enricher

Documentation

Index

• Constants
• func Dial() (*grpc.ClientConn, context.CancelFunc, error)
• func ExtractAuditLine(logLine string) (*types.AuditLine, error)
• func IsAuditLine(logLine string) bool
• func LogFilePath() string
• type Enricher
  • func New(logger logr.Logger) *Enricher
  • func (e *Enricher) Avcs(ctx context.Context, r *api.AvcRequest) (*api.AvcResponse, error)
  • func (e *Enricher) ResetAvcs(ctx context.Context, r *api.AvcRequest) (*api.EmptyResponse, error)
  • func (e *Enricher) ResetSyscalls(ctx context.Context, r *api.SyscallsRequest) (*api.EmptyResponse, error)
  • func (e *Enricher) Run() error
  • func (e *Enricher) Syscalls(ctx context.Context, r *api.SyscallsRequest) (*api.SyscallsResponse, error)

Constants

const (
	// ErrorNoSyscalls is returned when no syscalls are recorded for a profile.
	ErrorNoSyscalls = "no syscalls recorded for profile"
	// ErrorNoAvcs is returned when no AVCs are recorded for a profile.
	ErrorNoAvcs = "no avcs recorded for profile"
)

Functions

func Dial

func Dial() (*grpc.ClientConn, context.CancelFunc, error)

Dial can be used to connect to the default GRPC server by creating a new client.

func ExtractAuditLine

func ExtractAuditLine(logLine string) (*types.AuditLine, error)

ExtractAuditLine extracts an auditline from logLine.

func IsAuditLine

func IsAuditLine(logLine string) bool

IsAuditLine checks whether logLine is a supported audit line.

func LogFilePath

func LogFilePath() string

LogFilePath returns either the path to the audit logs or falls back to syslog if the audit log path does not exist.

Types

type Enricher

type Enricher struct {
	apienricher.UnimplementedEnricherServer
	// contains filtered or unexported fields
}

Enricher is the main structure of this package.

func New

func New(logger logr.Logger) *Enricher

New returns a new Enricher instance.

func (*Enricher) Avcs

func (e *Enricher) Avcs(
	ctx context.Context, r *api.AvcRequest,
) (*api.AvcResponse, error)

Avcs returns the AVC messages for a provided profile.

func (*Enricher) ResetAvcs

func (e *Enricher) ResetAvcs(
	ctx context.Context, r *api.AvcRequest,
) (*api.EmptyResponse, error)

ResetAvcs removes the avcs for a provided profile.

func (*Enricher) ResetSyscalls

func (e *Enricher) ResetSyscalls(
	ctx context.Context, r *api.SyscallsRequest,
) (*api.EmptyResponse, error)

ResetSyscalls removes the syscalls for a provided profile.

func (*Enricher) Run

func (e *Enricher) Run() error

Run the log-enricher to scrap audit logs and enrich them with Kubernetes data (namespace, pod and container).

func (*Enricher) Syscalls

func (e *Enricher) Syscalls(
	ctx context.Context, r *api.SyscallsRequest,
) (*api.SyscallsResponse, error)

Syscalls returns the syscalls for a provided profile.