a socket node
func (*SocketNode) Matches ¶
func (sn *SocketNode) Matches(toMatch *SocketNode) bool
Matches returns true if SocketNodes matches
type Stats ¶
type Stats struct { ProcessNodes int64 FileNodes int64 DNSNodes int64 SocketNodes int64 IMDSNodes int64 SyscallNodes int64 // contains filtered or unexported fields }
Stats represents the node counts in an activity dump
func NewActivityTreeNodeStats ¶
func NewActivityTreeNodeStats() *Stats
NewActivityTreeNodeStats returns a new activity tree stats
func (*Stats) ApproximateSize ¶
ApproximateSize returns an approximation of the size of the tree
type SyscallNode ¶
type SyscallNode struct { ImageTags []string GenerationType NodeGenerationType Syscall int }
SyscallNode is used to store a syscall node
func NewSyscallNode ¶
func NewSyscallNode(syscall int, imageTag string, generationType NodeGenerationType) *SyscallNode
NewSyscallNode returns a new SyscallNode instance