Documentation
¶
Index ¶
- Constants
- Variables
- func PathKeys(values []string) (keys [][maxPathLen]byte, star bool, rejected []compiler.RejectedTarget)
- type LsmEnforcer
- func (l *LsmEnforcer) AddCgids(cgids []uint64) error
- func (l *LsmEnforcer) AddTargets(paths *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
- func (l *LsmEnforcer) Attach() (link.Link, error)
- func (l *LsmEnforcer) Close() error
- func (l *LsmEnforcer) DeleteCgids(cgids []uint64) error
- func (l *LsmEnforcer) DeleteTargets(paths *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
- func (l *LsmEnforcer) DisableObservation(cgids []uint64) error
- func (l *LsmEnforcer) EnableObservation(cgids []uint64) error
- func (l *LsmEnforcer) ReadEvents(cgids []uint64) (map[uint64]map[PathEventKey]uint32, error)
- func (l *LsmEnforcer) ReadEventsLost() (uint64, error)
- func (l *LsmEnforcer) SetDefaultDeny(val bool) error
- type PathEventKey
Constants ¶
const ( PROG_TYPE_LSM_OPEN = "file_open" PROG_TYPE_LSM_EXEC = "bprm_check_security" )
Variables ¶
ErrObservationUnavailable is returned when the loaded program has no usable open_events hash-of-maps, so per-cgid path counting cannot be turned on.
Functions ¶
func PathKeys ¶
func PathKeys(values []string) (keys [][maxPathLen]byte, star bool, rejected []compiler.RejectedTarget)
PathKeys returns the banned/allowed map keys for one behavior's path values: each path's bytes NUL-padded to the width the kernel side declares, exactly as bpf_probe_read_kernel_str leaves it. compiler.StarTarget yields no key; it sets star, the default-deny sentinel SetDefaultDeny carries.
Types ¶
type LsmEnforcer ¶
type LsmEnforcer struct {
// contains filtered or unexported fields
}
func NewForAttachTarget ¶
func NewForAttachTarget(logger *logr.Logger, target string) (*LsmEnforcer, error)
func (*LsmEnforcer) AddCgids ¶
func (l *LsmEnforcer) AddCgids(cgids []uint64) error
func (*LsmEnforcer) AddTargets ¶
func (l *LsmEnforcer) AddTargets(paths *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
AddTargets programs a policy's paths into the banned and allowed maps and returns every value PathKeys could not key.
func (*LsmEnforcer) Close ¶
func (l *LsmEnforcer) Close() error
func (*LsmEnforcer) DeleteCgids ¶
func (l *LsmEnforcer) DeleteCgids(cgids []uint64) error
func (*LsmEnforcer) DeleteTargets ¶
func (l *LsmEnforcer) DeleteTargets(paths *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
DeleteTargets removes what AddTargets programmed for the same pair. Both derive their keys from PathKeys, so a value one of them can key is a value the other can key too.
func (*LsmEnforcer) DisableObservation ¶
func (l *LsmEnforcer) DisableObservation(cgids []uint64) error
DisableObservation removes the open_events entry for each cgid and releases the inner map. A cgid that was never enabled is not an error.
func (*LsmEnforcer) EnableObservation ¶
func (l *LsmEnforcer) EnableObservation(cgids []uint64) error
EnableObservation creates (or reuses) an inner hash map in open_events for each cgid so the kernel program starts recording path counts for it.
func (*LsmEnforcer) ReadEvents ¶
func (l *LsmEnforcer) ReadEvents(cgids []uint64) (map[uint64]map[PathEventKey]uint32, error)
ReadEvents reads and resets the per-cgid path counts. Every cgid is visited even when one of them fails, so a single bad cgid cannot hide the counts of the rest.
func (*LsmEnforcer) ReadEventsLost ¶
func (l *LsmEnforcer) ReadEventsLost() (uint64, error)
ReadEventsLost reports open/exec observations the kernel program could not record because the cgid's count map was full. It shares ReadEvents' single caller, so statLast needs no lock of its own.
func (*LsmEnforcer) SetDefaultDeny ¶
func (l *LsmEnforcer) SetDefaultDeny(val bool) error
type PathEventKey ¶
type PathEventKey struct {
Path string
Decision runtimeevent.KernelDecision
}
PathEventKey identifies one observation counter: a path (or exec filename) plus the enforcement decision the kernel program applied to the operation.
Source Files