ebpf

Documentation

Index

• Constants
• func FindingToEvent(f detect.Finding) (*trace.Event, error)
• func GetCaptureEventsList(cfg config.Config) map[events.ID]eventConfig
• func GetEssentialEventsList() map[events.ID]eventConfig
• func LoadKallsymsValues(ksymsTable helpers.KernelSymbolTable, ksymbols []string) map[string]*helpers.KernelSymbol
• func MergeErrors(cs ...<-chan error) <-chan error
• func SendKsymbolsToMap(bpfKsymsMap *libbpfgo.BPFMap, ksymbols map[string]*helpers.KernelSymbol) error
• func ValidateKsymbolsTable(ksyms helpers.KernelSymbolTable) bool
• type BPFLog
  • func (b BPFLog) CPU() uint32
  • func (b BPFLog) Count() uint32
  • func (b *BPFLog) Decode(rawBuffer []byte) error
  • func (b BPFLog) Error() string
  • func (b BPFLog) File() []byte
  • func (b BPFLog) FileAsString() string
  • func (b BPFLog) ID() uint32
  • func (b BPFLog) Line() uint32
  • func (b BPFLog) LogLevel() logger.Level
  • func (b BPFLog) Return() int64
  • func (b BPFLog) Size() int
  • func (b BPFLog) Type() BPFLogType
• type BPFLogType
  • func (b BPFLogType) String() string
• type InitValues
• type Tracee
  • func New(cfg config.Config) (*Tracee, error)
  • func (t *Tracee) AddReadyCallback(f func(ctx gocontext.Context))
  • func (t *Tracee) Close()
  • func (t *Tracee) GetTailCalls() ([]*events.TailCall, error)
  • func (t *Tracee) Init() error
  • func (t *Tracee) NewKernelSymbols() error
  • func (t *Tracee) PrepareBuiltinDataSources() []detect.DataSource
  • func (t *Tracee) RegisterEventDerivation(deriveFrom events.ID, deriveTo events.ID, deriveCondition func() bool, ...) error
  • func (t *Tracee) RegisterEventProcessor(id events.ID, proc func(evt *trace.Event) error) error
  • func (t *Tracee) Run(ctx gocontext.Context) error
  • func (t *Tracee) Running() bool
  • func (t *Tracee) Stats() *metrics.Stats
  • func (t *Tracee) UpdateBPFKsymbolsMap() error
  • func (t *Tracee) UpdateKallsyms() error
  • func (t *Tracee) UpdateKernelSymbols() error
  • func (t *Tracee) WaitForPipeline(errs ...<-chan error) error

Constants

const (
	IterateShared int = iota
	Iterate
)

const BPFMaxLogFileLen = 72 // BPF_MAX_LOG_FILE_LEN

Functions

func FindingToEvent

func FindingToEvent(f detect.Finding) (*trace.Event, error)

FindingToEvent converts a detect.Finding into a trace.Event This is used because the pipeline expects trace.Event, but the rule engine returns detect.Finding

func GetCaptureEventsList

func GetCaptureEventsList(cfg config.Config) map[events.ID]eventConfig

GetCaptureEventsList sets events used to capture data

func GetEssentialEventsList

func GetEssentialEventsList() map[events.ID]eventConfig

GetEssentialEventsList sets the default events used by tracee

func LoadKallsymsValues

func LoadKallsymsValues(ksymsTable helpers.KernelSymbolTable, ksymbols []string) map[string]*helpers.KernelSymbol

func MergeErrors

func MergeErrors(cs ...<-chan error) <-chan error

MergeErrors merges multiple channels of errors. Based on https://blog.golang.org/pipelines.

func SendKsymbolsToMap

func SendKsymbolsToMap(bpfKsymsMap *libbpfgo.BPFMap, ksymbols map[string]*helpers.KernelSymbol) error

func ValidateKsymbolsTable

func ValidateKsymbolsTable(ksyms helpers.KernelSymbolTable) bool

ValidateKsymbolsTable checks if the addresses in the table are valid by checking a specific symbol address. The reason for the addresses to be invalid is if the capabilities required to read the kallsyms file are not given. The chosen symbol used here is "security_file_open" because it is a must-have symbol for tracee to run.

Types

type BPFLog

type BPFLog struct {
	// contains filtered or unexported fields
}

BPFLog struct contains aggregated data about a bpf log origin

func (BPFLog) CPU

func (b BPFLog) CPU() uint32

func (BPFLog) Count

func (b BPFLog) Count() uint32

func (*BPFLog) Decode

func (b *BPFLog) Decode(rawBuffer []byte) error

func (BPFLog) Error

func (b BPFLog) Error() string

func (BPFLog) File

func (b BPFLog) File() []byte

func (BPFLog) FileAsString

func (b BPFLog) FileAsString() string

func (BPFLog) ID

func (b BPFLog) ID() uint32

func (BPFLog) Line

func (b BPFLog) Line() uint32

func (BPFLog) LogLevel

func (b BPFLog) LogLevel() logger.Level

func (BPFLog) Return

func (b BPFLog) Return() int64

func (BPFLog) Size

func (b BPFLog) Size() int

func (BPFLog) Type

func (b BPFLog) Type() BPFLogType

type BPFLogType

type BPFLogType uint32

const (
	BPFLogIDUnspec BPFLogType = iota // BPF_LOG_ID_UNSPEC

	// tracee functions
	BPFLogIDInitContext // BPF_LOG_ID_INIT_CONTEXT

	// bpf helpers functions
	BPFLogIDMapLookupElem  // BPF_LOG_ID_MAP_LOOKUP_ELEM
	BPFLogIDMapUpdateElem  // BPF_LOG_ID_MAP_UPDATE_ELEM
	BPFLogIDMapDeleteElem  // BPF_LOG_ID_MAP_DELETE_ELEM
	BPFLogIDGetCurrentComm // BPF_LOG_ID_GET_CURRENT_COMM
	BPFLogIDTailCall       // BPF_LOG_ID_TAIL_CALL
	BPFLogIDMemRead        // BPF_LOG_ID_MEM_READ
)

func (BPFLogType) String

func (b BPFLogType) String() string

type InitValues

type InitValues struct {
	Kallsyms bool
}

InitValues determines if to initialize values that might be needed by eBPF programs

type Tracee

type Tracee struct {
	OutDir *os.File // use utils.XXX functions to create or write to this file

	// BPF Maps
	StackAddressesMap *bpf.BPFMap
	FDArgPathMap      *bpf.BPFMap
	// contains filtered or unexported fields
}

Tracee traces system calls and system events using eBPF

func New

func New(cfg config.Config) (*Tracee, error)

New creates a new Tracee instance based on a given valid Config. It is expected that it won't cause external system side effects (reads, writes, etc.)

func (*Tracee) AddReadyCallback

func (t *Tracee) AddReadyCallback(f func(ctx gocontext.Context))

AddReadyCallback sets a callback function to be called when the tracee started all its probes and is ready to receive events

func (*Tracee) Close

func (t *Tracee) Close()

Close cleans up created resources

func (*Tracee) GetTailCalls

func (t *Tracee) GetTailCalls() ([]*events.TailCall, error)

func (*Tracee) Init

func (t *Tracee) Init() error

Init initialize tracee instance and it's various subsystems, potentially performing external system operations to initialize them. NOTE: any initialization logic, especially one that causes side effects, should go here and not New().

func (*Tracee) NewKernelSymbols

func (t *Tracee) NewKernelSymbols() error

func (*Tracee) PrepareBuiltinDataSources

func (t *Tracee) PrepareBuiltinDataSources() []detect.DataSource

PrepareBuiltinDataSources returns a list of all data sources tracee makes available built-in

func (*Tracee) RegisterEventDerivation

func (t *Tracee) RegisterEventDerivation(deriveFrom events.ID, deriveTo events.ID, deriveCondition func() bool, deriveLogic derive.DeriveFunction) error

RegisterEventDerivation registers an event derivation handler for tracee to use in the event pipeline

func (*Tracee) RegisterEventProcessor

func (t *Tracee) RegisterEventProcessor(id events.ID, proc func(evt *trace.Event) error) error

RegisterEventProcessor registers a pipeline processing handler for an event

func (*Tracee) Run

func (t *Tracee) Run(ctx gocontext.Context) error

Run starts the trace. it will run until ctx is cancelled

func (*Tracee) Running

func (t *Tracee) Running() bool

Running returns true if the tracee is running

func (*Tracee) Stats

func (t *Tracee) Stats() *metrics.Stats

func (*Tracee) UpdateBPFKsymbolsMap

func (t *Tracee) UpdateBPFKsymbolsMap() error

func (*Tracee) UpdateKallsyms

func (t *Tracee) UpdateKallsyms() error

func (*Tracee) UpdateKernelSymbols

func (t *Tracee) UpdateKernelSymbols() error

func (*Tracee) WaitForPipeline

func (t *Tracee) WaitForPipeline(errs ...<-chan error) error

WaitForPipeline waits for results from all error channels.