enforcer

Documentation

Index

• Variables
• type InnerKey
• type PtraceEnforcer
  • func NewPtraceEnforcer(container *tp.Container, logger *feeder.Feeder) *PtraceEnforcer
  • func (pe *PtraceEnforcer) StartSystemTracer()
  • func (pe *PtraceEnforcer) UpdateRules(securityPolicies []tp.SecurityPolicy, defaultPosture tp.DefaultPosture)
• type RuleConfig
• type RuleSet
  • func CreateNewRuleSet() (r *RuleSet)
• type Tracer
  • func (t *Tracer) NewBaseLog() tp.Log

Variables

var EPERM uint64 = ^uint64(syscall.EACCES - 1)

Permission Denied Return Code, cannot set it to -13 directly (since uint) so a workaround is used leveraging XOR

Types

type InnerKey

type InnerKey struct {
	Path   string
	Source string
}

type PtraceEnforcer

type PtraceEnforcer struct {
	Container *tp.Container
	Logger    *feeder.Feeder
	Rules     *RuleSet
}

func NewPtraceEnforcer

func NewPtraceEnforcer(container *tp.Container, logger *feeder.Feeder) *PtraceEnforcer

func (*PtraceEnforcer) StartSystemTracer

func (pe *PtraceEnforcer) StartSystemTracer()

func (*PtraceEnforcer) UpdateRules

func (pe *PtraceEnforcer) UpdateRules(securityPolicies []tp.SecurityPolicy, defaultPosture tp.DefaultPosture)

type RuleConfig

type RuleConfig struct {
	Dir, Hint, Recursive, ReadOnly, OwnerOnly, Deny, Allow bool
}

type RuleSet

type RuleSet struct {
	ProcessRules         map[InnerKey]RuleConfig
	FileRules            map[InnerKey]RuleConfig
	NetworkRules         map[InnerKey]RuleConfig
	ProcWhiteListPosture bool
	FileWhiteListPosture bool
	NetWhiteListPosture  bool
}

func CreateNewRuleSet

func CreateNewRuleSet() (r *RuleSet)

type Tracer

type Tracer struct {
	*PtraceEnforcer
	// contains filtered or unexported fields
}

func (*Tracer) NewBaseLog

func (t *Tracer) NewBaseLog() tp.Log