Documentation
¶
Overview ¶
Package bpf provides Go bindings for the eBPF process tracer.
Index ¶
- Constants
- func LoadProcessTracerObjects(obj *processTracerObjects, opts *ebpf.CollectionOptions) error
- func LoadProcessTracerSpec() (*ebpf.CollectionSpec, error)
- type AncestorHop
- type AncestorTraceEvent
- type CloneSyscallEvent
- type EnvChunkEvent
- type EnvVarEvent
- type Event
- type EventData
- type ProcessEventData
- type ProcessTracerMaps
- type ProcessTracerObjects
- type ProcessTracerPrograms
- type TCPEventData
Constants ¶
const ( EVENT_EXEC = 1 EVENT_EXIT = 2 EVENT_TCP_CONNECT = 3 EVENT_TCP_CLOSE = 4 EVENT_EXEC_ENV_CHUNK = 5 EVENT_ENV_VAR = 6 EVENT_EXEC_CANDIDATE = 7 EVENT_FORK = 8 EVENT_ANCESTOR_TRACE = 9 EVENT_CLONE_SYSCALL = 10 )
Event type constants matching kernel/C conventions.
const AncestorTraceMaxHops = 16
AncestorTraceMaxHops mirrors ANCESTOR_TRACE_MAX_HOPS in process_tracer.h.
Variables ¶
This section is empty.
Functions ¶
func LoadProcessTracerObjects ¶
func LoadProcessTracerObjects(obj *processTracerObjects, opts *ebpf.CollectionOptions) error
LoadProcessTracerObjects loads the BPF programs and maps.
func LoadProcessTracerSpec ¶ added in v0.5.0
func LoadProcessTracerSpec() (*ebpf.CollectionSpec, error)
LoadProcessTracerSpec loads and returns the BPF CollectionSpec without loading into kernel. This allows modifying variables (e.g. ambient_mode) before loading.
Types ¶
type AncestorHop ¶ added in v0.8.5
type AncestorHop struct {
Tgid uint32
PidNsInum uint32
Comm [16]byte
Tracked uint8
// contains filtered or unexported fields
}
AncestorHop mirrors struct ancestor_hop in process_tracer.h.
type AncestorTraceEvent ¶ added in v0.8.5
type AncestorTraceEvent struct {
Pid uint32
Ppid uint32
UID uint32
Pad1 uint32
Timestamp uint64
Type uint8 // EVENT_ANCESTOR_TRACE
NumHops uint8
Reason uint8 // 0 = exec_no_ancestor, 1 = fork_no_ancestor
Hops [AncestorTraceMaxHops]AncestorHop
// contains filtered or unexported fields
}
AncestorTraceEvent matches struct ancestor_trace_event in process_tracer.h. Emitted by BPF before an exec_candidate / fork-no-ancestor event so userland sees the full 16-level real_parent chain even though the 8-level tracking walk found nothing. Correlate with the following exec_unclaimed / weld_fail by (Pid, Timestamp).
type CloneSyscallEvent ¶ added in v0.8.5
type CloneSyscallEvent struct {
Tgid uint32
UID uint32
Flags uint64
Timestamp uint64
Type uint8 // EVENT_CLONE_SYSCALL
Variant uint8 // 0 = clone, 1 = clone3
Comm [16]byte
// contains filtered or unexported fields
}
CloneSyscallEvent matches struct clone_syscall_event in process_tracer.h. Emitted for each clone/clone3 syscall entry in ambient mode. Correlate with sched_process_fork by (Tgid, Timestamp) to see the flags that produced a given fork.
type EnvChunkEvent ¶
type EnvChunkEvent struct {
Pid uint32
Ppid uint32 // Not used, but keeps layout consistent
UID uint32
Pad1 uint32 // Padding before timestamp (matches Event struct)
Timestamp uint64 // Not used, but keeps layout consistent
Type uint8 // EVENT_EXEC_ENV_CHUNK
ChunkID uint32
DataSize uint32
Argc uint32 // Number of argv strings at start of Data
IsFinal uint8
Truncated uint8
Data [15000]byte
// contains filtered or unexported fields
}
EnvChunkEvent represents a chunk of argv and environment variables from execve. This is a separate event type that doesn't fit in the fixed-size Event union. Header fields match Event struct for consistent type detection at offset 24.
type EnvVarEvent ¶
type EnvVarEvent struct {
Pid uint32
Ppid uint32
UID uint32
Pad1 uint32 // Padding before timestamp
Timestamp uint64
Type uint8 // EVENT_ENV_VAR
VarIndex uint16 // Position in argv/envp array (0-2047)
TotalVars uint16 // Total count (0 = unknown yet)
IsArgv uint8 // 0=env, 1=argv
IsFinal uint8 // 1 if this is last variable
Truncated uint8 // 1 if variable was truncated
DataSize uint16 // Actual data length
Data [512]byte
// contains filtered or unexported fields
}
EnvVarEvent represents a single environment variable or argument from execve. Used for streaming large numbers of variables (1024-2048+). Header fields match Event struct for consistent type detection.
type Event ¶
type Event struct {
Pid uint32
Ppid uint32
UID uint32
Pad1 uint32 // Padding before timestamp to maintain 8-byte alignment
Timestamp uint64
Type uint8
Pad2 [7]byte // Padding to align Data field
Data EventData
}
Event matches the C struct from process_tracer.h. Using explicit struct layout to match C union.
func (*Event) ProcessData ¶
func (e *Event) ProcessData() *ProcessEventData
ProcessData extracts process event fields.
type EventData ¶
type EventData struct {
// This will overlay both process and TCP data
// The actual interpretation depends on Event.Type
Raw [48]byte // Sized to fit the largest union member
}
EventData is a union type matching the C union.
type ProcessEventData ¶
type ProcessEventData struct {
ExitCode uint32
Comm [16]byte
IsContainerInit uint32 // 1 if PID 1 in a non-root PID namespace
NsLevel uint32 // PID namespace nesting level (0 = root)
TrackedAncestor uint32 // PID found via ancestor walk (0 if immediate parent was tracked)
PidNsInum uint32 // task->nsproxy->pid_ns_for_children->ns.inum; lets userland
}
ProcessEventData matches the proc struct in the C union.
type ProcessTracerMaps ¶
type ProcessTracerMaps = processTracerMaps
ProcessTracerMaps provides access to the BPF maps.
type ProcessTracerObjects ¶
type ProcessTracerObjects = processTracerObjects
ProcessTracerObjects provides access to the loaded BPF objects.
type ProcessTracerPrograms ¶
type ProcessTracerPrograms = processTracerPrograms
ProcessTracerPrograms provides access to the BPF programs.
Source Files