Documentation
¶
Index ¶
- Constants
- Variables
- func ClearPins() error
- func PathKeys(values []string, allow bool) (keys []*runtimePolicyEntry, star bool, rejected []compiler.RejectedTarget)
- type Dispatcher
- type PathEventKey
- type PolicyMap
- func (l *PolicyMap) AddCgids(cgids []uint64) error
- func (l *PolicyMap) AddTargets(paths *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
- func (m *PolicyMap) Close() error
- func (l *PolicyMap) DeleteCgids(cgids []uint64) error
- func (l *PolicyMap) DeleteTargets(paths *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
- func (l *PolicyMap) SetDefaultDeny(val bool) error
- type Prog
Constants ¶
const ( PROG_TYPE_LSM_OPEN = "file_open" PROG_TYPE_LSM_EXEC = "bprm_check_security" PROG_TYPE_TRACE_OPEN = "security_file_open" PROG_TYPE_TRACE_EXEC = "security_bprm_check" )
Variables ¶
ErrObservationUnavailable reports that the loaded collection carries no events_map hash-of-maps, so per-cgid path counting cannot be turned on.
var ProgTypes = map[string]int{ PROG_TYPE_LSM_OPEN: 0, PROG_TYPE_TRACE_OPEN: 0, PROG_TYPE_LSM_EXEC: 1, PROG_TYPE_TRACE_EXEC: 1, }
ProgTypes maps each attach target to the PROG_TYPE_* value the kernel programs write into policy_ctx.prog_type and use as the prog_count key, so these values match _cprog/maps.h and cannot be changed on one side alone.
Functions ¶
func ClearPins ¶
func ClearPins() error
ClearPins wipes the pin directory at startup. The pinned maps outlive the process, so a restart would otherwise inherit prog arrays holding fds of programs this process never loaded and a prog_count covering them
func PathKeys ¶
func PathKeys(values []string, allow bool) (keys []*runtimePolicyEntry, star bool, rejected []compiler.RejectedTarget)
PathKeys turns the accepted values of one allow or deny list into policy map entries: each path's bytes NUL-padded to the width the kernel side declares, exactly as bpf_probe_read_kernel_str leaves it. compiler.StarTarget yields no entry; it sets star, the default-deny sentinel SetDefaultDeny carries.
Types ¶
type Dispatcher ¶
type Dispatcher struct {
// contains filtered or unexported fields
}
A Dispatcher owns one hook: it is the only program attached to the kernel, and it tail-calls the executor that walks the policy maps registered in its prog array. Policy maps come and go with policies; the dispatcher stays for the process lifetime. Callers serialize access (OpenExecManager holds its lock across every AddPolicy/DeleteProgram).
func NewDispatcherForTarget ¶
func NewDispatcherForTarget(target string) (*Dispatcher, error)
func (*Dispatcher) AddPolicy ¶
func (d *Dispatcher) AddPolicy(progFd int) error
AddProgram publishes an enforcer in the prog array before bumping the count the kernel chain terminates on, so the chain never waits for a program that is not yet callable.
func (*Dispatcher) Attach ¶
func (d *Dispatcher) Attach() error
Attach links the dispatcher's program to its hook. The tracepoint exec target carries no program: the file_open dispatcher is the one attached there, so linking again would run the handler twice per open.
func (*Dispatcher) DeleteProgram ¶
func (d *Dispatcher) DeleteProgram(progFd int) error
DeleteProgram drops the count before clearing the slot, mirroring AddProgram's ordering: the kernel treats a populated slot past the count as unreachable and a missing slot as skipped, never as a chain that hangs.
type PathEventKey ¶
PathEventKey identifies one observation counter: a path (or exec filename) plus the enforcement decision the kernel program applied to the operation. It mirrors `struct path_event_key` in _cprog/maps.h byte for byte — it is the map key cilium/ebpf marshals directly, and a layout drift from the BTF key is rejected at runtime.
func (PathEventKey) PathString ¶
func (k PathEventKey) PathString() string
PathString returns the path without the NUL padding the kernel key carries.
type PolicyMap ¶
type PolicyMap struct {
// contains filtered or unexported fields
}
A PolicyMap holds one policy's kernel-side state — allow/deny paths, cgids and flags, all entries of one inner map — registered in the dispatcher's policies array on creation.
func NewPolicyMap ¶
func NewPolicyMap(d *Dispatcher, logger *logr.Logger) (*PolicyMap, error)
func (*PolicyMap) AddTargets ¶
func (l *PolicyMap) AddTargets(paths *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
AddTargets programs a policy's paths into its entries map and returns every value PathKeys could not key.
func (*PolicyMap) DeleteCgids ¶
func (*PolicyMap) DeleteTargets ¶
func (l *PolicyMap) DeleteTargets(paths *compiler.AllowDenyPair) ([]compiler.RejectedTarget, error)
DeleteTargets removes what AddTargets programmed for the same pair. Both derive their keys from PathKeys, so a value one of them can key is a value the other can key too.
func (*PolicyMap) SetDefaultDeny ¶
type Prog ¶
type Prog struct {
// contains filtered or unexported fields
}
A Prog is the policy executor for one attach target: the single program the dispatcher tail-calls, which loops over every registered policy map, plus the observation maps it records into.
func NewProgram ¶
func NewProgram(d *Dispatcher) (*Prog, error)
func (*Prog) DisableObservation ¶
DisableObservation removes the events_map entry for each cgid and releases the inner map. A cgid that was never enabled is not an error.
func (*Prog) EnableObservation ¶
EnableObservation creates (or reuses) an inner hash map in events_map for each cgid so the kernel program starts recording path counts for it.
func (*Prog) ReadEvents ¶
func (l *Prog) ReadEvents() (map[uint64]map[PathEventKey]uint32, error)
ReadEvents reads and resets the path counts of every observed cgid, through the long-lived inner-map handles EnableObservation created. Every cgid is visited even when one of them fails, so a single bad map cannot hide the counts of the rest.
func (*Prog) ReadEventsLost ¶
ReadEventsLost reports open/exec observations the kernel program could not record because the cgid's count map was full. It shares ReadEvents' single caller, so statLast needs no lock of its own.
Source Files