audit

package
v0.9.1 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jan 26, 2026 License: Apache-2.0 Imports: 24 Imported by: 0

Documentation

Overview

Package audit is used to audit the violations of target containers, and send the audit event to subscribers.

Index

Constants

View Source 
const (
	DeniedAction  = 0x00000001
	AuditAction   = 0x00000002
	AllowedAction = 0x00000004
)

Variables

This section is empty.

Functions

func ParseProfileName added in v0.8.0 

func ParseProfileName(profile string) string

Types

type AppArmorEvent 

type AppArmorEvent struct {
	Version        uint32 `json:"version"`
	Event          uint32 `json:"event"`
	PID            uint64 `json:"pid"`
	PeerPID        uint64 `json:"peerPID"`
	Task           uint64 `json:"task"`
	MagicToken     uint64 `json:"magicToken"`
	Epoch          int64  `json:"epoch"`
	AuditSubID     uint32 `json:"auditSubID"`
	BitMask        int32  `json:"bitMask"`
	AuditID        string `json:"auditID"`
	Operation      string `json:"operation"`
	DeniedMask     string `json:"deniedMask"`
	RequestedMask  string `json:"requestedMask"`
	Fsuid          uint64 `json:"fsuid"`
	Ouid           uint64 `json:"ouid"`
	Profile        string `json:"profile"`
	PeerProfile    string `json:"peerProfile"`
	Comm           string `json:"comm"`
	Name           string `json:"name"`
	Name2          string `json:"name2"`
	Namespace      string `json:"namespace"`
	Attribute      string `json:"attribute"`
	Parent         uint64 `json:"parent"`
	Info           string `json:"info"`
	PeerInfo       string `json:"peerInfo"`
	ErrorCode      int32  `json:"errorCode"`
	ActiveHat      string `json:"activeHat"`
	NetFamily      string `json:"netFamily"`
	NetProtocol    string `json:"netProtocol"`
	NetSockType    string `json:"netSockType"`
	NetLocalAddr   string `json:"netLocalAddr"`
	NetLocalPort   uint64 `json:"netLocalPort"`
	NetForeignAddr string `json:"netForeignAddr"`
	NetForeignPort uint64 `json:"netForeignPort"`
	DbusBus        string `json:"dbusBus"`
	DbusPath       string `json:"dbusPath"`
	DbusInterface  string `json:"dbusInterface"`
	DbusMember     string `json:"dbusMember"`
	Signal         string `json:"signal"`
	Peer           string `json:"peer"`
	FsType         string `json:"fsType"`
	Flags          string `json:"flags"`
	SrcName        string `json:"srcName"`
}

func ParseAppArmorEvent added in v0.7.0 

func ParseAppArmorEvent(e string) (*AppArmorEvent, error)

type Auditor 

type Auditor struct {
	TaskStartCh      chan varmortypes.ContainerInfo
	TaskDeleteCh     chan varmortypes.ContainerInfo
	TaskDeleteSyncCh chan bool
	// contains filtered or unexported fields
}

func NewAuditor 

func NewAuditor(nodeName string, appArmorSupported, bpfLsmSupported, enableBehaviorModeling bool, auditLogPaths string, auditEventMetadata map[string]interface{}, log logr.Logger) (*Auditor, error)

NewAuditor creates an auditor to audit the violations of target containers

func (*Auditor) AddBehaviorEventNotifyChs 

func (auditor *Auditor) AddBehaviorEventNotifyChs(subscriber string, auditEventCh *chan string, bpfEventCh *chan BpfEvent)

AddBehaviorEventNotifyChs add the audit event channel and bpf event channel for the subscriber The subscriber parameter is the name of profile

func (*Auditor) Close 

func (auditor *Auditor) Close()

func (*Auditor) DeleteBehaviorEventNotifyCh 

func (auditor *Auditor) DeleteBehaviorEventNotifyCh(subscriber string)

DeleteBehaviorEventNotifyCh delete the audit event channel and bpf event channel for the subscriber The subscriber parameter is the name of profile

func (*Auditor) Run 

func (auditor *Auditor) Run(stopCh <-chan struct{})

type BpfCapabilityEvent 

type BpfCapabilityEvent struct {
	Operation  string `json:"operation"`
	Capability string `json:"capability"`
}

type BpfEvent added in v0.9.0 

type BpfEvent struct {
	Header BpfEventHeader `json:"header"`
	Body   interface{}    `json:"body"`
}

type BpfEventHeader added in v0.9.0 

type BpfEventHeader struct {
	Action string `json:"action"`
	Type   string `json:"type"`
	MntNs  uint32 `json:"mntNs"`
	Tgid   uint32 `json:"tgid"`
	Ktime  uint64 `json:"ktime"`
}

type BpfMountEvent 

type BpfMountEvent struct {
	Operation string   `json:"operation"`
	Path      string   `json:"path"`
	Type      string   `json:"type"`
	Flags     []string `json:"flags"`
}

type BpfNetworkEvent added in v0.9.0 

type BpfNetworkEvent struct {
	Operation string             `json:"operation"`
	Type      string             `json:"type"`
	Socket    BpfNetworkSocket   `json:"socket"`
	Address   BpfNetworkSockAddr `json:"address"`
}

type BpfNetworkSockAddr added in v0.9.0 

type BpfNetworkSockAddr struct {
	Operation string `json:"operation"`
	IP        string `json:"ip"`
	Port      uint16 `json:"port"`
}

type BpfNetworkSocket added in v0.9.0 

type BpfNetworkSocket struct {
	Operation string `json:"operation"`
	Domain    string `json:"domain"`
	Type      string `json:"type"`
	Protocol  string `json:"protocol"`
}

type BpfPathEvent 

type BpfPathEvent struct {
	Operation   string   `json:"operation"`
	Permissions []string `json:"permissions"`
	Path        string   `json:"path"`
}

type BpfPtraceEvent 

type BpfPtraceEvent struct {
	Operation  string `json:"operation"`
	Permission string `json:"permission"`
	External   bool   `json:"external"`
}

type SeccompEvent added in v0.7.0 

type SeccompEvent struct {
	AuditID string `json:"auditID"`
	Epoch   uint64 `json:"epoch"`
	Subj    string `json:"subj"`
	PID     uint64 `json:"pid"`
	Comm    string `json:"comm"`
	Exe     string `json:"exe"`
	Syscall string `json:"syscall"`
}

func ParseSeccompAuditEvent added in v0.7.0 

func ParseSeccompAuditEvent(e string) (*SeccompEvent, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.