tracee

package

Go to main page

Versions in this module

v0

v0.4.0

Jan 24, 2021

Changes in this version

+ const Clone3EventID — darwin/amd64, linux/amd64, windows/amd64

+ const CloseRangeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const EpollPwait2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const Faccessat2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const FsconfigEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FsmountEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FsopenEventID — darwin/amd64, linux/amd64, windows/amd64

+ const FspickEventID — darwin/amd64, linux/amd64, windows/amd64

+ const GreaterNotSetInt

+ const GreaterNotSetUint

+ const IoUringEnterEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoUringRegisterEventID — darwin/amd64, linux/amd64, windows/amd64

+ const IoUringSetupEventID — darwin/amd64, linux/amd64, windows/amd64

+ const LessNotSetInt

+ const LessNotSetUint

+ const MaxEventID

+ const MoveMountEventID — darwin/amd64, linux/amd64, windows/amd64

+ const OpenTreeEventID — darwin/amd64, linux/amd64, windows/amd64

+ const Openat2EventID — darwin/amd64, linux/amd64, windows/amd64

+ const PidfdGetfdEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PidfdOpenEventID — darwin/amd64, linux/amd64, windows/amd64

+ const PidfdSendSignalEventID — darwin/amd64, linux/amd64, windows/amd64

+ const ProcessMadviseEventID — darwin/amd64, linux/amd64, windows/amd64

+ type ArgFilter struct

+ Enabled bool

+ Filters map[int32]map[string]ArgFilterVal

+ type ArgFilterVal struct

+ Equal []string

+ NotEqual []string

+ type BoolFilter struct

+ Enabled bool

+ Value bool

+ type CaptureConfig struct

+ Exec bool

+ FileWrite bool

+ FilterFileWrite []string

+ Mem bool

+ OutputPath string

type Filter

+ ArgFilter *ArgFilter

+ CommFilter *StringFilter

+ ContFilter *BoolFilter

+ EventsToTrace []int32

+ Follow bool

+ MntNSFilter *UintFilter

+ NewContFilter *BoolFilter

+ NewPidFilter *BoolFilter

+ PIDFilter *UintFilter

+ PidNSFilter *UintFilter

+ RetFilter *RetFilter

+ UTSFilter *StringFilter

+ type IntFilter struct

+ Enabled bool

+ Equal []int64

+ Greater int64

+ Is32Bit bool

+ Less int64

+ NotEqual []int64

+ type OutputConfig struct

+ DetectSyscall bool

+ EOT bool

+ ErrPath string

+ ExecEnv bool

+ Format string

+ OutPath string

+ StackAddresses bool

+ func (cfg OutputConfig) Validate() error

+ type RetFilter struct

+ Enabled bool

+ Filters map[int32]IntFilter

+ type StringFilter struct

+ Enabled bool

+ Equal []string

+ NotEqual []string

type Tracee

+ StackAddressesMap *bpf.BPFMap

type TraceeConfig

+ Capture *CaptureConfig

+ Output *OutputConfig

+ type UintFilter struct

+ Enabled bool

+ Equal []uint64

+ Greater uint64

+ Is32Bit bool

+ Less uint64

+ NotEqual []uint64

v0.3.1

Dec 9, 2020

Changes in this version

+ const ModeHostAll

+ const ModeHostNew

+ const SecurityInodeUnlinkEventID

+ func PrintBPFCmd(cmd int32) string

type Filter

+ UIDFilter *UIDFilter

+ type UIDFilter struct

+ Equal []uint32

+ Greater int64

+ Less int64

+ NotEqual []uint32

v0.3.0

Nov 29, 2020

Changes in this version

+ const ModeContainerAll

+ const ModeContainerNew

+ const ModeProcessAll

+ const ModeProcessList

+ const ModeProcessNew

+ const SchedProcessExitEventID

+ func CopyFileByPath(src, dst string) error

+ func UnameRelease() string

+ type Filter struct

+ UIDs []uint32

type TraceeConfig

+ BPFObjPath string

+ Filter Filter

+ Mode uint32

v0.2.1

Oct 9, 2020

v0.2.0

Sep 15, 2020

Changes in this version

+ const VfsWritevEventID

v0.1.0

Sep 10, 2020

Changes in this version

+ const InotifyInit1EventID

+ const NameToHandleAtEventID

+ const SyncfsEventID

+ const SysEnterEventID

+ const SysExitEventID

+ var EventsIDToParams = map[int32][]param

type EventConfig

+ ID32Bit int32

+ Sets []string

type Tracee

+ DecParamName [2]map[argTag]string

+ EncParamName [2]map[string]argTag

v0.0.3

Aug 5, 2020

Changes in this version

+ const Accept4EventID

+ const AcceptEventID

+ const AccessEventID

+ const AcctEventID

+ const AddKeyEventID

+ const AdjtimexEventID

+ const AfsEventID

+ const AlarmEventID

+ const ArchPrctlEventID

+ const BindEventID

+ const BpfEventID

+ const BrkEventID

+ const CapCapableEventID

+ const CapgetEventID

+ const CapsetEventID

+ const ChdirEventID

+ const ChmodEventID

+ const ChownEventID

+ const ChrootEventID

+ const ClockAdjtimeEventID

+ const ClockGetresEventID

+ const ClockGettimeEventID

+ const ClockNanosleepEventID

+ const ClockSettimeEventID

+ const CloneEventID

+ const CloseEventID

+ const ConnectEventID

+ const CopyFileRangeEventID

+ const CreatEventID

+ const CreateModuleEventID

+ const DeleteModuleEventID

+ const DoExitEventID

+ const Dup2EventID

+ const Dup3EventID

+ const DupEventID

+ const EpollCreate1EventID

+ const EpollCreateEventID

+ const EpollCtlEventID

+ const EpollCtlOldEventID

+ const EpollPwaitEventID

+ const EpollWaitEventID

+ const EpollWaitOldEventID

+ const Eventfd2EventID

+ const EventfdEventID

+ const ExecveEventID

+ const ExecveatEventID

+ const ExitEventID

+ const ExitGroupEventID

+ const FaccessatEventID

+ const Fadvise64EventID

+ const FallocateEventID

+ const FanotifyInitEventID

+ const FanotifyMarkEventID

+ const FchdirEventID

+ const FchmodEventID

+ const FchmodatEventID

+ const FchownEventID

+ const FchownatEventID

+ const FcntlEventID

+ const FdatasyncEventID

+ const FgetxattrEventID

+ const FinitModuleEventID

+ const FlistxattrEventID

+ const FlockEventID

+ const ForkEventID

+ const FremovexattrEventID

+ const FsetxattrEventID

+ const FstatEventID

+ const FstatfsEventID

+ const FsyncEventID

+ const FtruncateEventID

+ const FutexEventID

+ const FutimesatEventID

+ const GetKernelSymsEventID

+ const GetMempolicyEventID

+ const GetRobustListEventID

+ const GetThreadAreaEventID

+ const GetcpuEventID

+ const GetcwdEventID

+ const Getdents64EventID

+ const GetdentsEventID

+ const GetegidEventID

+ const GeteuidEventID

+ const GetgidEventID

+ const GetgroupsEventID

+ const GetitimerEventID

+ const GetpeernameEventID

+ const GetpgidEventID

+ const GetpgrpEventID

+ const GetpidEventID

+ const GetpmsgEventID

+ const GetppidEventID

+ const GetpriorityEventID

+ const GetrandomEventID

+ const GetresgidEventID

+ const GetresuidEventID

+ const GetrlimitEventID

+ const GetrusageEventID

+ const GetsidEventID

+ const GetsocknameEventID

+ const GetsockoptEventID

+ const GettidEventID

+ const GettimeofdayEventID

+ const GetuidEventID

+ const GetxattrEventID

+ const InitModuleEventID

+ const InotifyAddWatchEventID

+ const InotifyInitEventID

+ const InotifyRmWatchEventID

+ const IoCancelEventID

+ const IoDestroyEventID

+ const IoGeteventsEventID

+ const IoPgeteventsEventID

+ const IoSetupEventID

+ const IoSubmitEventID

+ const IoctlEventID

+ const IonotifyInit1EventID

+ const IopermEventID

+ const IoplEventID

+ const IoprioGetEventID

+ const IoprioSetEventID

+ const KcmpEventID

+ const KexecFileLoadEventID

+ const KexecLoadEventID

+ const KeyctlEventID

+ const KillEventID

+ const LchownEventID

+ const LgetxattrEventID

+ const LinkEventID

+ const LinkatEventID

+ const ListenEventID

+ const ListxattrEventID

+ const LlistxattrEventID

+ const LookupDcookieEventID

+ const LremovexattrEventID

+ const LseekEventID

+ const LsetxattrEventID

+ const LstatEventID

+ const MadviseEventID

+ const MbindEventID

+ const MemProtAlertEventID

+ const MembarrierEventID

+ const MemfdCreateEventID

+ const MigratePagesEventID

+ const MincoreEventID

+ const MkdirEventID

+ const MkdiratEventID

+ const MknodEventID

+ const MknodatEventID

+ const Mlock2EventID

+ const MlockEventID

+ const MlockallEventID

+ const MmapEventID

+ const ModifyLdtEventID

+ const MountEventID

+ const MovePagesEventID

+ const MprotectEventID

+ const MqGetsetattrEventID

+ const MqNotifyEventID

+ const MqOpenEventID

+ const MqTimedreceiveEventID

+ const MqTimedsendEventID

+ const MqUnlinkEventID

+ const MremapEventID

+ const MsgctlEventID

+ const MsggetEventID

+ const MsgrcvEventID

+ const MsgsndEventID

+ const MsyncEventID

+ const MunlockEventID

+ const MunlockallEventID

+ const MunmapEventID

+ const NameTohandleAtEventID

+ const NanosleepEventID

+ const NewfstatatEventID

+ const NfsservctlEventID

+ const OpenByHandleAtEventID

+ const OpenEventID

+ const OpenatEventID

+ const PauseEventID

+ const PerfEventOpenEventID

+ const PersonalityEventID

+ const Pipe2EventID

+ const PipeEventID

+ const PivotRootEventID

+ const PkeyAllocEventID

+ const PkeyFreeEventID

+ const PkeyMprotectEventID

+ const PollEventID

+ const PpollEventID

+ const PrctlEventID

+ const Pread64EventID

+ const Preadv2EventID

+ const PreadvEventID

+ const Prlimit64EventID

+ const ProcessVmReadvEventID

+ const ProcessVmWritevEventID

+ const Pselect6EventID

+ const PtraceEventID

+ const PutpmsgEventID

+ const Pwrite64EventID

+ const Pwritev2EventID

+ const PwritevEventID

+ const QueryModuleEventID

+ const QuotactlEventID

+ const RawSyscallsEventID

+ const ReadEventID

+ const ReadaheadEventID

+ const ReadlinkEventID

+ const ReadlinkatEventID

+ const ReadvEventID

+ const RebootEventID

+ const RecvfromEventID

+ const RecvmmsgEventID

+ const RecvmsgEventID

+ const RemapFilePagesEventID

+ const RemovexattrEventID

+ const RenameEventID

+ const Renameat2EventID

+ const RenameatEventID

+ const RequestKeyEventID

+ const Reserved335EventID

+ const Reserved336EventID

+ const Reserved337EventID

+ const Reserved338EventID

+ const Reserved339EventID

+ const Reserved340EventID

+ const Reserved341EventID

+ const Reserved342EventID

+ const Reserved343EventID

+ const Reserved344EventID

+ const Reserved345EventID

+ const Reserved346EventID

+ const Reserved347EventID

+ const Reserved348EventID

+ const Reserved349EventID

+ const RestartSyscallEventID

+ const RmdirEventID

+ const RseqEventID

+ const RtSigactionEventID

+ const RtSigpendingEventID

+ const RtSigprocmaskEventID

+ const RtSigqueueinfoEventID

+ const RtSigreturnEventID

+ const RtSigsuspendEventID

+ const RtSigtimedwaitEventID

+ const RtTgsigqueueinfoEventID

+ const SchedGetPriorityMaxEventID

+ const SchedGetPriorityMinEventID

+ const SchedGetaffinityEventID

+ const SchedGetattrEventID

+ const SchedGetparamEventID

+ const SchedGetschedulerEventID

+ const SchedRrGetIntervalEventID

+ const SchedSetaffinityEventID

+ const SchedSetattrEventID

+ const SchedSetparamEventID

+ const SchedSetschedulerEventID

+ const SchedYieldEventID

+ const SeccompEventID

+ const SecurityBprmCheckEventID

+ const SecurityEventID

+ const SecurityFileOpenEventID

+ const SelectEventID

+ const SemctlEventID

+ const SemgetEventID

+ const SemopEventID

+ const SemtimedopEventID

+ const SendfileEventID

+ const SendmmsgEventID

+ const SendmsgEventID

+ const SendtoEventID

+ const SetMempolicyEventID

+ const SetRobustListEventID

+ const SetThreadAreaEventID

+ const SetTidAddressEventID

+ const SetdomainnameEventID

+ const SetfsgidEventID

+ const SetfsuidEventID

+ const SetgidEventID

+ const SetgroupsEventID

+ const SethostnameEventID

+ const SetitimerEventID

+ const SetnsEventID

+ const SetpgidEventID

+ const SetpriorityEventID

+ const SetregidEventID

+ const SetresgidEventID

+ const SetresuidEventID

+ const SetreuidEventID

+ const SetrlimitEventID

+ const SetsidEventID

+ const SetsockoptEventID

+ const SettimeofdayEventID

+ const SetuidEventID

+ const SetxattrEventID

+ const ShmatEventID

+ const ShmctlEventID

+ const ShmdtEventID

+ const ShmgetEventID

+ const ShutdownEventID

+ const SigaltstackEventID

+ const Signalfd4EventID

+ const SignalfdEventID

+ const SocketEventID

+ const SocketpairEventID

+ const SpliceEventID

+ const StatEventID

+ const StatfsEventID

+ const StatxEventID

+ const SwapoffEventID

+ const SwaponEventID

+ const SycnfsEventID

+ const SymlinkEventID

+ const SymlinkatEventID

+ const SyncEventID

+ const SyncFileRangeEventID

+ const SysctlEventID

+ const SysfsEventID

+ const SysinfoEventID

+ const SyslogEventID

+ const TagAddr

+ const TagAlert

+ const TagArg2

+ const TagArg3

+ const TagArg4

+ const TagArg5

+ const TagArgv

+ const TagBacklog

+ const TagCap

+ const TagCount

+ const TagData

+ const TagDev

+ const TagDirfd

+ const TagDomain

+ const TagEgid

+ const TagEnvp

+ const TagEuid

+ const TagFd

+ const TagFilename

+ const TagFilesystemtype

+ const TagFlags

+ const TagFsgid

+ const TagFsuid

+ const TagGid

+ const TagGroup

+ const TagInode

+ const TagLen

+ const TagLength

+ const TagLinkpath

+ const TagLiovcnt

+ const TagLocalIov

+ const TagMode

+ const TagModuleImage

+ const TagMountflags

+ const TagName

+ const TagNewdirfd

+ const TagNewfd

+ const TagNone

+ const TagOffset

+ const TagOldfd

+ const TagOption

+ const TagOwner

+ const TagParamValues

+ const TagPathname

+ const TagPid

+ const TagPkey

+ const TagPos

+ const TagProt

+ const TagProtocol

+ const TagRemoteIov

+ const TagRequest

+ const TagRgid

+ const TagRiovcnt

+ const TagRuid

+ const TagSgid

+ const TagSig

+ const TagSockfd

+ const TagSource

+ const TagSuid

+ const TagSyscall

+ const TagTarget

+ const TagType

+ const TagUid

+ const TeeEventID

+ const TgkillEventID

+ const TimeEventID

+ const TimerCreateEventID

+ const TimerDeleteEventID

+ const TimerGetoverrunEventID

+ const TimerGettimeEventID

+ const TimerSettimeEventID

+ const TimerfdCreateEventID

+ const TimerfdGettimeEventID

+ const TimerfdSettimeEventID

+ const TimesEventID

+ const TkillEventID

+ const TruncateEventID

+ const TuxcallEventID

+ const UmaskEventID

+ const UmountEventID

+ const UnameEventID

+ const UnlinkEventID

+ const UnlinkatEventID

+ const UnshareEventID

+ const UselibEventID

+ const UserfaultfdEventID

+ const UstatEventID

+ const UtimeEventID

+ const UtimensatEventID

+ const UtimesEventID

+ const VforkEventID

+ const VfsWriteEventID

+ const VhangupEventID

+ const VmspliceEventID

+ const VserverEventID

+ const Wait4EventID

+ const WaitidEventID

+ const WriteEventID

+ const WritevEventID

+ func MergeErrors(cs ...<-chan error) <-chan error

+ func PrintCloneFlags(flags uint64) string

+ type Argument struct

+ Name string

+ Value interface{}

type Event

+ HostParentProcessID int

+ HostProcessID int

+ HostThreadID int

+ type RawEvent struct

+ ArgsTags []argTag

+ Ctx context

+ RawArgs map[argTag]interface{}

type Tracee

+ func (t *Tracee) WaitForPipeline(errs ...<-chan error) error

type TraceeConfig

+ PidsToTrace []int

v0.0.2

Jul 23, 2020

Changes in this version

+ var EventsIDToEvent = map[int32]EventConfig

+ func PrintAlert(alert alert) string

+ type Event struct

+ Args []interface{}

+ ArgsNum int

+ EventID int

+ EventName string

+ HostName string

+ MountNS int

+ PIDNS int

+ ParentProcessID int

+ ProcessID int

+ ProcessName string

+ ReturnValue int

+ ThreadID int

+ Timestamp float64

+ UserID int

+ type EventConfig struct

+ EnabledByDefault bool

+ EssentialEvent bool

+ ID int32

+ Name string

+ Probes []probe

type TraceeConfig

+ BlobPerfBufferSize int

+ CaptureExec bool

+ CaptureMem bool

+ CaptureWrite bool

+ ErrorsFile *os.File

+ EventsFile *os.File

+ FilterFileWrite []string

+ OutputPath string

+ SecurityAlerts bool

v0.0.1

May 18, 2020

Changes in this version

+ const CONFIG_CONT_MODE

+ const CONFIG_DETECT_ORIG_SYSCALL

+ const CONFIG_EXEC_ENV

+ const EventIDMax

+ const EventIDSyscallMax

+ var EventsIDToName = map[int32]string

+ var EventsNameToID map[string]int32

+ func IsEventSyscall(e int32) bool

+ func Print16BytesSliceIP(in []byte) string

+ func PrintAccessMode(mode uint32) string

+ func PrintCapability(cap int32) string

+ func PrintExecFlags(flags uint32) string

+ func PrintInodeMode(mode uint32) string

+ func PrintMemProt(prot uint32) string

+ func PrintOpenFlags(flags uint32) string

+ func PrintPrctlOption(op int32) string

+ func PrintPtraceRequest(req int32) string

+ func PrintSocketDomain(sd uint32) string

+ func PrintSocketType(st uint32) string

+ func PrintSyscall(sc int32) string

+ func PrintUint32IP(in uint32) string

+ type ArgType uint8

+ const ACCESS_MODE_T

+ const CAP_T

+ const DEV_T_T

+ const EXEC_FLAGS_T

+ const INT_T

+ const LONG_T

+ const MODE_T_T

+ const NONE

+ const OFF_T_T

+ const OPEN_FLAGS_T

+ const POINTER_T

+ const PRCTL_OPT_T

+ const PROT_FLAGS_T

+ const PTRACE_REQ_T

+ const R_PATH_T

+ const SIZE_T_T

+ const SOCKADDR_T

+ const SOCK_DOM_T

+ const SOCK_TYPE_T

+ const STR_ARR_T

+ const STR_T

+ const SYSCALL_T

+ const TYPE_MAX

+ const UINT_T

+ const ULONG_T

+ type Tracee struct

+ func New(cfg TraceeConfig) (*Tracee, error)

+ func (t *Tracee) Run() error

+ func (t Tracee) Close()

+ type TraceeConfig struct

+ ContainerMode bool

+ DetectOriginalSyscall bool

+ EventsToTrace []int32

+ OutputFormat string

+ PerfBufferSize int

+ ShowExecEnv bool

+ func NewConfig(eventsToTrace []string, containerMode bool, detectOriginalSyscall bool, ...) (*TraceeConfig, error)

+ func (tc TraceeConfig) Validate() error

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL