trace

Documentation

Overview

Package trace defines the public types exported through the EBPF code and produced outwards from tracee-ebpf

Package trace defines the public types exported through the EBPF code and produced outwards from tracee-ebpf

Index

• Constants
• type ArgMeta
• type Argument
  • func (arg *Argument) UnmarshalJSON(b []byte) error
• type Container
• type ContextFlags
• type DnsAnswer
• type DnsQueryData
• type DnsResponseData
• type Event
  • func (e Event) Origin() EventOrigin
  • func (e Event) ToProtocol() protocol.Event
• type EventOrigin
• type HiddenKernelModule
• type HookedSymbolData
• type KernelReadType
  • func (readType KernelReadType) String() string
• type Kubernetes
• type MemProtAlert
  • func (alert MemProtAlert) String() string
• type Metadata
• type PktMeta
• type ProtoDNS
• type ProtoDNSMX
• type ProtoDNSOPT
• type ProtoDNSQuestion
• type ProtoDNSResourceRecord
• type ProtoDNSSOA
• type ProtoDNSSRV
• type ProtoDNSURI
• type ProtoHTTP
• type ProtoHTTPRequest
• type ProtoHTTPResponse
• type ProtoICMP
• type ProtoICMPv6
• type ProtoIPv4
• type ProtoIPv6
• type ProtoTCP
• type ProtoUDP
• type SlimCred

Constants

const (
	EventSource = "tracee"
)

Types

type ArgMeta

type ArgMeta struct {
	Name string `json:"name"`
	Type string `json:"type"`
}

ArgMeta describes an argument

type Argument

type Argument struct {
	ArgMeta
	Value interface{} `json:"value"`
}

Argument holds the information for one argument

func (*Argument) UnmarshalJSON

func (arg *Argument) UnmarshalJSON(b []byte) error

UnmarshalJSON implements the json.Unmarshaler interface.

type Container

type Container struct {
	ID          string `json:"id,omitempty"`
	Name        string `json:"name,omitempty"`
	ImageName   string `json:"image,omitempty"`
	ImageDigest string `json:"imageDigest,omitempty"`
}

type ContextFlags

type ContextFlags struct {
	ContainerStarted bool `json:"containerStarted"`
	IsCompat         bool `json:"isCompat"`
}

ContextFlags are flags representing event context

type DnsAnswer

type DnsAnswer struct {
	Type   string `json:"answer_type"`
	Ttl    uint32 `json:"ttl"`
	Answer string `json:"answer"`
}

type DnsQueryData

type DnsQueryData struct {
	Query      string `json:"query"`
	QueryType  string `json:"query_type"`
	QueryClass string `json:"query_class"`
}

type DnsResponseData

type DnsResponseData struct {
	QueryData DnsQueryData `json:"query_data"`
	DnsAnswer []DnsAnswer  `json:"dns_answer"`
}

type Event

type Event struct {
	Timestamp            int          `json:"timestamp"`
	ThreadStartTime      int          `json:"threadStartTime"`
	ProcessorID          int          `json:"processorId"`
	ProcessID            int          `json:"processId"`
	CgroupID             uint         `json:"cgroupId"`
	ThreadID             int          `json:"threadId"`
	ParentProcessID      int          `json:"parentProcessId"`
	HostProcessID        int          `json:"hostProcessId"`
	HostThreadID         int          `json:"hostThreadId"`
	HostParentProcessID  int          `json:"hostParentProcessId"`
	UserID               int          `json:"userId"`
	MountNS              int          `json:"mountNamespace"`
	PIDNS                int          `json:"pidNamespace"`
	ProcessName          string       `json:"processName"`
	HostName             string       `json:"hostName"`
	Container            Container    `json:"container,omitempty"`
	Kubernetes           Kubernetes   `json:"kubernetes,omitempty"`
	EventID              int          `json:"eventId,string"`
	EventName            string       `json:"eventName"`
	MatchedPolicies      uint64       `json:"-"` // omit bitmask of matched policies
	MatchedPoliciesNames []string     `json:"matchedPolicies,omitempty"`
	ArgsNum              int          `json:"argsNum"`
	ReturnValue          int          `json:"returnValue"`
	Syscall              string       `json:"syscall"`
	StackAddresses       []uint64     `json:"stackAddresses"`
	ContextFlags         ContextFlags `json:"contextFlags"`
	Args                 []Argument   `json:"args"` // Arguments are ordered according their appearance in the original event
	Metadata             *Metadata    `json:"metadata,omitempty"`
}

Event is a single result of an ebpf event process. It is used as a payload later delivered to tracee-rules.

func (Event) Origin

func (e Event) Origin() EventOrigin

Origin derive the EventOrigin of a trace.Event

func (Event) ToProtocol

func (e Event) ToProtocol() protocol.Event

Converts a trace.Event into a protocol.Event that the rules engine can consume

type EventOrigin

type EventOrigin string

EventOrigin is where a trace.Event occured, it can either be from the host machine or from a container

const (
	ContainerOrigin     EventOrigin = "container"      // Events originated from within a container, starting with the entry-point execution
	HostOrigin          EventOrigin = "host"           // Events originated from the host
	ContainerInitOrigin EventOrigin = "container-init" // Events originated from within container, before entry-point execution
)

type HiddenKernelModule

type HiddenKernelModule struct {
	Name    string `json:"name"`
	Address string `json:"address"`
}

type HookedSymbolData

type HookedSymbolData struct {
	SymbolName  string
	ModuleOwner string
}

type KernelReadType

type KernelReadType int

const (
	KernelReadUnknown KernelReadType = iota
	KernelReadFirmware
	KernelReadKernelModule
	KernelReadKExecImage
	KernelReadKExecInitRAMFS
	KernelReadSecurityPolicy
	KernelReadx509Certificate
)

func (KernelReadType) String

func (readType KernelReadType) String() string

type Kubernetes

type Kubernetes struct {
	PodName      string `json:"podName,omitempty"`
	PodNamespace string `json:"podNamespace,omitempty"`
	PodUID       string `json:"podUID,omitempty"`
	PodSandbox   bool   `json:"podSandbox,omitempty"`
}

type MemProtAlert

type MemProtAlert uint32

MemProtAlert is an enum of possible messages that can be sent by an event to pass some extra information about the event.

const (
	ProtAlertUnknown MemProtAlert = iota
	ProtAlertMmapWX
	ProtAlertMprotectToX
	ProtAlertMprotectXToWX
	ProtAlertMprotectWXToX
	ProtAlertLast
)

func (MemProtAlert) String

func (alert MemProtAlert) String() string

type Metadata

type Metadata struct {
	Version     string
	Description string
	Tags        []string
	Properties  map[string]interface{}
}

Metadata is a struct that holds metadata about an event

type PktMeta

type PktMeta struct {
	SrcIP     string `json:"src_ip"`
	DstIP     string `json:"dst_ip"`
	SrcPort   uint16 `json:"src_port"`
	DstPort   uint16 `json:"dst_port"`
	Protocol  uint8  `json:"protocol"`
	PacketLen uint32 `json:"packet_len"`
	Iface     string `json:"iface"` // TODO: currently it is always "any"
}

type ProtoDNS

type ProtoDNS struct {
	ID           uint16                   `json:"ID"`
	QR           uint8                    `json:"QR"`
	OpCode       string                   `json:"opCode"`
	AA           uint8                    `json:"AA"`
	TC           uint8                    `json:"TC"`
	RD           uint8                    `json:"RD"`
	RA           uint8                    `json:"RA"`
	Z            uint8                    `json:"Z"`
	ResponseCode string                   `json:"responseCode"`
	QDCount      uint16                   `json:"QDCount"`
	ANCount      uint16                   `json:"ANCount"`
	NSCount      uint16                   `json:"NSCount"`
	ARCount      uint16                   `json:"ARCount"`
	Questions    []ProtoDNSQuestion       `json:"questions"`
	Answers      []ProtoDNSResourceRecord `json:"answers"`
	Authorities  []ProtoDNSResourceRecord `json:"authorities"`
	Additionals  []ProtoDNSResourceRecord `json:"additionals"`
}

type ProtoDNSMX

type ProtoDNSMX struct {
	Preference uint16 `json:"preference"`
	Name       string `json:"name"`
}

type ProtoDNSOPT

type ProtoDNSOPT struct {
	Code string `json:"code"`
	Data string `json:"data"`
}

type ProtoDNSQuestion

type ProtoDNSQuestion struct {
	Name  string `json:"name"`
	Type  string `json:"type"`
	Class string `json:"class"`
}

type ProtoDNSResourceRecord

type ProtoDNSResourceRecord struct {
	Name  string        `json:"name"`
	Type  string        `json:"type"`
	Class string        `json:"class"`
	TTL   uint32        `json:"TTL"`
	IP    string        `json:"IP"`
	NS    string        `json:"NS"`
	CNAME string        `json:"CNAME"`
	PTR   string        `json:"PTR"`
	TXTs  []string      `json:"TXTs"`
	SOA   ProtoDNSSOA   `json:"SOA"`
	SRV   ProtoDNSSRV   `json:"SRV"`
	MX    ProtoDNSMX    `json:"MX"`
	OPT   []ProtoDNSOPT `json:"OPT"`
	URI   ProtoDNSURI   `json:"URI"`
	TXT   string        `json:"TXT"`
}

type ProtoDNSSOA

type ProtoDNSSOA struct {
	MName   string `json:"MName"`
	RName   string `json:"RName"`
	Serial  uint32 `json:"serial"`
	Refresh uint32 `json:"refresh"`
	Retry   uint32 `json:"retry"`
	Expire  uint32 `json:"expire"`
	Minimum uint32 `json:"minimum"`
}

type ProtoDNSSRV

type ProtoDNSSRV struct {
	Priority uint16 `json:"priority"`
	Weight   uint16 `json:"weight"`
	Port     uint16 `json:"port"`
	Name     string `json:"name"`
}

type ProtoDNSURI

type ProtoDNSURI struct {
	Priority uint16 `json:"priority"`
	Weight   uint16 `json:"weight"`
	Target   string `json:"target"`
}

type ProtoHTTP

type ProtoHTTP struct {
	Direction     string      `json:"direction"`
	Method        string      `json:"method"`
	Protocol      string      `json:"protocol"`
	Host          string      `json:"host"`
	URIPath       string      `json:"uri_path"`
	Status        string      `json:"status"`
	StatusCode    int         `json:"status_code"`
	Headers       http.Header `json:"headers"`
	ContentLength int64       `json:"content_length"`
}

type ProtoHTTPRequest

type ProtoHTTPRequest struct {
	Method        string      `json:"method"`
	Protocol      string      `json:"protocol"`
	Host          string      `json:"host"`
	URIPath       string      `json:"uri_path"`
	Headers       http.Header `json:"headers"`
	ContentLength int64       `json:"content_length"`
}

type ProtoHTTPResponse

type ProtoHTTPResponse struct {
	Status        string      `json:"status"`
	StatusCode    int         `json:"status_code"`
	Protocol      string      `json:"protocol"`
	Headers       http.Header `json:"headers"`
	ContentLength int64       `json:"content_length"`
}

type ProtoICMP

type ProtoICMP struct {
	TypeCode string `json:"typeCode"`
	Checksum uint16 `json:"checksum"`
	Id       uint16 `json:"id"`
	Seq      uint16 `json:"seq"`
}

type ProtoICMPv6

type ProtoICMPv6 struct {
	TypeCode string `json:"typeCode"`
	Checksum uint16 `json:"checksum"`
}

type ProtoIPv4

type ProtoIPv4 struct {
	Version    uint8  `json:"version"`
	IHL        uint8  `json:"IHL"`
	TOS        uint8  `json:"TOS"`
	Length     uint16 `json:"length"`
	Id         uint16 `json:"id"`
	Flags      uint8  `json:"flags"`
	FragOffset uint16 `json:"fragOffset"`
	TTL        uint8  `json:"TTL"`
	Protocol   string `json:"protocol"`
	Checksum   uint16 `json:"checksum"`
	SrcIP      string `json:"srcIP"`
	DstIP      string `json:"dstIP"`
}

type ProtoIPv6

type ProtoIPv6 struct {
	Version      uint8  `json:"version"`
	TrafficClass uint8  `json:"trafficClass"`
	FlowLabel    uint32 `json:"flowLabel"`
	Length       uint16 `json:"length"`
	NextHeader   string `json:"nextHeader"`
	HopLimit     uint8  `json:"hopLimit"`
	SrcIP        string `json:"srcIP"`
	DstIP        string `json:"dstIP"`
}

type ProtoTCP

type ProtoTCP struct {
	SrcPort    uint16 `json:"srcPort"`
	DstPort    uint16 `json:"dstPort"`
	Seq        uint32 `json:"seq"`
	Ack        uint32 `json:"ack"`
	DataOffset uint8  `json:"dataOffset"`
	FIN        uint8  `json:"FIN"`
	SYN        uint8  `json:"SYN"`
	RST        uint8  `json:"RST"`
	PSH        uint8  `json:"PSH"`
	ACK        uint8  `json:"ACK"`
	URG        uint8  `json:"URG"`
	ECE        uint8  `json:"ECE"`
	CWR        uint8  `json:"CWR"`
	NS         uint8  `json:"NS"`
	Window     uint16 `json:"window"`
	Checksum   uint16 `json:"checksum"`
	Urgent     uint16 `json:"urgent"`
}

type ProtoUDP

type ProtoUDP struct {
	SrcPort  uint16 `json:"srcPort"`
	DstPort  uint16 `json:"dstPort"`
	Length   uint16 `json:"length"`
	Checksum uint16 `json:"checksum"`
}

type SlimCred

type SlimCred struct {
	Uid            uint32 /* real UID of the task */
	Gid            uint32 /* real GID of the task */
	Suid           uint32 /* saved UID of the task */
	Sgid           uint32 /* saved GID of the task */
	Euid           uint32 /* effective UID of the task */
	Egid           uint32 /* effective GID of the task */
	Fsuid          uint32 /* UID for VFS ops */
	Fsgid          uint32 /* GID for VFS ops */
	UserNamespace  uint32 /* User Namespace of the of the event */
	SecureBits     uint32 /* SUID-less security management */
	CapInheritable uint64 /* caps our children can inherit */
	CapPermitted   uint64 /* caps we're permitted */
	CapEffective   uint64 /* caps we can actually use */
	CapBounding    uint64 /* capability bounding set */
	CapAmbient     uint64 /* Ambient capability set */
}

SlimCred struct is a slim version of the kernel's cred struct it is used to unmarshal binary data and therefore should match (bit by bit) to the `slim_cred_t` struct in the ebpf code. ANY CHANGE TO THIS STRUCT WILL BE REQUIRED ALSO TO bufferdecoder.SlimCred