bpfrecorder

Documentation

Index

• Variables
• func Dial() (*grpc.ClientConn, context.CancelFunc, error)
• type BpfRecorder
  • func New(logger logr.Logger) *BpfRecorder
  • func (b *BpfRecorder) FilterProgramName(filter string)
  • func (b *BpfRecorder) FindProcMountNamespace(pid uint32) (uint32, error)
  • func (b *BpfRecorder) Load(startEventProcessor bool) (err error)
  • func (b *BpfRecorder) Run() error
  • func (b *BpfRecorder) Start(ctx context.Context, r *api.EmptyRequest) (*api.EmptyResponse, error)
  • func (b *BpfRecorder) Stop(ctx context.Context, r *api.EmptyRequest) (*api.EmptyResponse, error)
  • func (b *BpfRecorder) Syscalls() *bpf.BPFMap
  • func (b *BpfRecorder) SyscallsForProfile(ctx context.Context, r *api.ProfileRequest) (*api.SyscallsResponse, error)
  • func (b *BpfRecorder) Unload()

Variables

var ErrNotFound = errors.New("no recorded profile found")

ErrNotFound is the GRPC error if no recorded profile found.

Functions

func Dial

func Dial() (*grpc.ClientConn, context.CancelFunc, error)

Dial can be used to connect to the default GRPC server by creating a new client.

Types

type BpfRecorder

type BpfRecorder struct {
	api.UnimplementedBpfRecorderServer
	// contains filtered or unexported fields
}

BpfRecorder is the main structure of this package.

func New

func New(logger logr.Logger) *BpfRecorder

New returns a new BpfRecorder instance.

func (*BpfRecorder) FilterProgramName

func (b *BpfRecorder) FilterProgramName(filter string)

FilterProgramName can be used to filter on a specific program name.

func (*BpfRecorder) FindProcMountNamespace

func (b *BpfRecorder) FindProcMountNamespace(pid uint32) (uint32, error)

FindProcMountNamespace is looking up the mnt ns for a given PID.

func (*BpfRecorder) Load

func (b *BpfRecorder) Load(startEventProcessor bool) (err error)

Load prestarts the bpf recorder.

func (*BpfRecorder) Run

func (b *BpfRecorder) Run() error

Run the BpfRecorder.

func (*BpfRecorder) Start

func (b *BpfRecorder) Start(
	ctx context.Context, r *api.EmptyRequest,
) (*api.EmptyResponse, error)

func (*BpfRecorder) Stop

func (b *BpfRecorder) Stop(
	ctx context.Context, r *api.EmptyRequest,
) (*api.EmptyResponse, error)

func (*BpfRecorder) Syscalls

func (b *BpfRecorder) Syscalls() *bpf.BPFMap

Syscalls returns the bpf map containing the PID (key) to syscalls (value) data.

func (*BpfRecorder) SyscallsForProfile

func (b *BpfRecorder) SyscallsForProfile(
	ctx context.Context, r *api.ProfileRequest,
) (*api.SyscallsResponse, error)

SyscallsForProfile returns the syscall names for the provided profile name.

func (*BpfRecorder) Unload

func (b *BpfRecorder) Unload()

Unload can be used to reset the bpf recorder.