config

Documentation

Index

• type CalcHashesOption
  • func (c CalcHashesOption) String() string
• type CapabilitiesConfig
• type CaptureConfig
• type Config
  • func (c Config) Validate() error
• type ContainerMode
• type FileCaptureConfig
• type FileCaptureType
• type OutputConfig
• type PcapsConfig
• type PrinterConfig

Types

type CalcHashesOption

type CalcHashesOption int

const (
	CalcHashesNone CalcHashesOption = iota
	CalcHashesInode
	CalcHashesDevInode
	CalcHashesDigestInode
)

func (CalcHashesOption) String

func (c CalcHashesOption) String() string

type CapabilitiesConfig

type CapabilitiesConfig struct {
	BypassCaps bool
	AddCaps    []string
	DropCaps   []string
}

type CaptureConfig

type CaptureConfig struct {
	OutputPath string
	FileWrite  FileCaptureConfig
	FileRead   FileCaptureConfig
	Module     bool
	Exec       bool
	Mem        bool
	Bpf        bool
	Net        PcapsConfig
}

type Config

type Config struct {
	InitialPolicies     []*policy.Policy
	Capture             *CaptureConfig
	Capabilities        *CapabilitiesConfig
	Output              *OutputConfig
	Cache               queue.CacheConfig
	ProcTree            proctree.ProcTreeConfig
	PerfBufferSize      int
	BlobPerfBufferSize  int
	PipelineChannelSize int
	MaxPidsCache        int // maximum number of pids to cache per mnt ns (in Tracee.pidsInMntns)
	BTFObjPath          string
	BPFObjBytes         []byte
	KernelConfig        *environment.KernelConfig
	OSInfo              *environment.OSInfo
	Sockets             runtime.Sockets
	NoContainersEnrich  bool
	EngineConfig        engine.Config
	MetricsEnabled      bool
	DNSCacheConfig      dnscache.Config
}

Config is a struct containing user defined configuration to initialize Tracee

NOTE: In the future, Tracee config will be changed at run time and will require proper management.

func (Config) Validate

func (c Config) Validate() error

Validate does static validation of the configuration

type ContainerMode

type ContainerMode int

const (
	ContainerModeDisabled ContainerMode = iota
	ContainerModeEnabled
	ContainerModeEnriched
)

type FileCaptureConfig

type FileCaptureConfig struct {
	Capture    bool
	PathFilter []string
	TypeFilter FileCaptureType
}

type FileCaptureType

type FileCaptureType uint

FileCaptureType represents file type capture configuration flags Values should match the filter values in the eBPF file ( CaptureRegularFiles -> FILTER_NORMAL_FILES)

const (
	CaptureRegularFiles FileCaptureType = 1 << iota
	CapturePipeFiles
	CaptureSocketFiles
	CaptureELFFiles
)

Filters for file types flags

const (
	CaptureStdinFiles FileCaptureType = 1 << (iota + 16)
	CaptureStdoutFiles
	CaptureStderrFiles
)

Filters for FDs flags

type OutputConfig

type OutputConfig struct {
	StackAddresses bool
	ExecEnv        bool
	RelativeTime   bool
	CalcHashes     CalcHashesOption

	ParseArguments    bool
	ParseArgumentsFDs bool
	EventsSorting     bool
}

type PcapsConfig

type PcapsConfig struct {
	CaptureSingle    bool
	CaptureProcess   bool
	CaptureContainer bool
	CaptureCommand   bool
	CaptureFiltered  bool
	CaptureLength    uint32
}

type PrinterConfig

type PrinterConfig struct {
	Kind          string
	OutPath       string
	OutFile       io.WriteCloser
	ContainerMode ContainerMode
	RelativeTS    bool
}