Documentation
¶
Index ¶
- Variables
- type CgroupSink
- type OpenExecManager
- func (l *OpenExecManager) CollectObservations(ctx context.Context) ([]runtimeevent.Event, error)
- func (l *OpenExecManager) ContainerStarted(pod corev1.Pod, nsLabels map[string]string, cgid uint64) error
- func (l *OpenExecManager) HooksUnavailable() error
- func (l *OpenExecManager) PodDeleted(uid string) error
- func (l *OpenExecManager) PodEvent(pod corev1.Pod, nsLabels map[string]string, ...) error
- func (l *OpenExecManager) RuntimePolicyEvent(compiledRb *compiler.EvaluationResult, eventType string) error
Constants ¶
This section is empty.
Variables ¶
var ErrNoHookExecutes = errors.New("no open/exec hook executes on this node")
ErrNoHookExecutes means neither the BPF-LSM nor the fmod_ret dispatchers could be attached and shown to run, so no open or exec rule can be enforced or observed on this node.
Functions ¶
This section is empty.
Types ¶
type CgroupSink ¶
CgroupSink is an observation-only kernel source that must see events from the same pods the exec policies select, and from no others.
type OpenExecManager ¶
type OpenExecManager struct {
// contains filtered or unexported fields
}
func NewOpenExecManager ¶
func NewOpenExecManager(logger logr.Logger, status runtimeevent.PolicyStatusRecorder, onLoss runtimeevent.LossFunc, lsm bool, cgroupSinks ...CgroupSink) *OpenExecManager
NewOpenExecManager returns a manager even when the hooks cannot be set up: that manager fails every open and exec policy with the cause, so a node that can enforce nothing reports it on each policy instead of reading as Enforcing. lsm is the active LSM list's answer and only decides which hook type is tried first.
func (*OpenExecManager) CollectObservations ¶
func (l *OpenExecManager) CollectObservations(ctx context.Context) ([]runtimeevent.Event, error)
CollectObservations drains the per-cgroup path counters of every enforcer from open/exec. Reading drains events, and hence reported counts represent events since the last drain.
func (*OpenExecManager) ContainerStarted ¶ added in v0.1.5
func (l *OpenExecManager) ContainerStarted(pod corev1.Pod, nsLabels map[string]string, cgid uint64) error
ContainerStarted adds one container's cgroup to its pod, creating the pod if this is its first container.
func (*OpenExecManager) HooksUnavailable ¶ added in v0.1.3
func (l *OpenExecManager) HooksUnavailable() error
HooksUnavailable returns why no open/exec hook executes on this node, or nil when a verified hook type is attached.
func (*OpenExecManager) PodDeleted ¶
func (l *OpenExecManager) PodDeleted(uid string) error
PodDeleted removes the pod's cgroups from every attached program and drops its bookkeeping.
func (*OpenExecManager) PodEvent ¶
func (l *OpenExecManager) PodEvent(pod corev1.Pod, nsLabels map[string]string, cgInfos []*containers.ContainerCgroupInfo, eventType string) error
func (*OpenExecManager) RuntimePolicyEvent ¶
func (l *OpenExecManager) RuntimePolicyEvent(compiledRb *compiler.EvaluationResult, eventType string) error
Source Files