Documentation
¶
Overview ¶
Package fwmark applies pmark process marks to Linux socket fwmarks.
The package is an example consumer of the root package's pinned processes map. Its eBPF cgroup/sock_create program looks up the current process lifetime and copies the high 32 bits of the 64-bit pmark value into bpf_sock.mark. The Go Manager also reconciles already-open sockets through pidfd_getfd and SO_MARK when pmark emits ProcessUpdate callbacks.
Use ToMark and FromMark to convert between a 32-bit Linux fwmark and the 64-bit mark value understood by package pmark.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func FromMark ¶
FromMark derives the Linux fwmark from the daemon mark. Keep this in sync with fwmark.c: higher 32 bits become the socket mark.
func SetProcessSocketsMark ¶
Types ¶
type Manager ¶
type Manager struct {
// contains filtered or unexported fields
}
Manager owns fwmark eBPF programs and the userspace socket reconciler.
func NewManager ¶
NewManager loads fwmark programs, reuses core's pinned processes map, and attaches cgroup hooks to the root cgroup.
func (*Manager) ApplyProcessUpdate ¶
func (*Manager) ProcessUpdateCallback ¶
func (m *Manager) ProcessUpdateCallback() func(pmark.ProcessUpdate)
ProcessUpdateCallback returns a daemon ProcessUpdate hook which reconciles already-open sockets for updated live processes.
func (*Manager) ReconcileMarkedProcesses ¶
type SocketMarkReport ¶
type SocketMarkReport struct {
FDs int
Sockets int
Marked int
AlreadyMarked int
PermissionSkipped int
}
func SetProcessSocketsMarkReport ¶
func SetProcessSocketsMarkReport(pid uint32, mark uint32) (SocketMarkReport, error)
Source Files