Documentation
¶
Index ¶
- Constants
- Variables
- func ClearPins() error
- func PathKeys(values []string) (keys [][maxPathLen]byte, star bool, rejected []compiler.RejectedTarget)
- type Dispatcher
- type LsmEnforcer
- func (l *LsmEnforcer) AddCgids(cgids []uint64) error
- func (l *LsmEnforcer) AddTargets(paths *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
- func (l *LsmEnforcer) Close() error
- func (l *LsmEnforcer) DeleteCgids(cgids []uint64) error
- func (l *LsmEnforcer) DeleteTargets(paths *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
- func (l *LsmEnforcer) DisableObservation(cgids []uint64) error
- func (l *LsmEnforcer) EnableObservation(cgids []uint64) error
- func (l *LsmEnforcer) ReadEvents(cgids []uint64) (map[uint64]map[PathEventKey]uint32, error)
- func (l *LsmEnforcer) ReadEventsLost() (uint64, error)
- func (l *LsmEnforcer) SetDefaultDeny(val bool) error
- type PathEventKey
Constants ¶
const ( PROG_TYPE_LSM_OPEN = "file_open" PROG_TYPE_LSM_EXEC = "bprm_check_security" )
Variables ¶
ErrObservationUnavailable is returned when the loaded program has no usable open_events hash-of-maps, so per-cgid path counting cannot be turned on.
var ProgTypes = []string{PROG_TYPE_LSM_OPEN, PROG_TYPE_LSM_EXEC}
ProgTypes is the ordered list of lsm hooks: a hook's index here is the PROG_TYPE_* value the kernel programs write into lsm_ctx.prog_type and use as the prog_count key, so this order is the one in _cprog/maps.h and cannot be changed on one side alone.
Functions ¶
func ClearPins ¶ added in v0.1.1
func ClearPins() error
ClearPins wipes the pin directory at startup. The pinned maps outlive the process, so a restart would otherwise inherit prog arrays holding fds of programs this process never loaded and a prog_count covering them
func PathKeys ¶
func PathKeys(values []string) (keys [][maxPathLen]byte, star bool, rejected []compiler.RejectedTarget)
PathKeys returns the banned/allowed map keys for one behavior's path values: each path's bytes NUL-padded to the width the kernel side declares, exactly as bpf_probe_read_kernel_str leaves it. compiler.StarTarget yields no key; it sets star, the default-deny sentinel SetDefaultDeny carries.
Types ¶
type Dispatcher ¶ added in v0.1.1
type Dispatcher struct {
// contains filtered or unexported fields
}
A Dispatcher owns one lsm hook: it is the only program attached to the kernel, and it tail-calls every enforcer registered in its prog array. Enforcers come and go with policies; the dispatcher stays for the process lifetime. Callers serialize access (the lsm manager holds its lock across every AddProgram/DeleteProgram).
func NewDispatcherForTarget ¶ added in v0.1.1
func NewDispatcherForTarget(target string) (*Dispatcher, error)
func (*Dispatcher) AddProgram ¶ added in v0.1.1
func (d *Dispatcher) AddProgram(progFd int) error
AddProgram publishes an enforcer in the prog array before bumping the count the kernel chain terminates on, so the chain never waits for a program that is not yet callable.
func (*Dispatcher) Attach ¶ added in v0.1.1
func (d *Dispatcher) Attach() error
func (*Dispatcher) DeleteProgram ¶ added in v0.1.1
func (d *Dispatcher) DeleteProgram(progFd int) error
DeleteProgram drops the count before clearing the slot, mirroring AddProgram's ordering: the kernel treats a populated slot past the count as unreachable and a missing slot as skipped, never as a chain that hangs.
type LsmEnforcer ¶
type LsmEnforcer struct {
// contains filtered or unexported fields
}
func NewForAttachTarget ¶
func NewForAttachTarget(d *Dispatcher, logger *logr.Logger) (*LsmEnforcer, error)
func (*LsmEnforcer) AddCgids ¶
func (l *LsmEnforcer) AddCgids(cgids []uint64) error
func (*LsmEnforcer) AddTargets ¶
func (l *LsmEnforcer) AddTargets(paths *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
AddTargets programs a policy's paths into the banned and allowed maps and returns every value PathKeys could not key.
func (*LsmEnforcer) Close ¶
func (l *LsmEnforcer) Close() error
func (*LsmEnforcer) DeleteCgids ¶
func (l *LsmEnforcer) DeleteCgids(cgids []uint64) error
func (*LsmEnforcer) DeleteTargets ¶
func (l *LsmEnforcer) DeleteTargets(paths *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
DeleteTargets removes what AddTargets programmed for the same pair. Both derive their keys from PathKeys, so a value one of them can key is a value the other can key too.
func (*LsmEnforcer) DisableObservation ¶
func (l *LsmEnforcer) DisableObservation(cgids []uint64) error
DisableObservation removes the open_events entry for each cgid and releases the inner map. A cgid that was never enabled is not an error.
func (*LsmEnforcer) EnableObservation ¶
func (l *LsmEnforcer) EnableObservation(cgids []uint64) error
EnableObservation creates (or reuses) an inner hash map in open_events for each cgid so the kernel program starts recording path counts for it.
func (*LsmEnforcer) ReadEvents ¶
func (l *LsmEnforcer) ReadEvents(cgids []uint64) (map[uint64]map[PathEventKey]uint32, error)
ReadEvents reads and resets the per-cgid path counts. Every cgid is visited even when one of them fails, so a single bad cgid cannot hide the counts of the rest.
func (*LsmEnforcer) ReadEventsLost ¶
func (l *LsmEnforcer) ReadEventsLost() (uint64, error)
ReadEventsLost reports open/exec observations the kernel program could not record because the cgid's count map was full. It shares ReadEvents' single caller, so statLast needs no lock of its own.
func (*LsmEnforcer) SetDefaultDeny ¶
func (l *LsmEnforcer) SetDefaultDeny(val bool) error
type PathEventKey ¶
type PathEventKey struct {
Path string
Decision runtimeevent.KernelDecision
}
PathEventKey identifies one observation counter: a path (or exec filename) plus the enforcement decision the kernel program applied to the operation.
Source Files