bpfrecorder

Documentation

Index

• Variables
• func BPFLSMEnabled() bool
• func Dial() (*grpc.ClientConn, context.CancelFunc, error)
• type AppArmorRecorder
  • func (b *AppArmorRecorder) GetAppArmorProcessed() BpfAppArmorProcessed
  • func (*AppArmorRecorder) Load(b *BpfRecorder) error
  • func (b *AppArmorRecorder) Unload()
• type BpfAppArmorFileProcessed
• type BpfAppArmorProcessed
• type BpfAppArmorSocketTypes
• type BpfRecorder
  • func New(programName string, logger logr.Logger, recordSeccomp, recordAppArmor bool) *BpfRecorder
  • func (b *BpfRecorder) FindProcMountNamespace(pid uint32) (uint32, error)
  • func (b *BpfRecorder) Load(startEventProcessor bool) (err error)
  • func (b *BpfRecorder) Run() error
  • func (b *BpfRecorder) Start(context.Context, *api.EmptyRequest) (*api.EmptyResponse, error)
  • func (b *BpfRecorder) Stop(context.Context, *api.EmptyRequest) (*api.EmptyResponse, error)
  • func (b *BpfRecorder) Syscalls() *bpf.BPFMap
  • func (b *BpfRecorder) SyscallsForProfile(_ context.Context, r *api.ProfileRequest) (*api.SyscallsResponse, error)
  • func (b *BpfRecorder) Unload()
  • func (b *BpfRecorder) WaitForPidExit(ctx context.Context, pid uint32) error
• type SeccompRecorder
  • func (s *SeccompRecorder) Load(b *BpfRecorder) error
  • func (s *SeccompRecorder) PopSyscalls(b *BpfRecorder, mntns uint32) ([]string, error)
  • func (s *SeccompRecorder) Unload()

Variables

var ErrNotFound = errors.New("no recorded profile found")

ErrNotFound is the GRPC error if no recorded profile found.

Functions

func BPFLSMEnabled

func BPFLSMEnabled() bool

func Dial

func Dial() (*grpc.ClientConn, context.CancelFunc, error)

Dial can be used to connect to the default GRPC server by creating a new client.

Types

type AppArmorRecorder

type AppArmorRecorder struct {
	// contains filtered or unexported fields
}

func (*AppArmorRecorder) GetAppArmorProcessed

func (b *AppArmorRecorder) GetAppArmorProcessed() BpfAppArmorProcessed

func (*AppArmorRecorder) Load

func (*AppArmorRecorder) Load(b *BpfRecorder) error

func (*AppArmorRecorder) Unload

func (b *AppArmorRecorder) Unload()

type BpfAppArmorFileProcessed

type BpfAppArmorFileProcessed struct {
	AllowedExecutables []string
	AllowedLibraries   []string
	ReadOnlyPaths      []string
	WriteOnlyPaths     []string
	ReadWritePaths     []string
}

type BpfAppArmorProcessed

type BpfAppArmorProcessed struct {
	FileProcessed BpfAppArmorFileProcessed
	Socket        BpfAppArmorSocketTypes
	Capabilities  []string
}

type BpfAppArmorSocketTypes

type BpfAppArmorSocketTypes struct {
	UseRaw bool
	UseTCP bool
	UseUDP bool
}

type BpfRecorder

type BpfRecorder struct {
	api.UnimplementedBpfRecorderServer

	AppArmor *AppArmorRecorder
	Seccomp  *SeccompRecorder
	// contains filtered or unexported fields
}

BpfRecorder is the main structure of this package.

func New

func New(programName string, logger logr.Logger, recordSeccomp, recordAppArmor bool) *BpfRecorder

New returns a new BpfRecorder instance.

func (*BpfRecorder) FindProcMountNamespace

func (b *BpfRecorder) FindProcMountNamespace(pid uint32) (uint32, error)

FindProcMountNamespace is looking up the mnt ns for a given PID.

func (*BpfRecorder) Load

func (b *BpfRecorder) Load(startEventProcessor bool) (err error)

Load prestarts the bpf recorder.

func (*BpfRecorder) Run

func (b *BpfRecorder) Run() error

Run the BpfRecorder.

func (*BpfRecorder) Start

func (b *BpfRecorder) Start(
	context.Context, *api.EmptyRequest,
) (*api.EmptyResponse, error)

func (*BpfRecorder) Stop

func (b *BpfRecorder) Stop(
	context.Context, *api.EmptyRequest,
) (*api.EmptyResponse, error)

func (*BpfRecorder) Syscalls

func (b *BpfRecorder) Syscalls() *bpf.BPFMap

Syscalls returns the bpf map containing the PID (key) to syscalls (value) data.

func (*BpfRecorder) SyscallsForProfile

func (b *BpfRecorder) SyscallsForProfile(
	_ context.Context, r *api.ProfileRequest,
) (*api.SyscallsResponse, error)

SyscallsForProfile returns the syscall names for the provided profile name.

func (*BpfRecorder) Unload

func (b *BpfRecorder) Unload()

Unload can be used to reset the bpf recorder.

func (*BpfRecorder) WaitForPidExit

func (b *BpfRecorder) WaitForPidExit(ctx context.Context, pid uint32) error

When running outside of Kubernetes as spoc, we have the use case of waiting for a specific PID to exit.

type SeccompRecorder

type SeccompRecorder struct {
	// contains filtered or unexported fields
}

func (*SeccompRecorder) Load

func (s *SeccompRecorder) Load(b *BpfRecorder) error

func (*SeccompRecorder) PopSyscalls

func (s *SeccompRecorder) PopSyscalls(b *BpfRecorder, mntns uint32) ([]string, error)

func (*SeccompRecorder) Unload

func (s *SeccompRecorder) Unload()