process

Documentation

Index

• Variables
• func ArgsDecoder(s string, flags uint32) (string, string)
• func DumpProcessCache(opts *tetragon.DumpProcessCacheReqArgs) []*tetragon.ProcessInternal
• func FreeCache()
• func GetExecID(proc *tetragonAPI.MsgProcess) string
• func GetExecIDFromKey(key *tetragonAPI.MsgExecveKey) string
• func GetK8s() watcher.K8sResourceWatcher
• func GetParentProcessInternal(pid uint32, ktime uint64) (*ProcessInternal, *ProcessInternal)
• func GetPodInfo(containerID, bin, args string, nspid uint32) *tetragon.Pod
• func GetProcessID(pid uint32, ktime uint64) string
• func InitCache(w watcher.K8sResourceWatcher, size int, GCInterval time.Duration) error
• func RegisterMetrics(group metrics.Group)
• func UpdateEventProcessTid(process *tetragon.Process, tid *uint32)
• type Cache
  • func NewCache(processCacheSize int, GCInterval time.Duration) (*Cache, error)
• type ProcessInternal
  • func AddCloneEvent(event *tetragonAPI.MsgCloneEvent) (*ProcessInternal, error)
  • func AddExecEvent(event *tetragonAPI.MsgExecveEventUnix) *ProcessInternal
  • func Get(execId string) (*ProcessInternal, error)
  • func (pi *ProcessInternal) AddPodInfo(pod *tetragon.Pod)
  • func (pi *ProcessInternal) AnnotateProcess(cred, ns bool) error
  • func (pi *ProcessInternal) GetProcessCopy() *tetragon.Process
  • func (pi *ProcessInternal) RefDec(reason string)
  • func (pi *ProcessInternal) RefGet() uint32
  • func (pi *ProcessInternal) RefInc(reason string)
  • func (pi *ProcessInternal) UnsafeGetProcess() *tetragon.Process
  • func (pi *ProcessInternal) UpdateExecOutsideCache(cred bool) (*tetragon.Process, bool)

Variables

var (
	ErrProcessInfoMissing = errors.New("failed process info missing")
)

Functions

func ArgsDecoder

func ArgsDecoder(s string, flags uint32) (string, string)

func DumpProcessCache

func DumpProcessCache(opts *tetragon.DumpProcessCacheReqArgs) []*tetragon.ProcessInternal

func FreeCache

func FreeCache()

func GetExecID

func GetExecID(proc *tetragonAPI.MsgProcess) string

func GetExecIDFromKey

func GetExecIDFromKey(key *tetragonAPI.MsgExecveKey) string

func GetK8s

func GetK8s() watcher.K8sResourceWatcher

GetK8s returns K8sResourceWatcher. You must call InitCache before calling this function to ensure that k8s has been initialized.

func GetParentProcessInternal

func GetParentProcessInternal(pid uint32, ktime uint64) (*ProcessInternal, *ProcessInternal)

func GetPodInfo

func GetPodInfo(containerID, bin, args string, nspid uint32) *tetragon.Pod

GetPodInfo constructs and returns the Kubernetes Pod information associated with an an event.

func GetProcessID

func GetProcessID(pid uint32, ktime uint64) string

func InitCache

func InitCache(w watcher.K8sResourceWatcher, size int, GCInterval time.Duration) error

func RegisterMetrics

func RegisterMetrics(group metrics.Group)

func UpdateEventProcessTid

func UpdateEventProcessTid(process *tetragon.Process, tid *uint32)

UpdateEventProcessTID Updates the Process.Tid of the event on the fly.

From BPF side as we track processes by their TGID we do not cache TIDs, this is done on purpose since we only track clone and execve where TGID == TID, and also to simplify things. From user space perspective this works in general without any problem especially for execve events. A cached process (user space procCache) will always have its TGID == TID.

However for other events we want to be precise and report the right thread that triggered an event. For such cases call this helper to set the Process.Tid to the corresponding thread ID that was reported from BPF side.

There is no point on calling this helper on clone or execve events, however on all other events it is perfectly fine.

Types

type Cache

type Cache struct {
	// contains filtered or unexported fields
}

func NewCache

func NewCache(
	processCacheSize int,
	GCInterval time.Duration,
) (*Cache, error)

type ProcessInternal

type ProcessInternal struct {
	// contains filtered or unexported fields
}

ProcessInternal is the internal representation of a process. nolint:revive // This is an acceptable case of "stuttering" since the name "Internal" wouldn't make much sense by itself.

func AddCloneEvent

func AddCloneEvent(event *tetragonAPI.MsgCloneEvent) (*ProcessInternal, error)

AddCloneEvent adds a new process into the cache from a CloneEvent

func AddExecEvent

func AddExecEvent(event *tetragonAPI.MsgExecveEventUnix) *ProcessInternal

AddExecEvent constructs a new ProcessInternal structure from an Execve event, adds it to the cache, and also returns it

func Get

func Get(execId string) (*ProcessInternal, error)

func (*ProcessInternal) AddPodInfo

func (pi *ProcessInternal) AddPodInfo(pod *tetragon.Pod)

func (*ProcessInternal) AnnotateProcess

func (pi *ProcessInternal) AnnotateProcess(cred, ns bool) error

func (*ProcessInternal) GetProcessCopy

func (pi *ProcessInternal) GetProcessCopy() *tetragon.Process

GetProcessCopy() duplicates tetragon.Process and returns it

func (*ProcessInternal) RefDec

func (pi *ProcessInternal) RefDec(reason string)

func (*ProcessInternal) RefGet

func (pi *ProcessInternal) RefGet() uint32

func (*ProcessInternal) RefInc

func (pi *ProcessInternal) RefInc(reason string)

func (*ProcessInternal) UnsafeGetProcess

func (pi *ProcessInternal) UnsafeGetProcess() *tetragon.Process

func (*ProcessInternal) UpdateExecOutsideCache

func (pi *ProcessInternal) UpdateExecOutsideCache(cred bool) (*tetragon.Process, bool)

UpdateExecOutsideCache() checks if we must augment the ProcessExec.Process with more fields without propagating again those fields into the process cache. This means that those added fields will only show up for the returned ProcessExec.Process.

This is usually the case where we have the core information of the process that was handled directly or through some event cache retries, in all cases the ProcessInternal.process is properly set and referenced and can't disappear, so we don't take any locks here. It operates on the direct reference and if some fields have to be added then a deep copy will be performed.

Returns:

1. The updated Process in case of new or updated fields, otherwise the old same Process reference.
2. A boolean to indicate if a process information update was performed

Current rules to make a copy and add fields for Process part of ProcessExec event are:

1. process_exec.process.binary_properties: a. if it is a setuid execution b. if it is a setgid execution c. if it is a filesystem capability execution d. Execution of an unlinked binary (shm, memfd, or deleted binaries)

   a b and c are subject to the --enable-process-creds flag