Documentation
¶
Index ¶
Constants ¶
const ( // MaxArgs is the number of argv slots the kernel program copies. Anything // beyond it is dropped in the kernel: an exec with more arguments is // reported truncated, never rejected. MaxArgs = 8 // MaxArgLen is the size of one argv slot. The kernel program's copy helper // truncates a longer argument at MaxArgLen and resumes mid-argument, so the // slot is unterminated and the next slot holds the tail of the same // argument: reported split rather than dropped. MaxArgLen = 128 // MaxFilename is the size of the filename field. MaxFilename = 256 // EventSize is the minimum number of bytes DecodeExecEvent needs. EventSize = offArgv + MaxArgs*MaxArgLen // 1310 )
Byte layout of `struct exec_event` in _cprog/exec.bpf.c. Little-endian, in the natural C field order with no internal padding:
off size field 0 8 cgroup_id __u64 8 4 pid __u32 (tgid, i.e. the userspace "pid") 12 16 comm char[16] (NUL-padded, may be unterminated) 28 2 argv_len __u16 (number of populated argv slots, <= 8) 30 256 filename char[256] 286 1024 argv char[8][128]
The C struct's sizeof is 1312 (8-byte alignment adds 2 trailing pad bytes); the decoder only requires the first EventSize bytes and ignores trailing padding.
const SourceName = "exec-trace"
SourceName is the name this source reports to the collector, and the value of the `source` label on its ingest and drop metrics.
Variables ¶
var ( // ErrTruncated means the kernel handed over fewer bytes than the layout // requires; the Go and C sides disagree, or the record is damaged. ErrTruncated = errors.New("exectrace: truncated kernel event") // ErrBadArgvLen means argv_len is larger than the kernel can produce, // which can only mean the layouts have drifted apart. ErrBadArgvLen = errors.New("exectrace: invalid argv count") )
Functions ¶
func DecodeExecEvent ¶
func DecodeExecEvent(b []byte) (runtimeevent.Event, error)
DecodeExecEvent converts one kernel exec event record into a normalized event.
Time is left zero: the record carries no timestamp, so the source stamps it. Count is 1 — every ring buffer record is one observed exec.
Types ¶
type Source ¶
type Source struct {
// contains filtered or unexported fields
}
Source streams one event per execve in a selected cgroup, with argv — the observation-only counterpart to pkg/bpf/lsm's enforcing bprm_check_security program, whose hook does not carry arguments. Argv is what identifies a stdio MCP server (`npx @modelcontextprotocol/...`, `uvx ...`).
The kernel side takes sched_process_exec as a raw tracepoint rather than through its ftrace format because only the raw form passes the `struct linux_binprm *`, whose argc is the only trustworthy bound on the argv walk: mm->arg_end brackets argv and envp together on some kernels, so a walk that stops at arg_end reports environment strings as arguments.
func (*Source) AddCgids ¶
AddCgids admits a pod's cgroups. Until a cgroup id is in this map the kernel program returns before reserving anything, so an unselected pod costs one hash lookup per exec and produces no traffic.
Source Files