policy

package
v0.23.2 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 18, 2025 License: Apache-2.0 Imports: 24 Imported by: 1

Documentation

Index

Constants

View Source 
const (
	// outer maps
	UIDFilterMapVersion         = "uid_filter_version"
	PIDFilterMapVersion         = "pid_filter_version"
	MntNSFilterMapVersion       = "mnt_ns_filter_version"
	PidNSFilterMapVersion       = "pid_ns_filter_version"
	UTSFilterMapVersion         = "uts_ns_filter_version"
	CommFilterMapVersion        = "comm_filter_version"
	DataFilterPrefixMapVersion  = "data_filter_prefix_version"
	DataFilterSuffixMapVersion  = "data_filter_suffix_version"
	DataFilterExactMapVersion   = "data_filter_exact_version"
	CgroupIdFilterVersion       = "cgroup_id_filter_version"
	ProcessTreeFilterMapVersion = "process_tree_map_version"
	BinaryFilterMapVersion      = "binary_filter_version"
	PoliciesConfigVersion       = "policies_config_version"

	// inner maps
	UIDFilterMap         = "uid_filter"
	PIDFilterMap         = "pid_filter"
	MntNSFilterMap       = "mnt_ns_filter"
	PidNSFilterMap       = "pid_ns_filter"
	UTSFilterMap         = "uts_ns_filter"
	CommFilterMap        = "comm_filter"
	DataFilterPrefixMap  = "data_filter_prefix"
	DataFilterSuffixMap  = "data_filter_suffix"
	DataFilterExactMap   = "data_filter_exact"
	CgroupIdFilterMap    = "cgroup_id_filter"
	ProcessTreeFilterMap = "process_tree_map"
	BinaryFilterMap      = "binary_filter"
	PoliciesConfigMap    = "policies_config_map"

	ProcInfoMap = "proc_info_map"
)
View Source 
const (
	PolicyMax  = int(64)
	PolicyAll  = ^uint64(0)
	PolicyNone = uint64(0)
)

Variables

View Source 
var AlwaysSubmit = events.EventState{
	Submit: PolicyAll,
}

Functions

func NewPolicies 

func NewPolicies() *policies

func PoliciesMaxExceededError 

func PoliciesMaxExceededError() error

func PoliciesOutOfRangeError 

func PoliciesOutOfRangeError(idx int) error

func PolicyAlreadyExistsError added in v0.21.0 

func PolicyAlreadyExistsError(name string, idx int) error

func PolicyNilError 

func PolicyNilError() error

func PolicyNotFoundByIDError added in v0.18.0 

func PolicyNotFoundByIDError(idx int) error

func PolicyNotFoundByNameError added in v0.18.0 

func PolicyNotFoundByNameError(name string) error

func Snapshots added in v0.20.0 

func Snapshots() *snapshots

Types

type KernelDataFields added in v0.23.0 

type KernelDataFields struct {
	ID     events.ID
	String string
}

type Manager added in v0.23.0 

type Manager struct {
	// contains filtered or unexported fields
}

Manager is a thread-safe struct that manages the enabled policies for each rule

func NewManager added in v0.23.0 

func NewManager(
	cfg ManagerConfig,
	depsManager *dependencies.Manager,
	initialPolicies ...*Policy,
) (*Manager, error)

func (*Manager) CreateAllIterator added in v0.23.0 

func (m *Manager) CreateAllIterator() utils.Iterator[*Policy]

func (*Manager) CreateUserlandIterator added in v0.23.0 

func (m *Manager) CreateUserlandIterator() utils.Iterator[*Policy]

func (*Manager) DisableEvent added in v0.23.0 

func (m *Manager) DisableEvent(id events.ID)

DisableEvent disables a given event

func (*Manager) DisableRule added in v0.23.0 

func (m *Manager) DisableRule(policyId int, id events.ID) error

DisableRule disables a rule for a given event policy

func (*Manager) EnableEvent added in v0.23.0 

func (m *Manager) EnableEvent(id events.ID)

EnableEvent enables a given event

func (*Manager) EnableRule added in v0.23.0 

func (m *Manager) EnableRule(policyId int, id events.ID) error

EnableRule enables a rule for a given event policy

func (*Manager) EventsSelected added in v0.23.0 

func (m *Manager) EventsSelected() []events.ID

func (*Manager) EventsToSubmit added in v0.23.0 

func (m *Manager) EventsToSubmit() []events.ID

func (*Manager) FilterableInUserland added in v0.23.0 

func (m *Manager) FilterableInUserland() bool

func (*Manager) IsEnabled added in v0.23.0 

func (m *Manager) IsEnabled(matchedPolicies uint64, id events.ID) bool

IsEnabled tests if a event, or a policy per event is enabled (in the future it will also check if a policy is enabled) TODO: add metrics about an event being enabled/disabled, or a policy being enabled/disabled?

func (*Manager) IsEventEnabled added in v0.23.0 

func (m *Manager) IsEventEnabled(id events.ID) bool

IsEventEnabled returns true if a given event policy is enabled for a given rule

func (*Manager) IsEventSelected added in v0.23.0 

func (m *Manager) IsEventSelected(id events.ID) bool

func (*Manager) IsEventToEmit added in v0.23.0 

func (m *Manager) IsEventToEmit(id events.ID) bool

func (*Manager) IsEventToSubmit added in v0.23.0 

func (m *Manager) IsEventToSubmit(id events.ID) bool

func (*Manager) IsRequiredBySignature added in v0.23.0 

func (m *Manager) IsRequiredBySignature(id events.ID) bool

func (*Manager) IsRuleEnabled added in v0.23.0 

func (m *Manager) IsRuleEnabled(matchedPolicies uint64, id events.ID) bool

IsRuleEnabled returns true if a given event policy is enabled for a given rule

func (*Manager) LookupByName added in v0.23.0 

func (m *Manager) LookupByName(name string) (*Policy, error)

func (*Manager) MatchEvent added in v0.23.0 

func (m *Manager) MatchEvent(id events.ID, matched uint64) uint64

func (*Manager) MatchEventInAnyPolicy added in v0.23.0 

func (m *Manager) MatchEventInAnyPolicy(id events.ID) uint64

func (*Manager) MatchedNames added in v0.23.0 

func (m *Manager) MatchedNames(matched uint64) []string

func (*Manager) UpdateBPF added in v0.23.0 

func (m *Manager) UpdateBPF(
	bpfModule *bpf.Module,
	cts *containers.Containers,
	eventsFields map[events.ID][]bufferdecoder.ArgType,
	createNewMaps bool,
	updateProcTree bool,
) (*PoliciesConfig, error)

func (*Manager) WithContainerFilterEnabled added in v0.23.0 

func (m *Manager) WithContainerFilterEnabled() uint64

type ManagerConfig added in v0.23.0 

type ManagerConfig struct {
	DNSCacheConfig dnscache.Config
	ProcTreeConfig proctree.ProcTreeConfig
	CaptureConfig  config.CaptureConfig
}

type PoliciesConfig added in v0.20.0 

type PoliciesConfig struct {
	UIDFilterEnabled      uint64
	PIDFilterEnabled      uint64
	MntNsFilterEnabled    uint64
	PidNsFilterEnabled    uint64
	UtsNsFilterEnabled    uint64
	CommFilterEnabled     uint64
	CgroupIdFilterEnabled uint64
	ContFilterEnabled     uint64
	NewContFilterEnabled  uint64
	NewPidFilterEnabled   uint64
	ProcTreeFilterEnabled uint64
	BinPathFilterEnabled  uint64
	FollowFilterEnabled   uint64

	UIDFilterMatchIfKeyMissing      uint64
	PIDFilterMatchIfKeyMissing      uint64
	MntNsFilterMatchIfKeyMissing    uint64
	PidNsFilterMatchIfKeyMissing    uint64
	UtsNsFilterMatchIfKeyMissing    uint64
	CommFilterMatchIfKeyMissing     uint64
	CgroupIdFilterMatchIfKeyMissing uint64
	ContFilterMatchIfKeyMissing     uint64
	NewContFilterMatchIfKeyMissing  uint64
	NewPidFilterMatchIfKeyMissing   uint64
	ProcTreeFilterMatchIfKeyMissing uint64
	BinPathFilterMatchIfKeyMissing  uint64

	EnabledPolicies uint64

	UidMax uint64
	UidMin uint64
	PidMax uint64
	PidMin uint64
}

PoliciesConfig mirrors the C struct policies_config (policies_config_t). Order of fields is important, as it is used as a value for the PoliciesConfigMap BPF map.

func (*PoliciesConfig) UpdateBPF added in v0.20.0 

func (pc *PoliciesConfig) UpdateBPF(bpfConfigMap *bpf.BPFMapLow) error

type Policy 

type Policy struct {
	ID                int
	Name              string
	UIDFilter         *filters.UIntFilter[uint32]
	PIDFilter         *filters.UIntFilter[uint32]
	NewPidFilter      *filters.BoolFilter
	MntNSFilter       *filters.UIntFilter[uint64]
	PidNSFilter       *filters.UIntFilter[uint64]
	UTSFilter         *filters.StringFilter
	CommFilter        *filters.StringFilter
	ContFilter        *filters.BoolFilter
	NewContFilter     *filters.BoolFilter
	ContIDFilter      *filters.StringFilter
	ProcessTreeFilter *filters.ProcessTreeFilter
	BinaryFilter      *filters.BinaryFilter
	Follow            bool
	Rules             map[events.ID]RuleData
}

func NewPolicy 

func NewPolicy() *Policy

func (*Policy) Clone added in v0.20.0 

func (p *Policy) Clone() *Policy

func (*Policy) ContainerFilterEnabled 

func (p *Policy) ContainerFilterEnabled() bool

ContainerFilterEnabled returns true if the policy has at least one container filter type enabled.

type RuleData added in v0.23.0 

type RuleData struct {
	EventID     events.ID
	ScopeFilter *filters.ScopeFilter
	DataFilter  *filters.DataFilter
	RetFilter   *filters.IntFilter[int64]
}

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.