utils

package
v0.3.310 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 3, 2026 License: Apache-2.0 Imports: 46 Imported by: 1

Documentation

Index

Constants

View Source 
const (
	ErrKernelVersion = "incompatible kernel version"
	ErrMacOS         = "no vdso address found in auxv"
)
View Source 
const (
	HostPktType                  = "HOST"
	OutgoingPktType              = "OUTGOING"
	Request         HTTPDataType = 2
	Response        HTTPDataType = 3
)
View Source 
const (
	// standard exit codes
	ExitCodeSuccess = iota
	ExitCodeError   = 1

	// custom exit codes
	ExitCodeRuncNotFound       = 100
	ExitCodeIncompatibleKernel = 101
	ExitCodeMacOS              = 102
)
View Source 
const (
	// Access modes (handled separately)
	O_RDONLY  = 0
	O_WRONLY  = 1
	O_RDWR    = 2
	O_ACCMODE = 3

	// Bit flags
	O_CREAT     = 0o100
	O_EXCL      = 0o200
	O_NOCTTY    = 0o400
	O_TRUNC     = 0o1000
	O_APPEND    = 0o2000
	O_NONBLOCK  = 0o4000
	O_DSYNC     = 0o10000
	O_FASYNC    = 0o20000
	O_DIRECT    = 0o40000
	O_LARGEFILE = 0o100000
	O_DIRECTORY = 0o200000
	O_NOFOLLOW  = 0o400000
	O_NOATIME   = 0o1000000
	O_CLOEXEC   = 0o2000000
)

Standard Linux file open flags from <fcntl.h>

View Source 
const AT_FDCWD int32 = -100

AT_FDCWD is the Linux sentinel indicating paths are relative to the current working directory.

Variables

View Source 
var CelFields = map[string]*celtypes.FieldType{
	"args": {
		Type:  celtypes.ListType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return x.Raw.GetArgs(), nil
		}),
	},
	"attrSize": {
		Type:  celtypes.UintType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Uint(x.Raw.GetAttrSize()), nil
		}),
	},
	"capName": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetCapability()), nil
		}),
	},
	"cmd": {
		Type:  celtypes.UintType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Uint(x.Raw.GetCmd()), nil
		}),
	},
	"comm": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetComm()), nil
		}),
	},
	"containerId": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetContainerID()), nil
		}),
	},
	"containerName": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetContainer()), nil
		}),
	},
	"cwd": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetCwd()), nil
		}),
	},
	"dstAddr": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetDstEndpoint().Addr), nil
		}),
	},
	"dstIp": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetDstIP()), nil
		}),
	},
	"dstPort": {
		Type:  celtypes.IntType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Int(x.Raw.GetDstPort()), nil
		}),
	},

	"qtype": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetQtype()), nil
		}),
	},
	"qr": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetQr()), nil
		}),
	},
	"numAnswers": {
		Type:  celtypes.IntType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Int(x.Raw.GetNumAnswers()), nil
		}),
	},
	"rcode": {
		Type:  celtypes.StringType,
		IsSet: dnsResponseIsSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetRcode()), nil
		}),
	},

	"dstNamespace": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetDstEndpoint().Namespace), nil
		}),
	},
	"dstPodLabels": {
		Type:  celtypes.MapType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			ep := x.Raw.GetDstEndpoint()
			var pl map[string]string
			if ep.Kind == igtypes.EndpointKindService {
				pl = ServicePeerLabels(ep.Namespace, ep.Name)
			} else {
				pl = ep.PodLabels
			}
			if pl == nil {
				pl = map[string]string{}
			}
			return pl, nil
		}),
	},
	"exepath": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetExePath()), nil
		}),
	},
	"file": {
		Type:  celtypes.StringType,
		IsSet: presenceOf("file"),
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetFile()), nil
		}),
	},
	"flags": {
		Type:  celtypes.ListType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return x.Raw.GetFlags(), nil
		}),
	},
	"flagsRaw": {
		Type:  celtypes.IntType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Int(x.Raw.GetFlagsRaw()), nil
		}),
	},
	"hasTty": {
		Type:  celtypes.BoolType,
		IsSet: presenceOf("tty"),
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Bool(x.Raw.GetHasTTY()), nil
		}),
	},
	"module": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetModule()), nil
		}),
	},
	"name": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetDNSName()), nil
		}),
	},
	"namespace": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetNamespace()), nil
		}),
	},
	"newPath": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetNewPath()), nil
		}),
	},
	"oldPath": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetOldPath()), nil
		}),
	},
	"opcode": {
		Type:  celtypes.IntType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Int(x.Raw.GetOpcode()), nil
		}),
	},
	"path": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetPath()), nil
		}),
	},
	"pcomm": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetPcomm()), nil
		}),
	},
	"pid": {
		Type:  celtypes.UintType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Uint(x.Raw.GetPID()), nil
		}),
	},
	"pktType": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetPktType()), nil
		}),
	},
	"podName": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetPod()), nil
		}),
	},
	"ppid": {
		Type:  celtypes.UintType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Uint(x.Raw.GetPpid()), nil
		}),
	},
	"proto": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetProto()), nil
		}),
	},
	"pupperlayer": {
		Type:  celtypes.BoolType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Bool(x.Raw.GetPupperLayer()), nil
		}),
	},
	"srcPort": {
		Type:  celtypes.IntType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Int(x.Raw.GetSrcPort()), nil
		}),
	},
	"syscallName": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetSyscall()), nil
		}),
	},
	"tty": {
		Type:  celtypes.IntType,
		IsSet: presenceOf("tty"),
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Int(x.Raw.GetTTY()), nil
		}),
	},
	"ttyMajor": {
		Type:  celtypes.UintType,
		IsSet: presenceOf("tty_major"),
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Uint(x.Raw.GetTTYMajor()), nil
		}),
	},
	"ttyMinor": {
		Type:  celtypes.UintType,
		IsSet: presenceOf("tty_minor"),
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Uint(x.Raw.GetTTYMinor()), nil
		}),
	},
	"upperlayer": {
		Type:  celtypes.BoolType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.Bool(x.Raw.GetUpperLayer()), nil
		}),
	},
	"uid": {
		Type:  celtypes.UintType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return x.Raw.GetUid(), nil
		}),
	},

	"request": {
		Type:  nil,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return target, nil
		}),
	},
	"direction": {
		Type:  celtypes.StringType,
		IsSet: isSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			return celtypes.String(x.Raw.GetDirection()), nil
		}),
	},
}

CelFields is the field registry exposed to rule expressions as `event.<name>`.

A field whose IsSet tester is presenceOf(...) can be absent at runtime when the running gadget does not emit it; rules should guard those with has(). See docs/features/exec-tty-field.md for the tty fields and docs/features/exec-file-cel-field.md for file.

View Source 
var ErrContainerRemoved = errors.New("container removed")

ErrContainerRemoved is the cancel cause when a remove event aborts a registration.

View Source 
var HttpRequestFields = map[string]*celtypes.FieldType{
	"headers": {
		Type:  celtypes.MapType,
		IsSet: requestIsSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			req := x.Raw.GetRequest()
			if req != nil {
				return req.Header, nil
			}
			return http.Header{}, nil
		}),
	},
	"host": {
		Type:  celtypes.StringType,
		IsSet: requestIsSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			req := x.Raw.GetRequest()
			if req != nil {
				return celtypes.String(req.Host), nil
			}
			return celtypes.String(""), nil
		}),
	},
	"method": {
		Type:  celtypes.StringType,
		IsSet: requestIsSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			req := x.Raw.GetRequest()
			if req != nil {
				return celtypes.String(req.Method), nil
			}
			return celtypes.String(""), nil
		}),
	},
	"url": {
		Type:  celtypes.StringType,
		IsSet: urlIsSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			req := x.Raw.GetRequest()
			if req != nil && req.URL != nil {
				return celtypes.String(req.URL.String()), nil
			}
			return celtypes.String(""), nil
		}),
	},
	"path": {
		Type:  celtypes.StringType,
		IsSet: urlIsSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}
			req := x.Raw.GetRequest()
			if req != nil && req.URL != nil {
				return celtypes.String(req.URL.Path), nil
			}
			return celtypes.String(""), nil
		}),
	},
	"body": {
		Type:  celtypes.StringType,
		IsSet: requestIsSet,
		GetFrom: ref.FieldGetter(func(target any) (any, error) {
			x := target.(*xcel.Object[CelEvent])
			if x.Raw == nil {
				return nil, errCelObjectNil
			}

			buf := x.Raw.GetBuf()
			if len(buf) > 0 {
				return celtypes.String(buf), nil
			}

			req := x.Raw.GetRequest()
			if req != nil && req.Body != nil {
				// Read with size limit (10MB) and restore body for downstream readers
				const maxBodySize = 10 * 1024 * 1024 // 10MB
				limitedReader := io.LimitReader(req.Body, maxBodySize)
				bodyBytes, err := io.ReadAll(limitedReader)
				req.Body.Close()
				req.Body = io.NopCloser(bytes.NewReader(bodyBytes))
				if err != nil {
					return "", err
				}
				return celtypes.String(bodyBytes), nil
			}
			return celtypes.String(""), nil
		}),
	},
}

HttpRequestFields defines CEL fields for the nested http.request object

Functions

func AddFailureLogger added in v0.3.273 

func AddFailureLogger(ctx context.Context) func(string, ...helpers.IDetails)

AddFailureLogger returns Debug if removal aborted the registration, else Error. Missing shared data alone is no proof of removal: its producer may still be retrying for a live container.

func AddJitter added in v0.2.134 

func AddJitter(duration time.Duration, maxJitterPercentage int) time.Duration

AddJitter adds jitter percent to the duration

func CalculateFileHashes added in v0.2.122 

func CalculateFileHashes(path string) (sha1Hash string, md5Hash string, err error)

CalculateFileHashes calculates both SHA1 and MD5 hashes of the given file.

func CalculateProcessTreeDepth added in v0.2.354 

func CalculateProcessTreeDepth(process *armotypes.Process) int

CalculateProcessTreeDepth calculates the maximum depth of a process tree. The depth is the maximum number of levels from the root process to any leaf process. A single process (no children) has a depth of 1.

func CalculateSHA256FileExecHash 

func CalculateSHA256FileExecHash(path string, args []string) string

func CalculateSHA256FileOpenHash added in v0.2.246 

func CalculateSHA256FileOpenHash(path string) string

func CopyProcess added in v0.2.405 

func CopyProcess(src *armotypes.Process) *armotypes.Process

CopyProcess creates a deep copy of a process node (without children) Children map is initialized empty so the caller can rebuild the tree structure

func CreateK8sContainerID 

func CreateK8sContainerID(namespaceName string, podName string, containerId string) string

func CreateK8sPodID 

func CreateK8sPodID(namespaceName string, podName string) string

func CreateProcessTree 

func CreateProcessTree(process *armotypes.Process, shimPid uint32) (armotypes.Process, error)

Creates a process tree from a process. The process tree will be built from scanning the /proc filesystem.

func CurrentDir 

func CurrentDir() string

func DirectionFromPktType added in v0.3.146 

func DirectionFromPktType(pktType string) consts.NetworkDirection

DirectionFromPktType maps an Inspektor Gadget packet type string to a NetworkDirection

func EnrichProcess added in v0.2.405 

func EnrichProcess(target *armotypes.Process, source *armotypes.Process)

EnrichProcess updates target with non-empty fields from source This is used when merging process information from multiple alerts Only overwrites fields that are empty in target but present in source

func EscapeJSONPointerElement 

func EscapeJSONPointerElement(s string) string

EscapeJSONPointerElement escapes a JSON pointer element See https://www.rfc-editor.org/rfc/rfc6901#section-3

func FlattenChainToList added in v0.2.405 

func FlattenChainToList(root *armotypes.Process) []*armotypes.Process

FlattenChainToList converts a chain-structured process tree into an ordered list (root-first) A chain is a single path from container init to the offending process This is optimized for the common case where each alert provides one linear path

func FuncName added in v0.2.325 

func FuncName(i any) string

func GetClusterUID added in v0.3.32 

func GetClusterUID(k8sClient kubernetes.Interface) string

GetClusterUID retrieves the UID of the kube-system namespace to use as a stable cluster identifier. If the namespace cannot be accessed (e.g., due to RBAC restrictions), it returns an empty string and logs a warning.

func GetCmdlineByPid 

func GetCmdlineByPid(pid int) (*string, error)

func GetCommFromPid 

func GetCommFromPid(pid uint32) (string, error)

func GetContainerStatuses 

func GetContainerStatuses(podStatus v1.PodStatus) []v1.ContainerStatus

func GetExecArgsFromEvent 

func GetExecArgsFromEvent(event ExecEvent) []string

Get exec args from the given event.

func GetExecPathFromEvent 

func GetExecPathFromEvent(event ExecEvent) string

GetExecPathFromEvent returns the path of the executable: the resolved file (`file`), then the kernel exe path (`exepath`), then comm. argv[0] is never used: it is caller-controlled and, since IG v0.57, it is the real argv[0] ("sh"), not the requested pathname.

func GetFileSize 

func GetFileSize(path string) (int64, error)

Get the size of the given file.

func GetHostFilePathFromEvent 

func GetHostFilePathFromEvent(event EnrichEvent, containerPid uint32) (string, error)

GetHostFilePathFromEvent returns the primary host path of the file behind the event. For an exec event this is the first path from GetHostFilePathsFromEvent. Use GetHostFilePathsFromEvent to also get the interpreter path of a script or a binfmt_misc binary.

func GetHostFilePathsFromEvent added in v0.3.307 

func GetHostFilePathsFromEvent(event EnrichEvent, containerPid uint32) ([]string, error)

GetHostFilePathsFromEvent returns the host paths of the files behind the event.

An open event yields its full path under the container root.

An exec event yields the executed file (`file`) under the container root. If `file` is empty, a memfd ("/memfd:...") or a deleted file ("... (deleted)"), the kernel no longer has a reachable path, so /proc/<pid>/exe is used, or the path is skipped when the pid is unknown. If `exepath` differs from `file` (a shebang script or a binfmt_misc binary), the interpreter is returned too.

func GetPathFromPid 

func GetPathFromPid(pid uint32) (string, error)

func GetProcessEnv 

func GetProcessEnv(pid int) (map[string]string, error)

func GetProcessFromProcessTree 

func GetProcessFromProcessTree(process *armotypes.Process, pid uint32) *armotypes.Process

func GetProcessStat 

func GetProcessStat(pid int) (*procfs.ProcStat, error)

func HasKubernetesPodIdentity added in v0.3.273 

func HasKubernetesPodIdentity(container *containercollection.Container) bool

HasKubernetesPodIdentity reports whether a container identifies an addressable Kubernetes Pod. Other runtime metadata cannot be used for a Pod lookup. Container-name enrichment is not required to acquire the Pod's shared data.

func IsHost added in v0.3.241 

func IsHost(containerID string) bool

IsHost reports whether containerID identifies the virtual host pseudo-container (armotypes.HostContainerID). This is the single choke point for the "is this the host" check wherever only a containerID string is available (not a full *containercollection.Container, which IsHostContainer checks instead).

func IsHostContainer added in v0.3.60 

func IsHostContainer(container *containercollection.Container) bool

IsHostContainer reports whether container is the virtual host pseudo-container, identified either by its synthetic container ID (armotypes.HostContainerID) or by running with PID 1 on the host PID namespace. Use this when a full *containercollection.Container is available; when only a containerID string is available, use IsHost instead.

func IsResolvedFullPath added in v0.3.273 

func IsResolvedFullPath(p string) bool

IsResolvedFullPath reports whether p is usable as a gadget-resolved full path (the "fpath" field of an open event).

The gadget builds that field by walking the dentry chain backwards into a per-CPU scratch buffer which is never cleared between events. When the walk contributes nothing, the buffer's previous contents are returned instead, so the field can carry a fragment of an unrelated event's path — including one belonging to a different container on the same node.

A successful walk always emits a leading slash before returning, so a non-empty value that is not absolute cannot have come from one. That makes the leading slash a reliable boundary check for the fragment case.

Callers must NOT apply this to "fname": that field is the raw syscall argument and is legitimately relative when openat is used with a dirfd.

This does not catch every stale value. When the returned pointer happens to land on the start of a previous complete path the result is absolute and indistinguishable by shape; that case can only be fixed in the gadget, by returning NULL for an empty walk and by clearing the scratch buffer.

func IsRuleOnlyEvent added in v0.3.278 

func IsRuleOnlyEvent(e K8sEvent) bool

IsRuleOnlyEvent reports whether e is marked rule-only.

func IsSensitivePath added in v0.2.246 

func IsSensitivePath(fullPath string, paths []string) bool

func Jitter added in v0.2.332 

func Jitter(duration *time.Duration, maxJitterPercentage float64)

Jitter returns a random duration

func MapContainerStatuses added in v0.2.263 

func MapContainerStatuses(statuses []v1.ContainerStatus) map[string]v1.ContainerStatus

func MergeCloudServices added in v0.2.405 

func MergeCloudServices(existing []string, new []string) []string

MergeCloudServices merges two slices of cloud services and deduplicates them

func MergePolicies added in v0.2.178 

func MergePolicies(primary, secondary v1beta1.RulePolicy) v1beta1.RulePolicy

func NormalizePath added in v0.3.91 

func NormalizePath(p string) string

NormalizePath normalizes a path by: 1. Ensuring it starts with "/" if it's not empty 2. Converting "." to "/" 3. Cleaning the path (removing redundant slashes, dot-dots, etc.)

func RandomDuration added in v0.2.141 

func RandomDuration(max int, duration time.Duration) time.Duration

RandomDuration returns a duration between 1/2 max and max

func RemovedDuringAdd added in v0.3.273 

func RemovedDuringAdd(ctx context.Context) bool

RemovedDuringAdd reports whether PendingAdds.Cancel canceled ctx or a parent.

func ResolveOpenPathProc added in v0.3.273 

func ResolveOpenPathProc(pid, fd uint32, fdValid bool, raw string, dirfd ...int32) string

ResolveOpenPathProc resolves a non-absolute open path via procfs (the agent runs hostPID). When fdValid is true (error_raw == 0), the returned fd names the opened object exactly — covering ".", relative names, descriptor 0 and AT_EMPTY_PATH re-opens. When fdValid is false, a relative open resolves against its base directory: if dirfd is AT_FDCWD (or omitted), it joins with /proc/<pid>/cwd; if dirfd is a valid directory descriptor, it joins with /proc/<pid>/fd/<dirfd>; an invalid or non-directory dirfd fails resolution to avoid attributing to cwd or fabricating a path. An empty raw with no usable fd is unresolvable by kernel semantics: openat("") names no filesystem object.

func ServicePeerLabels added in v0.3.273 

func ServicePeerLabels(namespace, name string) map[string]string

func SetServicePeerLabels added in v0.3.273 

func SetServicePeerLabels(f func(namespace, name string) map[string]string)

func TrimRuntimePrefix 

func TrimRuntimePrefix(id string) string

TrimRuntimePrefix removes the runtime prefix from a container ID.

Types

type BpfEvent added in v0.3.3 

type BpfEvent interface {
	EnrichEvent
	GetExePath() string
	GetCmd() uint32
	GetAttrSize() uint32
	GetUpperLayer() bool
}

type CapabilitiesEvent added in v0.3.3 

type CapabilitiesEvent interface {
	EnrichEvent
	GetCapability() string
	GetSyscall() string
}

type CelEvent added in v0.3.3 

type CelEvent interface {
	CapabilitiesEvent
	DNSEvent
	ExecEvent
	HttpEvent
	IOUring
	LinkEvent
	NetworkEvent
	OpenEvent
	SshEvent
	SyscallEvent
	KmodEvent
	UnshareEvent
	BpfEvent
}

type CelEventImpl added in v0.3.3 

type CelEventImpl struct {
	CelEvent
}

type DNSEvent added in v0.3.3 

type DNSEvent interface {
	EnrichEvent
	GetAddresses() []string
	GetCwd() string
	GetDNSName() string
	GetDstIP() string
	GetDstPort() uint16
	GetExePath() string
	GetNumAnswers() int
	GetProto() string
	GetQr() DNSPktType
	// GetQtype returns the question type as the gadget names it ("A", "AAAA",
	// "TXT", ...), or the decimal type number for types without a name.
	GetQtype() string
	// GetRcode returns the response code name ("Success", "NameError",
	// "ServerFailure", "Refused", ...) for a response, and "" for a query.
	GetRcode() string
	GetSrcIP() string
	GetSrcPort() uint16
}

type DNSPktType added in v0.3.3 

type DNSPktType string
const (
	DNSPktTypeQuery    DNSPktType = "Q"
	DNSPktTypeResponse DNSPktType = "R"
)

type DatasourceEvent added in v0.3.3 

type DatasourceEvent struct {
	Data            datasource.Data
	Datasource      datasource.DataSource
	Direction       consts.NetworkDirection
	EventType       EventType
	FullPathTracing bool
	Internal        bool
	// RuleOnly marks an event that only the rule manager may consume; see
	// RuleOnlyEvent. Set by the DNS tracer on forwarded queries and error
	// responses.
	RuleOnly bool
	Request  *http.Request
	Response *http.Response
	Syscall  string
	// contains filtered or unexported fields
}

func (*DatasourceEvent) FieldPresent added in v0.3.165 

func (e *DatasourceEvent) FieldPresent(name string) bool

FieldPresent reports whether the underlying datasource exposes the named field. name is a datasource field name (snake_case), not a CEL field name.

This is how "the gadget running on this agent does not emit this signal" is distinguished from "the signal's value is zero". It never logs: an absent field is an expected, per-event condition.

func (*DatasourceEvent) GetAddresses added in v0.3.3 

func (e *DatasourceEvent) GetAddresses() []string

func (*DatasourceEvent) GetArgs added in v0.3.3 

func (e *DatasourceEvent) GetArgs() []string

func (*DatasourceEvent) GetAttrSize added in v0.3.3 

func (e *DatasourceEvent) GetAttrSize() uint32

func (*DatasourceEvent) GetBuf added in v0.3.3 

func (e *DatasourceEvent) GetBuf() []byte

func (*DatasourceEvent) GetBufLen added in v0.3.60 

func (e *DatasourceEvent) GetBufLen() uint16

func (*DatasourceEvent) GetCapability added in v0.3.3 

func (e *DatasourceEvent) GetCapability() string

func (*DatasourceEvent) GetCmd added in v0.3.3 

func (e *DatasourceEvent) GetCmd() uint32

func (*DatasourceEvent) GetComm added in v0.3.3 

func (e *DatasourceEvent) GetComm() string

func (*DatasourceEvent) GetContainer added in v0.3.3 

func (e *DatasourceEvent) GetContainer() string

func (*DatasourceEvent) GetContainerID added in v0.3.3 

func (e *DatasourceEvent) GetContainerID() string

func (*DatasourceEvent) GetContainerImage added in v0.3.3 

func (e *DatasourceEvent) GetContainerImage() string

func (*DatasourceEvent) GetContainerImageDigest added in v0.3.3 

func (e *DatasourceEvent) GetContainerImageDigest() string

func (*DatasourceEvent) GetCwd added in v0.3.3 

func (e *DatasourceEvent) GetCwd() string

func (*DatasourceEvent) GetDNSName added in v0.3.3 

func (e *DatasourceEvent) GetDNSName() string

func (*DatasourceEvent) GetDirection added in v0.3.3 

func (e *DatasourceEvent) GetDirection() consts.NetworkDirection

func (*DatasourceEvent) GetDstEndpoint added in v0.3.3 

func (e *DatasourceEvent) GetDstEndpoint() types.L4Endpoint

func (*DatasourceEvent) GetDstIP added in v0.3.3 

func (e *DatasourceEvent) GetDstIP() string

func (*DatasourceEvent) GetDstPort added in v0.3.3 

func (e *DatasourceEvent) GetDstPort() uint16

func (*DatasourceEvent) GetEcsAvailabilityZone added in v0.3.36 

func (e *DatasourceEvent) GetEcsAvailabilityZone() string

func (*DatasourceEvent) GetEcsClusterARN added in v0.3.36 

func (e *DatasourceEvent) GetEcsClusterARN() string

func (*DatasourceEvent) GetEcsClusterName added in v0.3.36 

func (e *DatasourceEvent) GetEcsClusterName() string

func (*DatasourceEvent) GetEcsContainerARN added in v0.3.36 

func (e *DatasourceEvent) GetEcsContainerARN() string

func (*DatasourceEvent) GetEcsContainerInstance added in v0.3.36 

func (e *DatasourceEvent) GetEcsContainerInstance() string

func (*DatasourceEvent) GetEcsContainerName added in v0.3.36 

func (e *DatasourceEvent) GetEcsContainerName() string

func (*DatasourceEvent) GetEcsLaunchType added in v0.3.36 

func (e *DatasourceEvent) GetEcsLaunchType() string

func (*DatasourceEvent) GetEcsServiceName added in v0.3.36 

func (e *DatasourceEvent) GetEcsServiceName() string

func (*DatasourceEvent) GetEcsTaskARN added in v0.3.36 

func (e *DatasourceEvent) GetEcsTaskARN() string

func (*DatasourceEvent) GetEcsTaskDefinitionARN added in v0.3.36 

func (e *DatasourceEvent) GetEcsTaskDefinitionARN() string

func (*DatasourceEvent) GetEcsTaskFamily added in v0.3.36 

func (e *DatasourceEvent) GetEcsTaskFamily() string

func (*DatasourceEvent) GetError added in v0.3.3 

func (e *DatasourceEvent) GetError() int64

func (*DatasourceEvent) GetEventType added in v0.3.3 

func (e *DatasourceEvent) GetEventType() EventType

func (*DatasourceEvent) GetExePath added in v0.3.3 

func (e *DatasourceEvent) GetExePath() string

func (*DatasourceEvent) GetExitCode added in v0.3.3 

func (e *DatasourceEvent) GetExitCode() uint32

func (*DatasourceEvent) GetExtra added in v0.3.3 

func (e *DatasourceEvent) GetExtra() any

func (*DatasourceEvent) GetFile added in v0.3.307 

func (e *DatasourceEvent) GetFile() string

GetFile returns the file the kernel executed (d_path of bprm->file): the symlink-resolved path of the binary or, for a shebang script, the script.

func (*DatasourceEvent) GetFlags added in v0.3.3 

func (e *DatasourceEvent) GetFlags() []string

func (*DatasourceEvent) GetFlagsRaw added in v0.3.3 

func (e *DatasourceEvent) GetFlagsRaw() uint32

func (*DatasourceEvent) GetFullPath added in v0.3.3 

func (e *DatasourceEvent) GetFullPath() string

func (*DatasourceEvent) GetGid added in v0.3.3 

func (e *DatasourceEvent) GetGid() *uint32

func (*DatasourceEvent) GetHasTTY added in v0.3.165 

func (e *DatasourceEvent) GetHasTTY() bool

GetHasTTY reports whether the process has a controlling terminal.

It prefers the device number, which is unambiguous, and falls back to the raw per-driver index, where 0 means both /dev/pts/0 and "no terminal" -- so on a gadget that emits only the index this under-reports rather than over-reports. The preference order is what lets the field become accurate with no code change once the gadget emits tty_major.

Reads go through localFieldAccessor, not getFieldAccessor, so an accessor from another datasource sharing this EventType can never decode this event's data.

func (*DatasourceEvent) GetHostNetwork added in v0.3.3 

func (e *DatasourceEvent) GetHostNetwork() bool

func (*DatasourceEvent) GetIdentifier added in v0.3.3 

func (e *DatasourceEvent) GetIdentifier() string

func (*DatasourceEvent) GetInternal added in v0.3.3 

func (e *DatasourceEvent) GetInternal() bool

func (*DatasourceEvent) GetModule added in v0.3.3 

func (e *DatasourceEvent) GetModule() string

func (*DatasourceEvent) GetMountNsID added in v0.3.3 

func (e *DatasourceEvent) GetMountNsID() uint64

func (*DatasourceEvent) GetNamespace added in v0.3.3 

func (e *DatasourceEvent) GetNamespace() string

func (*DatasourceEvent) GetNewPath added in v0.3.3 

func (e *DatasourceEvent) GetNewPath() string

func (*DatasourceEvent) GetNumAnswers added in v0.3.3 

func (e *DatasourceEvent) GetNumAnswers() int

func (*DatasourceEvent) GetOldPath added in v0.3.3 

func (e *DatasourceEvent) GetOldPath() string

func (*DatasourceEvent) GetOpcode added in v0.3.3 

func (e *DatasourceEvent) GetOpcode() int

func (*DatasourceEvent) GetOtherIp added in v0.3.3 

func (e *DatasourceEvent) GetOtherIp() string

func (*DatasourceEvent) GetPID added in v0.3.3 

func (e *DatasourceEvent) GetPID() uint32

func (*DatasourceEvent) GetPID64 added in v0.3.3 

func (e *DatasourceEvent) GetPID64() uint64

GetPID64 is a special implementation for stack trace events.

func (*DatasourceEvent) GetParentExePath added in v0.3.108 

func (e *DatasourceEvent) GetParentExePath() string

func (*DatasourceEvent) GetPath added in v0.3.3 

func (e *DatasourceEvent) GetPath() string

func (*DatasourceEvent) GetPcomm added in v0.3.3 

func (e *DatasourceEvent) GetPcomm() string

func (*DatasourceEvent) GetPktType added in v0.3.3 

func (e *DatasourceEvent) GetPktType() string

func (*DatasourceEvent) GetPod added in v0.3.3 

func (e *DatasourceEvent) GetPod() string

func (*DatasourceEvent) GetPodHostIP added in v0.3.3 

func (e *DatasourceEvent) GetPodHostIP() string

func (*DatasourceEvent) GetPodLabels added in v0.3.3 

func (e *DatasourceEvent) GetPodLabels() map[string]string

func (*DatasourceEvent) GetPpid added in v0.3.3 

func (e *DatasourceEvent) GetPpid() uint32

func (*DatasourceEvent) GetProto added in v0.3.3 

func (e *DatasourceEvent) GetProto() string

func (*DatasourceEvent) GetPupperLayer added in v0.3.3 

func (e *DatasourceEvent) GetPupperLayer() bool

func (*DatasourceEvent) GetQr added in v0.3.3 

func (e *DatasourceEvent) GetQr() DNSPktType

GetQr returns Q or R for a DNS event and "" for any other event type, so a rule that reads event.qr on a non-DNS event gets the documented empty value instead of a spurious Q.

func (*DatasourceEvent) GetQtype added in v0.3.278 

func (e *DatasourceEvent) GetQtype() string

GetQtype returns the DNS question type name. Non-DNS events return "" without touching the datasource, so a rule that reads event.qtype on another event type does not log a missing-field warning.

func (*DatasourceEvent) GetRcode added in v0.3.278 

func (e *DatasourceEvent) GetRcode() string

GetRcode returns the DNS response code name for a response and "" for a query. The gadget operator only writes rcode on responses, and packet buffers are pooled, so the field must not be read on a query.

func (*DatasourceEvent) GetRequest added in v0.3.3 

func (e *DatasourceEvent) GetRequest() *http.Request

func (*DatasourceEvent) GetResponse added in v0.3.3 

func (e *DatasourceEvent) GetResponse() *http.Response

func (*DatasourceEvent) GetSignal added in v0.3.3 

func (e *DatasourceEvent) GetSignal() uint32

func (*DatasourceEvent) GetSockFd added in v0.3.3 

func (e *DatasourceEvent) GetSockFd() uint32

func (*DatasourceEvent) GetSocketInode added in v0.3.3 

func (e *DatasourceEvent) GetSocketInode() uint64

func (*DatasourceEvent) GetSrcIP added in v0.3.3 

func (e *DatasourceEvent) GetSrcIP() string

func (*DatasourceEvent) GetSrcPort added in v0.3.3 

func (e *DatasourceEvent) GetSrcPort() uint16

func (*DatasourceEvent) GetSyscall added in v0.3.3 

func (e *DatasourceEvent) GetSyscall() string

func (*DatasourceEvent) GetSyscalls added in v0.3.3 

func (e *DatasourceEvent) GetSyscalls() []byte

func (*DatasourceEvent) GetTTY added in v0.3.165 

func (e *DatasourceEvent) GetTTY() int32

GetTTY returns the index of the controlling terminal within its own driver. It does not uniquely identify a device: the index is only unique per driver, so /dev/pts/0 and /dev/tty0 are both 0. A nonzero value does mean a terminal is present; only 0 is ambiguous, meaning either /dev/pts/0 or no terminal at all. Prefer GetTTYMajor/GetTTYMinor.

func (*DatasourceEvent) GetTTYMajor added in v0.3.165 

func (e *DatasourceEvent) GetTTYMajor() uint32

GetTTYMajor returns the major number of the controlling terminal's device, or 0 when the process has no controlling terminal or the running gadget does not emit it. Use FieldPresent("tty_major") to tell those apart.

func (*DatasourceEvent) GetTTYMinor added in v0.3.165 

func (e *DatasourceEvent) GetTTYMinor() uint32

GetTTYMinor returns the minor number of the controlling terminal's device, or 0 when the process has no controlling terminal or the running gadget does not emit it.

func (*DatasourceEvent) GetTimestamp added in v0.3.3 

func (e *DatasourceEvent) GetTimestamp() types.Time

func (*DatasourceEvent) GetType added in v0.3.3 

func (e *DatasourceEvent) GetType() HTTPDataType

func (*DatasourceEvent) GetUid added in v0.3.3 

func (e *DatasourceEvent) GetUid() *uint32

func (*DatasourceEvent) GetUpperLayer added in v0.3.3 

func (e *DatasourceEvent) GetUpperLayer() bool

func (*DatasourceEvent) HasDroppedEvents added in v0.3.3 

func (e *DatasourceEvent) HasDroppedEvents() bool

func (*DatasourceEvent) IsDir added in v0.3.3 

func (e *DatasourceEvent) IsDir() bool

func (*DatasourceEvent) IsRuleOnly added in v0.3.278 

func (e *DatasourceEvent) IsRuleOnly() bool

IsRuleOnly implements RuleOnlyEvent.

func (*DatasourceEvent) MakeHttpEvent added in v0.3.3 

func (e *DatasourceEvent) MakeHttpEvent(request *http.Request, direction consts.NetworkDirection) HttpEvent

func (*DatasourceEvent) Release added in v0.3.3 

func (e *DatasourceEvent) Release()

func (*DatasourceEvent) SetExtra added in v0.3.3 

func (e *DatasourceEvent) SetExtra(extra any)

func (*DatasourceEvent) SetResponse added in v0.3.3 

func (e *DatasourceEvent) SetResponse(response *http.Response)

type EnrichEvent added in v0.2.197 

type EnrichEvent interface {
	K8sEvent
	GetComm() string
	GetContainer() string
	GetContainerImage() string
	GetContainerImageDigest() string
	GetError() int64
	GetExtra() any
	FieldPresent(name string) bool
	GetGid() *uint32
	GetHostNetwork() bool
	GetMountNsID() uint64
	GetPcomm() string
	GetPID() uint32
	GetPID64() uint64
	GetPodLabels() map[string]string
	GetPpid() uint32
	GetUid() *uint32
	SetExtra(extra any)

	// ECS-specific methods
	GetEcsClusterName() string
	GetEcsClusterARN() string
	GetEcsTaskARN() string
	GetEcsTaskFamily() string
	GetEcsTaskDefinitionARN() string
	GetEcsServiceName() string
	GetEcsContainerName() string
	GetEcsContainerARN() string
	GetEcsContainerInstance() string
	GetEcsAvailabilityZone() string
	GetEcsLaunchType() string
}

type EventType 

type EventType string
const (
	AllEventType          EventType = "all"
	BpfEventType          EventType = "bpf"
	CapabilitiesEventType EventType = "capabilities"
	DnsEventType          EventType = "dns"
	// DnsQueryRuleEventType is not a tracer event type. It is the rule-selection
	// alias for DNS queries and error responses forwarded to the rule manager
	// (see RuleEventType); such events still report DnsEventType from
	// GetEventType so every DNS accessor and adapter applies to them.
	DnsQueryRuleEventType EventType = "dnsQuery"
	ExecveEventType       EventType = "exec"
	ExitEventType         EventType = "exit"
	ForkEventType         EventType = "fork"
	HTTPEventType         EventType = "http"
	HardlinkEventType     EventType = "hardlink"
	IoUringEventType      EventType = "iouring"
	KmodEventType         EventType = "kmod"
	NetworkEventType      EventType = "network"
	OpenEventType         EventType = "open"
	ProcfsEventType       EventType = "procfs"
	PtraceEventType       EventType = "ptrace"
	RandomXEventType      EventType = "randomx"
	SSHEventType          EventType = "ssh"
	SymlinkEventType      EventType = "symlink"
	SyscallEventType      EventType = "syscall"
	UnshareEventType      EventType = "unshare"
)

func RuleEventType added in v0.3.278 

func RuleEventType(e K8sEvent) EventType

RuleEventType returns the event type the rule manager uses to select rule expressions for e. For a rule-only DNS event this is DnsQueryRuleEventType, so that rules opt in with `eventType: "dnsQuery"` and existing "dns" expressions keep matching answered responses only. For every other event it is the event's own type.

type ExecEvent added in v0.3.3 

type ExecEvent interface {
	EnrichEvent
	GetArgs() []string
	GetCwd() string
	GetExePath() string
	GetFile() string
	GetHasTTY() bool
	GetParentExePath() string
	GetPupperLayer() bool
	GetTTY() int32
	GetTTYMajor() uint32
	GetTTYMinor() uint32
	GetUpperLayer() bool
}

type ExitEvent added in v0.3.3 

type ExitEvent interface {
	EnrichEvent
	GetExitCode() uint32
	GetSignal() uint32
}

type ForkEvent added in v0.3.3 

type ForkEvent interface {
	EnrichEvent
	GetExePath() string
}

type HTTPDataType added in v0.3.3 

type HTTPDataType int

type HttpEvent added in v0.3.3 

type HttpEvent interface {
	HttpRawEvent
	GetDirection() consts.NetworkDirection
	GetInternal() bool
	GetOtherIp() string
	GetRequest() *http.Request
	GetResponse() *http.Response
	SetResponse(response *http.Response)
}

type HttpRawEvent added in v0.3.3 

type HttpRawEvent interface {
	EnrichEvent
	GetBuf() []byte
	GetBufLen() uint16
	GetDstIP() string
	GetDstPort() uint16
	GetSockFd() uint32
	GetSocketInode() uint64
	GetSrcIP() string
	GetSrcPort() uint16
	GetSyscall() string
	GetType() HTTPDataType
	MakeHttpEvent(request *http.Request, direction consts.NetworkDirection) HttpEvent
}

type IOUring added in v0.3.3 

type IOUring interface {
	EnrichEvent
	GetFlags() []string
	GetIdentifier() string
	GetOpcode() int
}

type K8sEvent added in v0.2.145 

type K8sEvent interface {
	GetContainerID() string
	GetEventType() EventType
	GetNamespace() string
	GetPod() string
	GetTimestamp() types.Time
	HasDroppedEvents() bool
	Release()
}

type KmodEvent added in v0.3.3 

type KmodEvent interface {
	EnrichEvent
	GetModule() string
	GetExePath() string
	GetSyscall() string
	GetUpperLayer() bool
}

type LifecycleQueue added in v0.3.244 

type LifecycleQueue struct {
	// contains filtered or unexported fields
}

LifecycleQueue runs callbacks in submission order for each key, without blocking unrelated containers. The zero value is ready for use. Idle keys are removed, so the queue does not retain every container ever observed.

func (*LifecycleQueue) Submit added in v0.3.244 

func (q *LifecycleQueue) Submit(key string, callback func())

type LinkEvent added in v0.3.3 

type LinkEvent interface {
	EnrichEvent
	GetExePath() string
	GetNewPath() string
	GetOldPath() string
	GetUpperLayer() bool
}

type NetworkEvent added in v0.3.3 

type NetworkEvent interface {
	EnrichEvent
	GetExePath() string
	GetDstEndpoint() types.L4Endpoint
	GetDstPort() uint16
	GetPktType() string
	GetPodHostIP() string
	GetProto() string
}

type OpenEvent added in v0.3.3 

type OpenEvent interface {
	EnrichEvent
	GetFlags() []string
	GetFlagsRaw() uint32
	GetFullPath() string
	GetPath() string
	IsDir() bool
}

type PatchOperation 

type PatchOperation struct {
	Op    string `json:"op"`
	Path  string `json:"path"`
	Value any    `json:"value"`
}

type PendingAdds added in v0.3.273 

type PendingAdds struct {
	// contains filtered or unexported fields
}

PendingAdds tracks in-flight registrations so a remove event can abort them. A failure from that abort is expected: the container exited first (#848). Any other failure is not. The zero value is ready for use.

func (*PendingAdds) Cancel added in v0.3.273 

func (p *PendingAdds) Cancel(key string)

Cancel aborts every registration tracked for key. Later Track calls are not affected, so readmission works.

func (*PendingAdds) Len added in v0.3.273 

func (p *PendingAdds) Len(key string) int

Len returns the number of tracked registrations for key.

func (*PendingAdds) Track added in v0.3.273 

func (p *PendingAdds) Track(key string) (context.Context, func())

Track registers a registration for key. A later Cancel(key) cancels the returned context with ErrContainerRemoved. Call release once the registration settles. Call Track in the add callback itself, not in a spawned goroutine, so the following remove callback always sees it.

type PtraceEvent added in v0.3.3 

type PtraceEvent interface {
	EnrichEvent
	GetExePath() string
}

type RuleOnlyEvent added in v0.3.278 

type RuleOnlyEvent interface {
	IsRuleOnly() bool
}

RuleOnlyEvent is implemented by events that must reach the rule manager only, bypassing every other consumer of their event type (profile learning, DNS cache, network stream, metrics, third-party receivers). The DNS tracer marks forwarded queries and error responses this way: they carry no answer addresses and would otherwise trigger agent-side lookups in the DNS manager and be recorded as outbound connections by the network stream.

type SshEvent added in v0.3.3 

type SshEvent interface {
	EnrichEvent
	GetDstIP() string
	GetDstPort() uint16
	GetSrcIP() string
	GetSrcPort() uint16
}

type StructEvent added in v0.3.3 

type StructEvent struct {
	Addresses            []string                `json:"addresses,omitempty" yaml:"addresses,omitempty"`
	Args                 []string                `json:"args,omitempty" yaml:"args,omitempty"`
	AttrSize             uint32                  `json:"attrSize,omitempty" yaml:"attrSize,omitempty"`
	Buf                  []byte                  `json:"buf,omitempty" yaml:"buf,omitempty"`
	CapName              string                  `json:"capName,omitempty" yaml:"capName,omitempty"`
	Cmd                  uint32                  `json:"cmd,omitempty" yaml:"cmd,omitempty"`
	Comm                 string                  `json:"comm,omitempty" yaml:"comm,omitempty"`
	Container            string                  `json:"container,omitempty" yaml:"container,omitempty"`
	ContainerID          string                  `json:"containerId,omitempty" yaml:"containerId,omitempty"`
	ContainerImage       string                  `json:"containerImage,omitempty" yaml:"containerImage,omitempty"`
	ContainerImageDigest string                  `json:"containerImageDigest,omitempty" yaml:"containerImageDigest,omitempty"`
	Cwd                  string                  `json:"cwd,omitempty" yaml:"cwd,omitempty"`
	DNSName              string                  `json:"dnsName,omitempty" yaml:"dnsName,omitempty"`
	Dir                  bool                    `json:"dir,omitempty" yaml:"dir,omitempty"`
	Direction            consts.NetworkDirection `json:"direction,omitempty" yaml:"direction,omitempty"`
	DstEndpoint          types.L3Endpoint        `json:"dstEndpoint" yaml:"dstEndpoint,omitempty"`
	DstIP                string                  `json:"dstIP,omitempty" yaml:"dstIP,omitempty"`
	DstPort              uint16                  `json:"dstPort,omitempty" yaml:"dstPort,omitempty"`
	Error                int64                   `json:"error,omitempty" yaml:"error,omitempty"`
	EventType            EventType               `json:"eventType,omitempty" yaml:"eventType,omitempty"`
	ExePath              string                  `json:"exePath,omitempty" yaml:"exePath,omitempty"`
	ExitCode             uint32                  `json:"exitCode,omitempty" yaml:"exitCode,omitempty"`
	Extra                any                     `json:"extra,omitempty" yaml:"extra,omitempty"`
	File                 string                  `json:"file,omitempty" yaml:"file,omitempty"`
	Flags                []string                `json:"flags,omitempty" yaml:"flags,omitempty"`
	FlagsRaw             uint32                  `json:"flagsRaw,omitempty" yaml:"flagsRaw,omitempty"`
	FullPath             string                  `json:"fullPath,omitempty" yaml:"fullPath,omitempty"`
	FullPathTracing      bool                    `json:"fullPathTracing,omitempty" yaml:"fullPathTracing,omitempty"`
	Gid                  uint32                  `json:"gid,omitempty" yaml:"gid,omitempty"`
	HostNetwork          bool                    `json:"hostNetwork,omitempty" yaml:"hostNetwork,omitempty"`
	ID                   string                  `json:"id,omitempty" yaml:"id,omitempty"`
	Identifier           string                  `json:"identifier,omitempty" yaml:"identifier,omitempty"`
	Internal             bool                    `json:"internal,omitempty" yaml:"internal,omitempty"`
	Module               string                  `json:"module,omitempty" yaml:"module,omitempty"`
	MountNsID            uint64                  `json:"mountNsID,omitempty" yaml:"mountNsID,omitempty"`
	Namespace            string                  `json:"namespace,omitempty" yaml:"namespace,omitempty"`
	NewPath              string                  `json:"newPath,omitempty" yaml:"newPath,omitempty"`
	NumAnswers           int                     `json:"numAnswers,omitempty" yaml:"numAnswers,omitempty"`
	OldPath              string                  `json:"oldPath,omitempty" yaml:"oldPath,omitempty"`
	Opcode               int                     `json:"opcode,omitempty" yaml:"opcode,omitempty"`
	PID64                uint64                  `json:"pid64,omitempty" yaml:"pid64,omitempty"`
	Path                 string                  `json:"path,omitempty" yaml:"path,omitempty"`
	Pcomm                string                  `json:"pcomm,omitempty" yaml:"pcomm,omitempty"`
	Pid                  uint32                  `json:"pid,omitempty" yaml:"pid,omitempty"`
	PktType              string                  `json:"pktType,omitempty" yaml:"pktType,omitempty"`
	Pod                  string                  `json:"pod,omitempty" yaml:"pod,omitempty"`
	PodHostIP            string                  `json:"podHostIP,omitempty" yaml:"podHostIP,omitempty"`
	PodLabels            map[string]string       `json:"podLabels,omitempty" yaml:"podLabels,omitempty"`
	ParentExePath        string                  `json:"parentExePath,omitempty" yaml:"parentExePath,omitempty"`
	Ppid                 uint32                  `json:"ppid,omitempty" yaml:"ppid,omitempty"`
	Proto                string                  `json:"proto,omitempty" yaml:"proto,omitempty"`
	Ptid                 uint64                  `json:"ptid,omitempty" yaml:"ptid,omitempty"`
	PtraceRequest        int                     `json:"ptraceRequest,omitempty" yaml:"ptraceRequest,omitempty"`
	PupperLayer          bool                    `json:"pupperLayer,omitempty" yaml:"pupperLayer,omitempty"`
	Qr                   DNSPktType              `json:"qr,omitempty" yaml:"qr,omitempty"`
	Qtype                string                  `json:"qtype,omitempty" yaml:"qtype,omitempty"`
	Rcode                string                  `json:"rcode,omitempty" yaml:"rcode,omitempty"`
	Request              *http.Request           `json:"request,omitempty" yaml:"request,omitempty"`
	// RuleOnly mirrors DatasourceEvent.RuleOnly for synthetic events (rule
	// library tests build dnsQuery events with it). Not serialized.
	RuleOnly    bool           `json:"-" yaml:"-"`
	Response    *http.Response `json:"response,omitempty" yaml:"response,omitempty"`
	Signal      uint32         `json:"signal,omitempty" yaml:"signal,omitempty"`
	SockFd      uint32         `json:"sockFd,omitempty" yaml:"sockFd,omitempty"`
	SocketInode uint64         `json:"socketInode,omitempty" yaml:"socketInode,omitempty"`
	SrcIP       string         `json:"srcIP,omitempty" yaml:"srcIP,omitempty"`
	SrcPort     uint16         `json:"srcPort,omitempty" yaml:"srcPort,omitempty"`
	StatusCode  int            `json:"statusCode,omitempty" yaml:"statusCode,omitempty"`
	Syscall     string         `json:"syscall,omitempty" yaml:"syscall,omitempty"`
	Syscalls    []byte         `json:"syscalls,omitempty" yaml:"syscalls,omitempty"`
	Tid         uint64         `json:"tid,omitempty" yaml:"tid,omitempty"`
	Timestamp   int64          `json:"timestamp,omitempty" yaml:"timestamp,omitempty"`
	TTY         *int32         `json:"tty,omitempty" yaml:"tty,omitempty"`
	TTYMajor    *uint32        `json:"ttyMajor,omitempty" yaml:"ttyMajor,omitempty"`
	TTYMinor    *uint32        `json:"ttyMinor,omitempty" yaml:"ttyMinor,omitempty"`
	Type        HTTPDataType   `json:"type,omitempty" yaml:"type,omitempty"`
	Uid         uint32         `json:"uid,omitempty" yaml:"uid,omitempty"`
	UpperLayer  bool           `json:"upperLayer,omitempty" yaml:"upperLayer,omitempty"`
	UserData    int            `json:"userData,omitempty" yaml:"userData,omitempty"`
}

func (*StructEvent) FieldPresent added in v0.3.165 

func (e *StructEvent) FieldPresent(name string) bool

FieldPresent reports whether this event carries the named field, using datasource field names (snake_case) to match the DatasourceEvent implementation. A nil pointer means "not measured".

Only names with a wired CEL presence tester are meaningful here; everything else reports false. If a presence tester is ever added for another field, this switch must be extended in the same change.

func (*StructEvent) GetAddresses added in v0.3.3 

func (e *StructEvent) GetAddresses() []string

func (*StructEvent) GetArgs added in v0.3.3 

func (e *StructEvent) GetArgs() []string

func (*StructEvent) GetAttrSize added in v0.3.3 

func (e *StructEvent) GetAttrSize() uint32

func (*StructEvent) GetBuf added in v0.3.3 

func (e *StructEvent) GetBuf() []byte

func (*StructEvent) GetBufLen added in v0.3.60 

func (e *StructEvent) GetBufLen() uint16

func (*StructEvent) GetCapability added in v0.3.3 

func (e *StructEvent) GetCapability() string

func (*StructEvent) GetCmd added in v0.3.3 

func (e *StructEvent) GetCmd() uint32

func (*StructEvent) GetComm added in v0.3.3 

func (e *StructEvent) GetComm() string

func (*StructEvent) GetContainer added in v0.3.3 

func (e *StructEvent) GetContainer() string

func (*StructEvent) GetContainerID added in v0.3.3 

func (e *StructEvent) GetContainerID() string

func (*StructEvent) GetContainerImage added in v0.3.3 

func (e *StructEvent) GetContainerImage() string

func (*StructEvent) GetContainerImageDigest added in v0.3.3 

func (e *StructEvent) GetContainerImageDigest() string

func (*StructEvent) GetCwd added in v0.3.3 

func (e *StructEvent) GetCwd() string

func (*StructEvent) GetDNSName added in v0.3.3 

func (e *StructEvent) GetDNSName() string

func (*StructEvent) GetDirection added in v0.3.3 

func (e *StructEvent) GetDirection() consts.NetworkDirection

func (*StructEvent) GetDstEndpoint added in v0.3.3 

func (e *StructEvent) GetDstEndpoint() types.L4Endpoint

func (*StructEvent) GetDstIP added in v0.3.3 

func (e *StructEvent) GetDstIP() string

func (*StructEvent) GetDstPort added in v0.3.3 

func (e *StructEvent) GetDstPort() uint16

func (*StructEvent) GetEcsAvailabilityZone added in v0.3.36 

func (e *StructEvent) GetEcsAvailabilityZone() string

func (*StructEvent) GetEcsClusterARN added in v0.3.36 

func (e *StructEvent) GetEcsClusterARN() string

func (*StructEvent) GetEcsClusterName added in v0.3.36 

func (e *StructEvent) GetEcsClusterName() string

func (*StructEvent) GetEcsContainerARN added in v0.3.36 

func (e *StructEvent) GetEcsContainerARN() string

func (*StructEvent) GetEcsContainerInstance added in v0.3.36 

func (e *StructEvent) GetEcsContainerInstance() string

func (*StructEvent) GetEcsContainerName added in v0.3.36 

func (e *StructEvent) GetEcsContainerName() string

func (*StructEvent) GetEcsLaunchType added in v0.3.36 

func (e *StructEvent) GetEcsLaunchType() string

func (*StructEvent) GetEcsServiceName added in v0.3.36 

func (e *StructEvent) GetEcsServiceName() string

func (*StructEvent) GetEcsTaskARN added in v0.3.36 

func (e *StructEvent) GetEcsTaskARN() string

func (*StructEvent) GetEcsTaskDefinitionARN added in v0.3.36 

func (e *StructEvent) GetEcsTaskDefinitionARN() string

func (*StructEvent) GetEcsTaskFamily added in v0.3.36 

func (e *StructEvent) GetEcsTaskFamily() string

func (*StructEvent) GetError added in v0.3.3 

func (e *StructEvent) GetError() int64

func (*StructEvent) GetEventType added in v0.3.3 

func (e *StructEvent) GetEventType() EventType

func (*StructEvent) GetExePath added in v0.3.3 

func (e *StructEvent) GetExePath() string

func (*StructEvent) GetExitCode added in v0.3.3 

func (e *StructEvent) GetExitCode() uint32

func (*StructEvent) GetExtra added in v0.3.3 

func (e *StructEvent) GetExtra() any

func (*StructEvent) GetFile added in v0.3.307 

func (e *StructEvent) GetFile() string

func (*StructEvent) GetFlags added in v0.3.3 

func (e *StructEvent) GetFlags() []string

func (*StructEvent) GetFlagsRaw added in v0.3.3 

func (e *StructEvent) GetFlagsRaw() uint32

func (*StructEvent) GetFullPath added in v0.3.3 

func (e *StructEvent) GetFullPath() string

func (*StructEvent) GetGid added in v0.3.3 

func (e *StructEvent) GetGid() *uint32

func (*StructEvent) GetHasTTY added in v0.3.165 

func (e *StructEvent) GetHasTTY() bool

GetHasTTY reports whether the process has a controlling terminal, preferring the device major and falling back to the driver-local index.

func (*StructEvent) GetHostNetwork added in v0.3.3 

func (e *StructEvent) GetHostNetwork() bool

func (*StructEvent) GetIdentifier added in v0.3.3 

func (e *StructEvent) GetIdentifier() string

func (*StructEvent) GetInternal added in v0.3.3 

func (e *StructEvent) GetInternal() bool

func (*StructEvent) GetModule added in v0.3.3 

func (e *StructEvent) GetModule() string

func (*StructEvent) GetMountNsID added in v0.3.3 

func (e *StructEvent) GetMountNsID() uint64

func (*StructEvent) GetNamespace added in v0.3.3 

func (e *StructEvent) GetNamespace() string

func (*StructEvent) GetNewPath added in v0.3.3 

func (e *StructEvent) GetNewPath() string

func (*StructEvent) GetNumAnswers added in v0.3.3 

func (e *StructEvent) GetNumAnswers() int

func (*StructEvent) GetOldPath added in v0.3.3 

func (e *StructEvent) GetOldPath() string

func (*StructEvent) GetOpcode added in v0.3.3 

func (e *StructEvent) GetOpcode() int

func (*StructEvent) GetOtherIp added in v0.3.3 

func (e *StructEvent) GetOtherIp() string

func (*StructEvent) GetPID added in v0.3.3 

func (e *StructEvent) GetPID() uint32

func (*StructEvent) GetPID64 added in v0.3.3 

func (e *StructEvent) GetPID64() uint64

GetPID64 is a special implementation for stack trace events.

func (*StructEvent) GetParentExePath added in v0.3.108 

func (e *StructEvent) GetParentExePath() string

func (*StructEvent) GetPath added in v0.3.3 

func (e *StructEvent) GetPath() string

func (*StructEvent) GetPcomm added in v0.3.3 

func (e *StructEvent) GetPcomm() string

func (*StructEvent) GetPktType added in v0.3.3 

func (e *StructEvent) GetPktType() string

func (*StructEvent) GetPod added in v0.3.3 

func (e *StructEvent) GetPod() string

func (*StructEvent) GetPodHostIP added in v0.3.3 

func (e *StructEvent) GetPodHostIP() string

func (*StructEvent) GetPodLabels added in v0.3.3 

func (e *StructEvent) GetPodLabels() map[string]string

func (*StructEvent) GetPpid added in v0.3.3 

func (e *StructEvent) GetPpid() uint32

func (*StructEvent) GetProto added in v0.3.3 

func (e *StructEvent) GetProto() string

func (*StructEvent) GetPtid added in v0.3.3 

func (e *StructEvent) GetPtid() uint64

func (*StructEvent) GetPupperLayer added in v0.3.3 

func (e *StructEvent) GetPupperLayer() bool

func (*StructEvent) GetQr added in v0.3.3 

func (e *StructEvent) GetQr() DNSPktType

func (*StructEvent) GetQtype added in v0.3.278 

func (e *StructEvent) GetQtype() string

func (*StructEvent) GetRcode added in v0.3.278 

func (e *StructEvent) GetRcode() string

GetRcode mirrors DatasourceEvent: a query never carries a response code.

func (*StructEvent) GetRequest added in v0.3.3 

func (e *StructEvent) GetRequest() *http.Request

func (*StructEvent) GetResponse added in v0.3.3 

func (e *StructEvent) GetResponse() *http.Response

func (*StructEvent) GetSignal added in v0.3.3 

func (e *StructEvent) GetSignal() uint32

func (*StructEvent) GetSockFd added in v0.3.3 

func (e *StructEvent) GetSockFd() uint32

func (*StructEvent) GetSocketInode added in v0.3.3 

func (e *StructEvent) GetSocketInode() uint64

func (*StructEvent) GetSrcIP added in v0.3.3 

func (e *StructEvent) GetSrcIP() string

func (*StructEvent) GetSrcPort added in v0.3.3 

func (e *StructEvent) GetSrcPort() uint16

func (*StructEvent) GetSyscall added in v0.3.3 

func (e *StructEvent) GetSyscall() string

func (*StructEvent) GetSyscalls added in v0.3.3 

func (e *StructEvent) GetSyscalls() []byte

func (*StructEvent) GetTTY added in v0.3.165 

func (e *StructEvent) GetTTY() int32

func (*StructEvent) GetTTYMajor added in v0.3.165 

func (e *StructEvent) GetTTYMajor() uint32

func (*StructEvent) GetTTYMinor added in v0.3.165 

func (e *StructEvent) GetTTYMinor() uint32

func (*StructEvent) GetTid added in v0.3.3 

func (e *StructEvent) GetTid() uint64

func (*StructEvent) GetTimestamp added in v0.3.3 

func (e *StructEvent) GetTimestamp() types.Time

func (*StructEvent) GetType added in v0.3.3 

func (e *StructEvent) GetType() HTTPDataType

func (*StructEvent) GetUid added in v0.3.3 

func (e *StructEvent) GetUid() *uint32

func (*StructEvent) GetUpperLayer added in v0.3.3 

func (e *StructEvent) GetUpperLayer() bool

func (*StructEvent) HasDroppedEvents added in v0.3.3 

func (e *StructEvent) HasDroppedEvents() bool

func (*StructEvent) IsDir added in v0.3.3 

func (e *StructEvent) IsDir() bool

func (*StructEvent) IsRuleOnly added in v0.3.278 

func (e *StructEvent) IsRuleOnly() bool

IsRuleOnly implements RuleOnlyEvent.

func (*StructEvent) MakeHttpEvent added in v0.3.3 

func (e *StructEvent) MakeHttpEvent(request *http.Request, direction consts.NetworkDirection) HttpEvent

func (*StructEvent) Release added in v0.3.3 

func (e *StructEvent) Release()

func (*StructEvent) SetExtra added in v0.3.3 

func (e *StructEvent) SetExtra(extra any)

func (*StructEvent) SetResponse added in v0.3.3 

func (e *StructEvent) SetResponse(response *http.Response)

type SyscallEvent added in v0.3.3 

type SyscallEvent interface {
	EnrichEvent
	GetSyscall() string
}

type UnshareEvent added in v0.3.3 

type UnshareEvent interface {
	EnrichEvent
	GetExePath() string
	// GetFlags() uint64
	GetUpperLayer() bool
}

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.