Documentation
¶
Overview ¶
Package runtimeevent defines the normalized, attributed runtime event plane shared by every producer (the managers' poll sources) and every consumer (attribution, monitor sinks, reporters).
The package is deliberately dependency-light and side-effect free: it holds the event schema and the source/sink seam interfaces.
Index ¶
Constants ¶
const ReasonCountMapFull = "count_map_full"
ReasonCountMapFull is the LossFunc reason for observations a kernel program could not record because its per-cgroup count map had no room left.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type DNSFacts ¶
type DNSFacts struct {
QName string `json:"qname"`
}
DNSFacts describes an observed DNS question. The name is what the workload asked to resolve, which is not proof that it connected: an answer can be cached or shared, and a workload dialling a bare address asks nothing.
type Event ¶
type Event struct {
Kind Kind `json:"kind"`
Time time.Time `json:"time"`
CgroupID uint64 `json:"cgroupID,omitempty"`
PID uint32 `json:"pid,omitempty"`
Comm string `json:"comm,omitempty"`
// Count > 1 for poll-sourced events that aggregate N kernel occurrences.
// The decision is part of the counter key, so a Count never mixes allowed
// and denied occurrences.
Count uint32 `json:"count,omitempty"`
// KernelDenied marks events actually denied at the kernel level.
KernelDenied bool `json:"kernelDenied,omitempty"`
// WouldDeny marks events that would have been blocked but whose policy is
// in monitor mode. Written by pkg/monitor.
WouldDeny bool `json:"wouldDeny,omitempty"`
Net *NetFacts `json:"net,omitempty"`
DNS *DNSFacts `json:"dns,omitempty"`
Exec *ExecFacts `json:"exec,omitempty"`
Open *OpenFacts `json:"open,omitempty"`
Protocol *ProtocolFacts `json:"protocol,omitempty"`
// Pod is filled by pkg/attribution. Sources may pre-fill Pod.UID as a
// hint when they know the pod but not the cgroup (egress poll source).
Pod PodIdentity `json:"pod,omitempty"`
}
Event is one normalized, attributed runtime observation. Exactly one facts pointer matching Kind is non-nil.
type ExecFacts ¶
type ExecFacts struct {
Filename string `json:"filename"`
// Argv is empty for sources that observe the exec without its arguments.
// It is attacker-controlled text and can carry credentials passed as
// flags, so it must not reach a Report without going through the
// reporter's redaction.
Argv []string `json:"argv,omitempty"`
}
ExecFacts describes a process execution.
type KernelDecision ¶
type KernelDecision uint32
KernelDecision mirrors the DECISION_ALLOW / DECISION_DENY defines in the C programs; keep the values in sync.
const ( DecisionAllow KernelDecision = 0 DecisionDeny KernelDecision = 1 )
type NetFacts ¶
type NetFacts struct {
DestIP netip.Addr `json:"destIP"`
// Domain is the DNS name DestIP was resolved from, empty when the kernel
// never saw the address in a snooped answer.
Domain string `json:"domain,omitempty"`
}
NetFacts describes an egress connection attempt.
type OpenFacts ¶
type OpenFacts struct {
Path string `json:"path"`
}
OpenFacts describes a file open.
type PodIdentity ¶
type PodIdentity struct {
UID string `json:"uid,omitempty"`
Namespace string `json:"namespace,omitempty"`
Name string `json:"name,omitempty"`
Labels map[string]string `json:"labels,omitempty"`
Container string `json:"container,omitempty"`
ContainerID string `json:"containerID,omitempty"`
OwnerKind string `json:"ownerKind,omitempty"`
OwnerName string `json:"ownerName,omitempty"`
NodeName string `json:"nodeName,omitempty"`
ServiceAccount string `json:"serviceAccount,omitempty"`
}
PodIdentity is the workload attribution attached to an Event.
type PolicyStatusRecorder ¶
type PolicyStatusRecorder interface {
RecordCondition(policyUID, policyName string, cond metav1.Condition)
}
PolicyStatusRecorder is implemented by controller.StatusWriter and consumed by the managers. policyName is what addresses the object, so a caller that knows it makes the condition flushable even for a policy the recorder has never seen an event for; an empty name leaves the recorder to find it.
type ProtocolFacts ¶
ProtocolFacts describes the application protocol classified from the first data segment of an egress flow. ALPN is non-empty only for TLS.
Source Files