ebpf

package
v0.19.0-rc Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 3, 2023 License: Apache-2.0 Imports: 54 Imported by: 1

Documentation

Index

Constants

View Source 
const (
	IterateShared int = iota
	Iterate
)
View Source 
const BPFMaxLogFileLen = 72 // BPF_MAX_LOG_FILE_LEN

Variables

This section is empty.

Functions

func FindingToEvent added in v0.10.0 

func FindingToEvent(f detect.Finding) (*trace.Event, error)

FindingToEvent converts a detect.Finding into a trace.Event This is used because the pipeline expects trace.Event, but the rule engine returns detect.Finding

func GetCaptureEventsList added in v0.8.0 

func GetCaptureEventsList(cfg config.Config) map[events.ID]events.EventState

GetCaptureEventsList sets events used to capture data.

func LoadKallsymsValues added in v0.11.0 

func LoadKallsymsValues(ksymsTable helpers.KernelSymbolTable, ksymbols []string) map[string]*helpers.KernelSymbol

func MergeErrors 

func MergeErrors(cs ...<-chan error) <-chan error

MergeErrors merges multiple channels of errors (https://blog.golang.org/pipelines)

func SendKsymbolsToMap added in v0.11.0 

func SendKsymbolsToMap(bpfKsymsMap *libbpfgo.BPFMap, ksymbols map[string]*helpers.KernelSymbol) error

Types

type BPFLog added in v0.11.0 

type BPFLog struct {
	// contains filtered or unexported fields
}

BPFLog struct contains aggregated data about a bpf log origin

func (BPFLog) CPU added in v0.11.0 

func (b BPFLog) CPU() uint32

func (BPFLog) Count added in v0.11.0 

func (b BPFLog) Count() uint32

func (*BPFLog) Decode added in v0.11.0 

func (b *BPFLog) Decode(rawBuffer []byte) error

func (BPFLog) Error added in v0.11.0 

func (b BPFLog) Error() string

func (BPFLog) File added in v0.11.0 

func (b BPFLog) File() []byte

func (BPFLog) FileAsString added in v0.11.0 

func (b BPFLog) FileAsString() string

func (BPFLog) ID added in v0.11.0 

func (b BPFLog) ID() uint32

func (BPFLog) Line added in v0.11.0 

func (b BPFLog) Line() uint32

func (BPFLog) LogLevel added in v0.11.0 

func (b BPFLog) LogLevel() logger.Level

func (BPFLog) Return added in v0.11.0 

func (b BPFLog) Return() int64

func (BPFLog) Size added in v0.11.0 

func (b BPFLog) Size() int

func (BPFLog) Type added in v0.11.0 

func (b BPFLog) Type() BPFLogType

type BPFLogType added in v0.11.0 

type BPFLogType uint32
const (
	BPFLogIDUnspec BPFLogType = iota // BPF_LOG_ID_UNSPEC

	// tracee functions
	BPFLogIDInitContext // BPF_LOG_ID_INIT_CONTEXT

	// bpf helpers functions
	BPFLogIDMapLookupElem  // BPF_LOG_ID_MAP_LOOKUP_ELEM
	BPFLogIDMapUpdateElem  // BPF_LOG_ID_MAP_UPDATE_ELEM
	BPFLogIDMapDeleteElem  // BPF_LOG_ID_MAP_DELETE_ELEM
	BPFLogIDGetCurrentComm // BPF_LOG_ID_GET_CURRENT_COMM
	BPFLogIDTailCall       // BPF_LOG_ID_TAIL_CALL
	BPFLogIDMemRead        // BPF_LOG_ID_MEM_READ
)

func (BPFLogType) String added in v0.11.0 

func (b BPFLogType) String() string

type InitValues added in v0.8.1 

type InitValues struct {
	Kallsyms bool
}

InitValues determines if to initialize values that might be needed by eBPF programs

type Tracee 

type Tracee struct {
	OutDir *os.File // use utils.XXX functions to create or write to this file

	// BPF Maps
	StackAddressesMap *bpf.BPFMap
	FDArgPathMap      *bpf.BPFMap
	// contains filtered or unexported fields
}

Tracee traces system calls and system events using eBPF

func New 

func New(cfg config.Config) (*Tracee, error)

New creates a new Tracee instance based on a given valid Config. It is expected that it won't cause external system side effects (reads, writes, etc).

func (*Tracee) AddReadyCallback added in v0.15.0 

func (t *Tracee) AddReadyCallback(f func(ctx gocontext.Context))

AddReadyCallback sets a callback function to be called when the tracee started all its probes and is ready to receive events

func (*Tracee) Close 

func (t *Tracee) Close()

Close cleans up created resources

func (*Tracee) DisableEvent added in v0.18.0 

func (t *Tracee) DisableEvent(eventName string) error

func (*Tracee) DisableRule added in v0.18.0 

func (t *Tracee) DisableRule(policyNames []string, ruleId string) error

DisableRule disables a rule in the specified policies

func (*Tracee) EnableEvent added in v0.18.0 

func (t *Tracee) EnableEvent(eventName string) error

func (*Tracee) EnableRule added in v0.18.0 

func (t *Tracee) EnableRule(policyNames []string, ruleId string) error

EnableRule enables a rule in the specified policies

func (*Tracee) Init added in v0.8.1 

func (t *Tracee) Init(ctx gocontext.Context) error

Init initialize tracee instance and it's various subsystems, potentially performing external system operations to initialize them. NOTE: any initialization logic, especially one that causes side effects, should go here and not New().

func (*Tracee) NewKernelSymbols added in v0.11.0 

func (t *Tracee) NewKernelSymbols() error

func (*Tracee) PrepareBuiltinDataSources added in v0.17.0 

func (t *Tracee) PrepareBuiltinDataSources() []detect.DataSource

PrepareBuiltinDataSources returns a list of all data sources tracee makes available built-in

func (*Tracee) RegisterEventDerivation added in v0.11.0 

func (t *Tracee) RegisterEventDerivation(deriveFrom events.ID, deriveTo events.ID, deriveCondition func() bool, deriveLogic derive.DeriveFunction) error

RegisterEventDerivation registers an event derivation handler for tracee to use in the event pipeline

func (*Tracee) RegisterEventProcessor added in v0.11.0 

func (t *Tracee) RegisterEventProcessor(id events.ID, proc func(evt *trace.Event) error)

RegisterEventProcessor registers a new event processor for a specific event id.

func (*Tracee) Run 

func (t *Tracee) Run(ctx gocontext.Context) error

Run starts the trace. it will run until ctx is cancelled

func (*Tracee) Running added in v0.8.1 

func (t *Tracee) Running() bool

Running returns true if the tracee is running

func (*Tracee) Stats 

func (t *Tracee) Stats() *metrics.Stats

func (*Tracee) Subscribe added in v0.18.0 

func (t *Tracee) Subscribe(policyNames []string) (*streams.Stream, error)

Subscribe returns a stream subscribed to selected policies

func (*Tracee) SubscribeAll added in v0.18.0 

func (t *Tracee) SubscribeAll() *streams.Stream

SubscribeAll returns a stream subscribed to all policies

func (*Tracee) Unsubscribe added in v0.18.0 

func (t *Tracee) Unsubscribe(s *streams.Stream)

Unsubscribe unsubscribes stream

func (*Tracee) UpdateBPFKsymbolsMap added in v0.11.0 

func (t *Tracee) UpdateBPFKsymbolsMap() error

func (*Tracee) UpdateKallsyms added in v0.11.0 

func (t *Tracee) UpdateKallsyms() error

func (*Tracee) UpdateKernelSymbols added in v0.11.0 

func (t *Tracee) UpdateKernelSymbols() error

func (*Tracee) WaitForPipeline 

func (t *Tracee) WaitForPipeline(errs ...<-chan error) error

WaitForPipeline waits for results from all error channels.

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.