-
Notifications
You must be signed in to change notification settings - Fork 1.2k
/
model.go
1098 lines (911 loc) · 45.7 KB
/
model.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
// Unless explicitly stated otherwise all files in this repository are licensed
// under the Apache License Version 2.0.
// This product includes software developed at Datadog (https://www.datadoghq.com/).
// Copyright 2016-present Datadog, Inc.
//go:generate go run github.com/DataDog/datadog-agent/pkg/security/secl/compiler/generators/accessors -output accessors.go -field-handlers field_handlers.go -doc ../../../../docs/cloud-workload-security/secl.json
package model
import (
"errors"
"fmt"
"net"
"path"
"path/filepath"
"reflect"
"strings"
"syscall"
"time"
"unsafe"
"github.com/DataDog/datadog-agent/pkg/security/secl/compiler/eval"
)
const (
// OverlayFS overlay filesystem
OverlayFS = "overlay"
)
// Model describes the data model for the runtime security agent events
type Model struct {
ExtraValidateFieldFnc func(field eval.Field, fieldValue eval.FieldValue) error
}
// NewEvent returns a new Event
func (m *Model) NewEvent() eval.Event {
return &Event{}
}
// NewDefaultEventWithType returns a new Event for the given type
func (m *Model) NewDefaultEventWithType(kind EventType) eval.Event {
return &Event{
Type: uint32(kind),
FieldHandlers: &DefaultFieldHandlers{},
}
}
// check that all path are absolute
func validatePath(field eval.Field, fieldValue eval.FieldValue) error {
// do not support regular expression on path, currently unable to support discarder for regex value
if fieldValue.Type == eval.RegexpValueType {
return fmt.Errorf("regexp not supported on path `%s`", field)
} else if fieldValue.Type == eval.VariableValueType {
return nil
}
if value, ok := fieldValue.Value.(string); ok {
errAbs := fmt.Errorf("invalid path `%s`, all the path have to be absolute", value)
errDepth := fmt.Errorf("invalid path `%s`, path depths have to be shorter than %d", value, MaxPathDepth)
errSegment := fmt.Errorf("invalid path `%s`, each segment of a path must be shorter than %d", value, MaxSegmentLength)
if value == "" {
return nil
}
if value != path.Clean(value) {
return errAbs
}
if value == "*" {
return errAbs
}
if !filepath.IsAbs(value) && len(value) > 0 && value[0] != '*' {
return errAbs
}
if strings.HasPrefix(value, "~") {
return errAbs
}
// check resolution limitations
segments := strings.Split(value, "/")
if len(segments) > MaxPathDepth {
return errDepth
}
for _, segment := range segments {
if segment == ".." {
return errAbs
}
if len(segment) > MaxSegmentLength {
return errSegment
}
}
}
return nil
}
// ValidateField validates the value of a field
func (m *Model) ValidateField(field eval.Field, fieldValue eval.FieldValue) error {
if strings.HasSuffix(field, "path") {
if err := validatePath(field, fieldValue); err != nil {
return err
}
}
switch field {
case "event.retval":
if value := fieldValue.Value; value != -int(syscall.EPERM) && value != -int(syscall.EACCES) {
return errors.New("return value can only be tested against EPERM or EACCES")
}
case "bpf.map.name", "bpf.prog.name":
if value, ok := fieldValue.Value.(string); ok {
if len(value) > MaxBpfObjName {
return fmt.Errorf("the name provided in %s must be at most %d characters, len(\"%s\") = %d", field, MaxBpfObjName, value, len(value))
}
}
}
if m.ExtraValidateFieldFnc != nil {
return m.ExtraValidateFieldFnc(field, fieldValue)
}
return nil
}
// ChmodEvent represents a chmod event
type ChmodEvent struct {
SyscallEvent
File FileEvent `field:"file"`
Mode uint32 `field:"file.destination.mode; file.destination.rights"` // SECLDoc[file.destination.mode] Definition:`New mode of the chmod-ed file` Constants:`Chmod mode constants` SECLDoc[file.destination.rights] Definition:`New rights of the chmod-ed file` Constants:`Chmod mode constants`
}
// ChownEvent represents a chown event
type ChownEvent struct {
SyscallEvent
File FileEvent `field:"file"`
UID int64 `field:"file.destination.uid"` // SECLDoc[file.destination.uid] Definition:`New UID of the chown-ed file's owner`
User string `field:"file.destination.user,handler:ResolveChownUID"` // SECLDoc[file.destination.user] Definition:`New user of the chown-ed file's owner`
GID int64 `field:"file.destination.gid"` // SECLDoc[file.destination.gid] Definition:`New GID of the chown-ed file's owner`
Group string `field:"file.destination.group,handler:ResolveChownGID"` // SECLDoc[file.destination.group] Definition:`New group of the chown-ed file's owner`
}
// ContainerContext holds the container context of an event
type ContainerContext struct {
ID string `field:"id,handler:ResolveContainerID"` // SECLDoc[id] Definition:`ID of the container`
CreatedAt uint64 `field:"created_at,handler:ResolveContainerCreatedAt"` // SECLDoc[created_at] Definition:`Timestamp of the creation of the container``
Tags []string `field:"tags,handler:ResolveContainerTags,opts:skip_ad,weight:9999"` // SECLDoc[tags] Definition:`Tags of the container`
}
// Event represents an event sent from the kernel
// genaccessors
type Event struct {
ID string `field:"-" json:"-"`
Type uint32 `field:"-"`
Flags uint32 `field:"-"`
Async bool `field:"async,handler:ResolveAsync" event:"*"` // SECLDoc[async] Definition:`True if the syscall was asynchronous`
TimestampRaw uint64 `field:"-" json:"-"`
Timestamp time.Time `field:"-"` // Timestamp of the event
Rules []*MatchedRule `field:"-"`
// context shared with all events
ProcessCacheEntry *ProcessCacheEntry `field:"-" json:"-"`
PIDContext PIDContext `field:"-" json:"-"`
SpanContext SpanContext `field:"-" json:"-"`
ProcessContext *ProcessContext `field:"process" event:"*"`
ContainerContext ContainerContext `field:"container"`
NetworkContext NetworkContext `field:"network"`
// fim events
Chmod ChmodEvent `field:"chmod" event:"chmod"` // [7.27] [File] A file’s permissions were changed
Chown ChownEvent `field:"chown" event:"chown"` // [7.27] [File] A file’s owner was changed
Open OpenEvent `field:"open" event:"open"` // [7.27] [File] A file was opened
Mkdir MkdirEvent `field:"mkdir" event:"mkdir"` // [7.27] [File] A directory was created
Rmdir RmdirEvent `field:"rmdir" event:"rmdir"` // [7.27] [File] A directory was removed
Rename RenameEvent `field:"rename" event:"rename"` // [7.27] [File] A file/directory was renamed
Unlink UnlinkEvent `field:"unlink" event:"unlink"` // [7.27] [File] A file was deleted
Utimes UtimesEvent `field:"utimes" event:"utimes"` // [7.27] [File] Change file access/modification times
Link LinkEvent `field:"link" event:"link"` // [7.27] [File] Create a new name/alias for a file
SetXAttr SetXAttrEvent `field:"setxattr" event:"setxattr"` // [7.27] [File] Set exteneded attributes
RemoveXAttr SetXAttrEvent `field:"removexattr" event:"removexattr"` // [7.27] [File] Remove extended attributes
Splice SpliceEvent `field:"splice" event:"splice"` // [7.36] [File] A splice command was executed
Mount MountEvent `field:"mount" event:"mount"` // [7.42] [File] [Experimental] A filesystem was mounted
// process events
Exec ExecEvent `field:"exec" event:"exec"` // [7.27] [Process] A process was executed or forked
SetUID SetuidEvent `field:"setuid" event:"setuid"` // [7.27] [Process] A process changed its effective uid
SetGID SetgidEvent `field:"setgid" event:"setgid"` // [7.27] [Process] A process changed its effective gid
Capset CapsetEvent `field:"capset" event:"capset"` // [7.27] [Process] A process changed its capacity set
Signal SignalEvent `field:"signal" event:"signal"` // [7.35] [Process] A signal was sent
Exit ExitEvent `field:"exit" event:"exit"` // [7.38] [Process] A process was terminated
Syscalls SyscallsEvent `field:"-"`
// kernel events
SELinux SELinuxEvent `field:"selinux" event:"selinux"` // [7.30] [Kernel] An SELinux operation was run
BPF BPFEvent `field:"bpf" event:"bpf"` // [7.33] [Kernel] A BPF command was executed
PTrace PTraceEvent `field:"ptrace" event:"ptrace"` // [7.35] [Kernel] A ptrace command was executed
MMap MMapEvent `field:"mmap" event:"mmap"` // [7.35] [Kernel] A mmap command was executed
MProtect MProtectEvent `field:"mprotect" event:"mprotect"` // [7.35] [Kernel] A mprotect command was executed
LoadModule LoadModuleEvent `field:"load_module" event:"load_module"` // [7.35] [Kernel] A new kernel module was loaded
UnloadModule UnloadModuleEvent `field:"unload_module" event:"unload_module"` // [7.35] [Kernel] A kernel module was deleted
// network events
DNS DNSEvent `field:"dns" event:"dns"` // [7.36] [Network] A DNS request was sent
Bind BindEvent `field:"bind" event:"bind"` // [7.37] [Network] [Experimental] A bind was executed
// internal usage
Umount UmountEvent `field:"-" json:"-"`
InvalidateDentry InvalidateDentryEvent `field:"-" json:"-"`
ArgsEnvs ArgsEnvsEvent `field:"-" json:"-"`
MountReleased MountReleasedEvent `field:"-" json:"-"`
CgroupTracing CgroupTracingEvent `field:"-" json:"-"`
NetDevice NetDeviceEvent `field:"-" json:"-"`
VethPair VethPairEvent `field:"-" json:"-"`
UnshareMountNS UnshareMountNSEvent `field:"-" json:"-"`
PathResolutionError error `field:"-" json:"-"` // hold one of the path resolution error
// field resolution
FieldHandlers FieldHandlers `field:"-" json:"-"`
}
func initMember(member reflect.Value, deja map[string]bool) {
for i := 0; i < member.NumField(); i++ {
field := member.Field(i)
switch field.Kind() {
case reflect.Ptr:
if field.CanSet() {
field.Set(reflect.New(field.Type().Elem()))
}
if field.Elem().Kind() == reflect.Struct {
name := field.Elem().Type().Name()
if deja[name] {
continue
}
deja[name] = true
initMember(field.Elem(), deja)
}
case reflect.Struct:
name := field.Type().Name()
if deja[name] {
continue
}
deja[name] = true
initMember(field, deja)
}
}
}
// NewDefaultEvent returns a new event using the default field handlers
func NewDefaultEvent() eval.Event {
return &Event{
FieldHandlers: &DefaultFieldHandlers{},
}
}
// Init initialize the event
func (e *Event) Init() {
initMember(reflect.ValueOf(e).Elem(), map[string]bool{})
}
// IsSavedByActivityDumps return whether saved by AD
func (e *Event) IsSavedByActivityDumps() bool {
return e.Flags&EventFlagsSavedByAD > 0
}
// IsSavedByActivityDumps return whether AD sample
func (e *Event) IsActivityDumpSample() bool {
return e.Flags&EventFlagsActivityDumpSample > 0
}
// GetType returns the event type
func (e *Event) GetType() string {
return EventType(e.Type).String()
}
// GetEventType returns the event type of the event
func (e *Event) GetEventType() EventType {
return EventType(e.Type)
}
// GetTags returns the list of tags specific to this event
func (e *Event) GetTags() []string {
tags := []string{"type:" + e.GetType()}
// should already be resolved at this stage
if len(e.ContainerContext.Tags) > 0 {
tags = append(tags, e.ContainerContext.Tags...)
}
return tags
}
// Retain the event
func (ev *Event) Retain() Event {
if ev.ProcessCacheEntry != nil {
ev.ProcessCacheEntry.Retain()
}
return *ev
}
// Release the event
func (ev *Event) Release() {
if ev.ProcessCacheEntry != nil {
ev.ProcessCacheEntry.Release()
}
}
// SetPathResolutionError sets the Event.pathResolutionError
func (ev *Event) SetPathResolutionError(fileFields *FileEvent, err error) {
fileFields.PathResolutionError = err
ev.PathResolutionError = err
}
// ResolveProcessCacheEntry uses the field handler
func (ev *Event) ResolveProcessCacheEntry() (*ProcessCacheEntry, bool) {
return ev.FieldHandlers.ResolveProcessCacheEntry(ev)
}
// ResolveEventTimestamp uses the field handler
func (ev *Event) ResolveEventTimestamp() time.Time {
return ev.FieldHandlers.ResolveEventTimestamp(ev)
}
// GetProcessServiceTag uses the field handler
func (ev *Event) GetProcessServiceTag() string {
return ev.FieldHandlers.GetProcessServiceTag(ev)
}
// MatchedRules contains the identification of one rule that has match
type MatchedRule struct {
RuleID string
RuleVersion string
RuleTags map[string]string
PolicyName string
PolicyVersion string
}
// NewMatchedRule return a new MatchedRule instance
func NewMatchedRule(ruleID, ruleVersion string, ruleTags map[string]string, policyName, policyVersion string) *MatchedRule {
return &MatchedRule{
RuleID: ruleID,
RuleVersion: ruleVersion,
RuleTags: ruleTags,
PolicyName: policyName,
PolicyVersion: policyVersion,
}
}
func (mr *MatchedRule) Match(mr2 *MatchedRule) bool {
if mr2 == nil ||
mr.RuleID != mr2.RuleID ||
mr.RuleVersion != mr2.RuleVersion ||
mr.PolicyName != mr2.PolicyName ||
mr.PolicyVersion != mr2.PolicyVersion {
return false
}
return true
}
// Append two lists, but avoiding duplicates
func AppendMatchedRule(list []*MatchedRule, toAdd []*MatchedRule) []*MatchedRule {
for _, ta := range toAdd {
found := false
for _, l := range list {
if l.Match(ta) { // rule already present
found = true
break
}
}
if !found {
list = append(list, ta)
}
}
return list
}
// SetuidEvent represents a setuid event
type SetuidEvent struct {
UID uint32 `field:"uid"` // SECLDoc[uid] Definition:`New UID of the process`
User string `field:"user,handler:ResolveSetuidUser"` // SECLDoc[user] Definition:`New user of the process`
EUID uint32 `field:"euid"` // SECLDoc[euid] Definition:`New effective UID of the process`
EUser string `field:"euser,handler:ResolveSetuidEUser"` // SECLDoc[euser] Definition:`New effective user of the process`
FSUID uint32 `field:"fsuid"` // SECLDoc[fsuid] Definition:`New FileSystem UID of the process`
FSUser string `field:"fsuser,handler:ResolveSetuidFSUser"` // SECLDoc[fsuser] Definition:`New FileSystem user of the process`
}
// SetgidEvent represents a setgid event
type SetgidEvent struct {
GID uint32 `field:"gid"` // SECLDoc[gid] Definition:`New GID of the process`
Group string `field:"group,handler:ResolveSetgidGroup"` // SECLDoc[group] Definition:`New group of the process`
EGID uint32 `field:"egid"` // SECLDoc[egid] Definition:`New effective GID of the process`
EGroup string `field:"egroup,handler:ResolveSetgidEGroup"` // SECLDoc[egroup] Definition:`New effective group of the process`
FSGID uint32 `field:"fsgid"` // SECLDoc[fsgid] Definition:`New FileSystem GID of the process`
FSGroup string `field:"fsgroup,handler:ResolveSetgidFSGroup"` // SECLDoc[fsgroup] Definition:`New FileSystem group of the process`
}
// CapsetEvent represents a capset event
type CapsetEvent struct {
CapEffective uint64 `field:"cap_effective"` // SECLDoc[cap_effective] Definition:`Effective capability set of the process` Constants:`Kernel Capability constants`
CapPermitted uint64 `field:"cap_permitted"` // SECLDoc[cap_permitted] Definition:`Permitted capability set of the process` Constants:`Kernel Capability constants`
}
// Credentials represents the kernel credentials of a process
type Credentials struct {
UID uint32 `field:"uid"` // SECLDoc[uid] Definition:`UID of the process`
GID uint32 `field:"gid"` // SECLDoc[gid] Definition:`GID of the process`
User string `field:"user"` // SECLDoc[user] Definition:`User of the process` Example:`process.user == "root"` Description:`Constrain an event to be triggered by a process running as the root user.`
Group string `field:"group"` // SECLDoc[group] Definition:`Group of the process`
EUID uint32 `field:"euid"` // SECLDoc[euid] Definition:`Effective UID of the process`
EGID uint32 `field:"egid"` // SECLDoc[egid] Definition:`Effective GID of the process`
EUser string `field:"euser"` // SECLDoc[euser] Definition:`Effective user of the process`
EGroup string `field:"egroup"` // SECLDoc[egroup] Definition:`Effective group of the process`
FSUID uint32 `field:"fsuid"` // SECLDoc[fsuid] Definition:`FileSystem-uid of the process`
FSGID uint32 `field:"fsgid"` // SECLDoc[fsgid] Definition:`FileSystem-gid of the process`
FSUser string `field:"fsuser"` // SECLDoc[fsuser] Definition:`FileSystem-user of the process`
FSGroup string `field:"fsgroup"` // SECLDoc[fsgroup] Definition:`FileSystem-group of the process`
CapEffective uint64 `field:"cap_effective"` // SECLDoc[cap_effective] Definition:`Effective capability set of the process` Constants:`Kernel Capability constants`
CapPermitted uint64 `field:"cap_permitted"` // SECLDoc[cap_permitted] Definition:`Permitted capability set of the process` Constants:`Kernel Capability constants`
}
// GetPathResolutionError returns the path resolution error as a string if there is one
func (p *Process) GetPathResolutionError() string {
return p.FileEvent.GetPathResolutionError()
}
// HasInterpreter returns whether the process uses an interpreter
func (p *Process) HasInterpreter() bool {
return p.LinuxBinprm.FileEvent.Inode != 0
}
// IsNotKworker returns true if the process isn't a kworker
func (p *Process) IsNotKworker() bool {
return !p.IsKworker
}
// LinuxBinprm contains content from the linux_binprm struct, which holds the arguments used for loading binaries
type LinuxBinprm struct {
FileEvent FileEvent `field:"file"`
}
// Process represents a process
type Process struct {
PIDContext
FileEvent FileEvent `field:"file,check:IsNotKworker"`
ContainerID string `field:"container.id"` // SECLDoc[container.id] Definition:`Container ID`
SpanID uint64 `field:"-"`
TraceID uint64 `field:"-"`
TTYName string `field:"tty_name"` // SECLDoc[tty_name] Definition:`Name of the TTY associated with the process`
Comm string `field:"comm"` // SECLDoc[comm] Definition:`Comm attribute of the process`
LinuxBinprm LinuxBinprm `field:"interpreter,check:HasInterpreter"` // Script interpreter as identified by the shebang
// pid_cache_t
ForkTime time.Time `field:"-" json:"-"`
ExitTime time.Time `field:"-" json:"-"`
ExecTime time.Time `field:"-" json:"-"`
CreatedAt uint64 `field:"created_at,handler:ResolveProcessCreatedAt"` // SECLDoc[created_at] Definition:`Timestamp of the creation of the process`
Cookie uint32 `field:"cookie"` // SECLDoc[cookie] Definition:`Cookie of the process`
PPid uint32 `field:"ppid"` // SECLDoc[ppid] Definition:`Parent process ID`
// credentials_t section of pid_cache_t
Credentials ``
ArgsID uint32 `field:"-" json:"-"`
EnvsID uint32 `field:"-" json:"-"`
ArgsEntry *ArgsEntry `field:"-" json:"-"`
EnvsEntry *EnvsEntry `field:"-" json:"-"`
// defined to generate accessors, ArgsTruncated and EnvsTruncated are used during by unmarshaller
Argv0 string `field:"argv0,handler:ResolveProcessArgv0,weight:100"` // SECLDoc[argv0] Definition:`First argument of the process`
Args string `field:"args,handler:ResolveProcessArgs,weight:100"` // SECLDoc[args] Definition:`Arguments of the process (as a string, excluding argv0)` Example:`exec.args == "-sV -p 22,53,110,143,4564 198.116.0-255.1-127"` Description:`Matches any process with these exact arguments.` Example:`exec.args =~ "* -F * http*"` Description:`Matches any process that has the "-F" argument anywhere before an argument starting with "http".`
Argv []string `field:"argv,handler:ResolveProcessArgv,weight:100; args_flags,handler:ResolveProcessArgsFlags,opts:cacheless_resolution; args_options,handler:ResolveProcessArgsOptions,opts:cacheless_resolution"` // SECLDoc[argv] Definition:`Arguments of the process (as an array, excluding argv0)` Example:`exec.argv in ["127.0.0.1"]` Description:`Matches any process that has this IP address as one of its arguments.` SECLDoc[args_flags] Definition:`Flags in the process arguments` Example:`exec.args_flags in ["s"] && exec.args_flags in ["V"]` Description:`Matches any process with both "-s" and "-V" flags in its arguments. Also matches "-sV".` SECLDoc[args_options] Definition:`Argument of the process as options` Example:`exec.args_options in ["p=0-1024"]` Description:`Matches any process that has either "-p 0-1024" or "--p=0-1024" in its arguments.`
ArgsTruncated bool `field:"args_truncated,handler:ResolveProcessArgsTruncated"` // SECLDoc[args_truncated] Definition:`Indicator of arguments truncation`
Envs []string `field:"envs,handler:ResolveProcessEnvs:100"` // SECLDoc[envs] Definition:`Environment variable names of the process`
Envp []string `field:"envp,handler:ResolveProcessEnvp:100"` // SECLDoc[envp] Definition:`Environment variables of the process`
EnvsTruncated bool `field:"envs_truncated,handler:ResolveProcessEnvsTruncated"` // SECLDoc[envs_truncated] Definition:`Indicator of environment variables truncation`
// symlink to the process binary
SymlinkPathnameStr [MaxSymlinks]string `field:"-" json:"-"`
SymlinkBasenameStr string `field:"-" json:"-"`
// cache version
ScrubbedArgvResolved bool `field:"-" json:"-"`
ScrubbedArgv []string `field:"-" json:"-"`
ScrubbedArgsTruncated bool `field:"-" json:"-"`
Variables eval.Variables `field:"-" json:"-"`
IsThread bool `field:"is_thread"` // SECLDoc[is_thread] Definition:`Indicates whether the process is considered a thread (that is, a child process that hasn't executed another program)`
}
// SpanContext describes a span context
type SpanContext struct {
SpanID uint64 `field:"_" json:"-"`
TraceID uint64 `field:"_" json:"-"`
}
// ExecEvent represents a exec event
type ExecEvent struct {
*Process
}
// ExitEvent represents a process exit event
type ExitEvent struct {
*Process
Cause uint32 `field:"cause"` // SECLDoc[cause] Definition:`Cause of the process termination (one of EXITED, SIGNALED, COREDUMPED)`
Code uint32 `field:"code"` // SECLDoc[code] Definition:`Exit code of the process or number of the signal that caused the process to terminate`
}
// FileFields holds the information required to identify a file
type FileFields struct {
UID uint32 `field:"uid"` // SECLDoc[uid] Definition:`UID of the file's owner`
User string `field:"user,handler:ResolveFileFieldsUser"` // SECLDoc[user] Definition:`User of the file's owner`
GID uint32 `field:"gid"` // SECLDoc[gid] Definition:`GID of the file's owner`
Group string `field:"group,handler:ResolveFileFieldsGroup"` // SECLDoc[group] Definition:`Group of the file's owner`
Mode uint16 `field:"mode;rights,handler:ResolveRights,opts:cacheless_resolution"` // SECLDoc[mode] Definition:`Mode of the file` SECLDoc[rights] Definition:`Rights of the file` Constants:`Chmod mode constants`
CTime uint64 `field:"change_time"` // SECLDoc[change_time] Definition:`Change time of the file`
MTime uint64 `field:"modification_time"` // SECLDoc[modification_time] Definition:`Modification time of the file`
PathKey
InUpperLayer bool `field:"in_upper_layer,handler:ResolveFileFieldsInUpperLayer"` // SECLDoc[in_upper_layer] Definition:`Indicator of the file layer, for example, in an OverlayFS`
NLink uint32 `field:"-" json:"-"`
Flags int32 `field:"-" json:"-"`
}
// IsFileless return whether it is a file less access
func (f *FileFields) IsFileless() bool {
// TODO(safchain) fix this heuristic by add a flag in the event intead of using mount ID 0
return f.Inode != 0 && f.MountID == 0
}
// HasHardLinks returns whether the file has hardlink
func (f *FileFields) HasHardLinks() bool {
return f.NLink > 1
}
// GetInLowerLayer returns whether a file is in a lower layer
func (f *FileFields) GetInLowerLayer() bool {
return f.Flags&LowerLayer != 0
}
// GetInUpperLayer returns whether a file is in the upper layer
func (f *FileFields) GetInUpperLayer() bool {
return f.Flags&UpperLayer != 0
}
// FileEvent is the common file event type
type FileEvent struct {
FileFields ``
PathnameStr string `field:"path,handler:ResolveFilePath,opts:length" op_override:"ProcessSymlinkPathname"` // SECLDoc[path] Definition:`File's path` Example:`exec.file.path == "/usr/bin/apt"` Description:`Matches the execution of the file located at /usr/bin/apt` Example:`open.file.path == "/etc/passwd"` Description:`Matches any process opening the /etc/passwd file.`
BasenameStr string `field:"name,handler:ResolveFileBasename,opts:length" op_override:"ProcessSymlinkBasename"` // SECLDoc[name] Definition:`File's basename` Example:`exec.file.name == "apt"` Description:`Matches the execution of any file named apt.`
Filesystem string `field:"filesystem,handler:ResolveFileFilesystem"` // SECLDoc[filesystem] Definition:`File's filesystem`
PathResolutionError error `field:"-" json:"-"`
PkgName string `field:"package.name,handler:ResolvePackageName"` // SECLDoc[package.name] Definition:`[Experimental] Name of the package that provided this file`
PkgVersion string `field:"package.version,handler:ResolvePackageVersion"` // SECLDoc[package.version] Definition:`[Experimental] Full version of the package that provided this file`
PkgSrcVersion string `field:"package.source_version,handler:ResolvePackageSourceVersion"` // SECLDoc[package.source_version] Definition:`[Experimental] Full version of the source package of the package that provided this file`
// used to mark as already resolved, can be used in case of empty path
IsPathnameStrResolved bool `field:"-" json:"-"`
IsBasenameStrResolved bool `field:"-" json:"-"`
}
// SetPathnameStr set and mark as resolved
func (e *FileEvent) SetPathnameStr(str string) {
e.PathnameStr = str
e.IsPathnameStrResolved = true
}
// SetBasenameStr set and mark as resolved
func (e *FileEvent) SetBasenameStr(str string) {
e.BasenameStr = str
e.IsBasenameStrResolved = true
}
// GetPathResolutionError returns the path resolution error as a string if there is one
func (e *FileEvent) GetPathResolutionError() string {
if e.PathResolutionError != nil {
return e.PathResolutionError.Error()
}
return ""
}
// InvalidateDentryEvent defines a invalidate dentry event
type InvalidateDentryEvent struct {
Inode uint64
MountID uint32
}
// MountReleasedEvent defines a mount released event
type MountReleasedEvent struct {
MountID uint32
}
// LinkEvent represents a link event
type LinkEvent struct {
SyscallEvent
Source FileEvent `field:"file"`
Target FileEvent `field:"file.destination"`
}
// MkdirEvent represents a mkdir event
type MkdirEvent struct {
SyscallEvent
File FileEvent `field:"file"`
Mode uint32 `field:"file.destination.mode; file.destination.rights"` // SECLDoc[file.destination.mode] Definition:`Mode of the new directory` Constants:`Chmod mode constants` SECLDoc[file.destination.rights] Definition:`Rights of the new directory` Constants:`Chmod mode constants`
}
// ArgsEnvsEvent defines a args/envs event
type ArgsEnvsEvent struct {
ArgsEnvs
}
// Mount represents a mountpoint (used by MountEvent and UnshareMountNSEvent)
type Mount struct {
MountID uint32 `field:"-"`
GroupID uint32 `field:"-"`
Device uint32 `field:"-"`
ParentMountID uint32 `field:"-"`
ParentInode uint64 `field:"-"`
RootMountID uint32 `field:"-"`
RootInode uint64 `field:"-"`
BindSrcMountID uint32 `field:"-"`
FSType string `field:"fs_type"` // SECLDoc[fs_type] Definition:`Type of the mounted file system`
MountPointStr string `field:"-"`
RootStr string `field:"-"`
Path string `field:"-"`
}
// MountEvent represents a mount event
//
//msgp:ignore MountEvent
type MountEvent struct {
SyscallEvent
Mount
MountPointPath string `field:"mountpoint.path,handler:ResolveMountPointPath"` // SECLDoc[mountpoint.path] Definition:`Path of the mount point`
MountSourcePath string `field:"source.path,handler:ResolveMountSourcePath"` // SECLDoc[source.path] Definition:`Source path of a bind mount`
MountPointPathResolutionError error `field:"-"`
MountSourcePathResolutionError error `field:"-"`
}
// UnshareMountNSEvent represents a mount cloned from a newly created mount namespace
type UnshareMountNSEvent struct {
Mount
}
// GetFSType returns the filesystem type of the mountpoint
func (m *Mount) GetFSType() string {
return m.FSType
}
// IsOverlayFS returns whether it is an overlay fs
func (m *Mount) IsOverlayFS() bool {
return m.GetFSType() == "overlay"
}
// OpenEvent represents an open event
type OpenEvent struct {
SyscallEvent
File FileEvent `field:"file"`
Flags uint32 `field:"flags"` // SECLDoc[flags] Definition:`Flags used when opening the file` Constants:`Open flags`
Mode uint32 `field:"file.destination.mode"` // SECLDoc[file.destination.mode] Definition:`Mode of the created file` Constants:`Chmod mode constants`
}
// SELinuxEventKind represents the event kind for SELinux events
type SELinuxEventKind uint32
const (
// SELinuxBoolChangeEventKind represents SELinux boolean change events
SELinuxBoolChangeEventKind SELinuxEventKind = iota
// SELinuxStatusChangeEventKind represents SELinux status change events
SELinuxStatusChangeEventKind
// SELinuxBoolCommitEventKind represents SELinux boolean commit events
SELinuxBoolCommitEventKind
)
// SELinuxEvent represents a selinux event
type SELinuxEvent struct {
File FileEvent `field:"-" json:"-"`
EventKind SELinuxEventKind `field:"-" json:"-"`
BoolName string `field:"bool.name,handler:ResolveSELinuxBoolName"` // SECLDoc[bool.name] Definition:`SELinux boolean name`
BoolChangeValue string `field:"bool.state"` // SECLDoc[bool.state] Definition:`SELinux boolean new value`
BoolCommitValue bool `field:"bool_commit.state"` // SECLDoc[bool_commit.state] Definition:`Indicator of a SELinux boolean commit operation`
EnforceStatus string `field:"enforce.status"` // SECLDoc[enforce.status] Definition:`SELinux enforcement status (one of "enforcing", "permissive", "disabled")`
}
var zeroProcessContext ProcessContext
// ProcessCacheEntry this struct holds process context kept in the process tree
type ProcessCacheEntry struct {
ProcessContext
refCount uint64 `field:"-" json:"-"`
onRelease func(_ *ProcessCacheEntry) `field:"-" json:"-"`
releaseCb func() `field:"-" json:"-"`
}
// IsContainerRoot returns whether this is a top level process in the container ID
func (pc *ProcessCacheEntry) IsContainerRoot() bool {
return pc.ContainerID != "" && pc.Ancestor != nil && pc.Ancestor.ContainerID == ""
}
// Reset the entry
func (pc *ProcessCacheEntry) Reset() {
pc.ProcessContext = zeroProcessContext
pc.refCount = 0
pc.releaseCb = nil
}
// Retain increment ref counter
func (pc *ProcessCacheEntry) Retain() {
pc.refCount++
}
// SetReleaseCallback set the callback called when the entry is released
func (pc *ProcessCacheEntry) SetReleaseCallback(callback func()) {
pc.releaseCb = callback
}
// Release decrement and eventually release the entry
func (pc *ProcessCacheEntry) Release() {
pc.refCount--
if pc.refCount > 0 {
return
}
if pc.onRelease != nil {
pc.onRelease(pc)
}
if pc.releaseCb != nil {
pc.releaseCb()
}
}
// NewProcessCacheEntry returns a new process cache entry
func NewProcessCacheEntry(onRelease func(_ *ProcessCacheEntry)) *ProcessCacheEntry {
return &ProcessCacheEntry{onRelease: onRelease}
}
// ProcessAncestorsIterator defines an iterator of ancestors
type ProcessAncestorsIterator struct {
prev *ProcessCacheEntry
}
// Front returns the first element
func (it *ProcessAncestorsIterator) Front(ctx *eval.Context) unsafe.Pointer {
if front := ctx.Event.(*Event).ProcessContext.Ancestor; front != nil {
it.prev = front
return unsafe.Pointer(front)
}
return nil
}
// Next returns the next element
func (it *ProcessAncestorsIterator) Next() unsafe.Pointer {
if next := it.prev.Ancestor; next != nil {
it.prev = next
return unsafe.Pointer(next)
}
return nil
}
// HasParent returns whether the process has a parent
func (p *ProcessContext) HasParent() bool {
return p.Parent != nil
}
// ProcessContext holds the process context of an event
type ProcessContext struct {
Process
Parent *Process `field:"parent,opts:exposed_at_event_root_only,check:HasParent"`
Ancestor *ProcessCacheEntry `field:"ancestors,iterator:ProcessAncestorsIterator,check:IsNotKworker"`
}
// PIDContext holds the process context of an kernel event
type PIDContext struct {
Pid uint32 `field:"pid"` // SECLDoc[pid] Definition:`Process ID of the process (also called thread group ID)`
Tid uint32 `field:"tid"` // SECLDoc[tid] Definition:`Thread ID of the thread`
NetNS uint32 `field:"-"`
IsKworker bool `field:"is_kworker"` // SECLDoc[is_kworker] Definition:`Indicates whether the process is a kworker`
Inode uint64 `field:"-"` // used to track exec and event loss
}
// RenameEvent represents a rename event
type RenameEvent struct {
SyscallEvent
Old FileEvent `field:"file"`
New FileEvent `field:"file.destination"`
}
// RmdirEvent represents a rmdir event
type RmdirEvent struct {
SyscallEvent
File FileEvent `field:"file"`
}
// SetXAttrEvent represents an extended attributes event
type SetXAttrEvent struct {
SyscallEvent
File FileEvent `field:"file"`
Namespace string `field:"file.destination.namespace,handler:ResolveXAttrNamespace"` // SECLDoc[file.destination.namespace] Definition:`Namespace of the extended attribute`
Name string `field:"file.destination.name,handler:ResolveXAttrName"` // SECLDoc[file.destination.name] Definition:`Name of the extended attribute`
NameRaw [200]byte `field:"-" json:"-"`
}
// SyscallEvent contains common fields for all the event
type SyscallEvent struct {
Retval int64 `field:"retval"` // SECLDoc[retval] Definition:`Return value of the syscall` Constants:`Error constants`
}
// UnlinkEvent represents an unlink event
type UnlinkEvent struct {
SyscallEvent
File FileEvent `field:"file"`
Flags uint32 `field:"flags"` // SECLDoc[flags] Definition:`Flags of the unlink syscall` Constants:`Unlink flags`
}
// UmountEvent represents an umount event
type UmountEvent struct {
SyscallEvent
MountID uint32
}
// UtimesEvent represents a utime event
type UtimesEvent struct {
SyscallEvent
File FileEvent `field:"file"`
Atime time.Time `field:"-" json:"-"`
Mtime time.Time `field:"-" json:"-"`
}
// BPFEvent represents a BPF event
type BPFEvent struct {
SyscallEvent
Map BPFMap `field:"map"` // eBPF map involved in the BPF command
Program BPFProgram `field:"prog"` // eBPF program involved in the BPF command
Cmd uint32 `field:"cmd"` // SECLDoc[cmd] Definition:`BPF command name` Constants:`BPF commands`
}
// BPFMap represents a BPF map
type BPFMap struct {
ID uint32 `field:"-" json:"-"` // ID of the eBPF map
Type uint32 `field:"type"` // SECLDoc[type] Definition:`Type of the eBPF map` Constants:`BPF map types`
Name string `field:"name"` // SECLDoc[name] Definition:`Name of the eBPF map (added in 7.35)`
}
// BPFProgram represents a BPF program
type BPFProgram struct {
ID uint32 `field:"-" json:"-"` // ID of the eBPF program
Type uint32 `field:"type"` // SECLDoc[type] Definition:`Type of the eBPF program` Constants:`BPF program types`
AttachType uint32 `field:"attach_type"` // SECLDoc[attach_type] Definition:`Attach type of the eBPF program` Constants:`BPF attach types`
Helpers []uint32 `field:"helpers"` // SECLDoc[helpers] Definition:`eBPF helpers used by the eBPF program (added in 7.35)` Constants:`BPF helper functions`
Name string `field:"name"` // SECLDoc[name] Definition:`Name of the eBPF program (added in 7.35)`
Tag string `field:"tag"` // SECLDoc[tag] Definition:`Hash (sha1) of the eBPF program (added in 7.35)`
}
// PTraceEvent represents a ptrace event
type PTraceEvent struct {
SyscallEvent
Request uint32 `field:"request"` // SECLDoc[request] Definition:`ptrace request` Constants:`Ptrace constants`
PID uint32 `field:"-" json:"-"`
Address uint64 `field:"-" json:"-"`
Tracee *ProcessContext `field:"tracee"` // process context of the tracee
}
// MMapEvent represents a mmap event
type MMapEvent struct {
SyscallEvent
File FileEvent `field:"file"`
Addr uint64 `field:"-" json:"-"`
Offset uint64 `field:"-" json:"-"`
Len uint32 `field:"-" json:"-"`
Protection int `field:"protection"` // SECLDoc[protection] Definition:`memory segment protection` Constants:`Protection constants`
Flags int `field:"flags"` // SECLDoc[flags] Definition:`memory segment flags` Constants:`MMap flags`
}
// MProtectEvent represents a mprotect event
type MProtectEvent struct {
SyscallEvent
VMStart uint64 `field:"-" json:"-"`
VMEnd uint64 `field:"-" json:"-"`
VMProtection int `field:"vm_protection"` // SECLDoc[vm_protection] Definition:`initial memory segment protection` Constants:`Virtual Memory flags`
ReqProtection int `field:"req_protection"` // SECLDoc[req_protection] Definition:`new memory segment protection` Constants:`Virtual Memory flags`
}
// LoadModuleEvent represents a load_module event
type LoadModuleEvent struct {
SyscallEvent
File FileEvent `field:"file"` // Path to the kernel module file
LoadedFromMemory bool `field:"loaded_from_memory"` // SECLDoc[loaded_from_memory] Definition:`Indicates if the kernel module was loaded from memory`
Name string `field:"name"` // SECLDoc[name] Definition:`Name of the new kernel module`
}
// UnloadModuleEvent represents an unload_module event
type UnloadModuleEvent struct {
SyscallEvent
Name string `field:"name"` // SECLDoc[name] Definition:`Name of the kernel module that was deleted`
}
// SignalEvent represents a signal event
type SignalEvent struct {
SyscallEvent
Type uint32 `field:"type"` // SECLDoc[type] Definition:`Signal type (ex: SIGHUP, SIGINT, SIGQUIT, etc)` Constants:`Signal constants`
PID uint32 `field:"pid"` // SECLDoc[pid] Definition:`Target PID`
Target *ProcessContext `field:"target"` // Target process context
}
// SpliceEvent represents a splice event
type SpliceEvent struct {
SyscallEvent
File FileEvent `field:"file"` // File modified by the splice syscall
PipeEntryFlag uint32 `field:"pipe_entry_flag"` // SECLDoc[pipe_entry_flag] Definition:`Entry flag of the "fd_out" pipe passed to the splice syscall` Constants:`Pipe buffer flags`
PipeExitFlag uint32 `field:"pipe_exit_flag"` // SECLDoc[pipe_exit_flag] Definition:`Exit flag of the "fd_out" pipe passed to the splice syscall` Constants:`Pipe buffer flags`
}
// CgroupTracingEvent is used to signal that a new cgroup should be traced by the activity dump manager
type CgroupTracingEvent struct {
ContainerContext ContainerContext
Config ActivityDumpLoadConfig
ConfigCookie uint32
}
// ActivityDumpLoadConfig represents the load configuration of an activity dump
type ActivityDumpLoadConfig struct {
TracedEventTypes []EventType
Timeout time.Duration
WaitListTimestampRaw uint64
StartTimestampRaw uint64
EndTimestampRaw uint64
Rate uint32 // max number of events per sec
Paused uint32
}
// SetTimeout updates the timeout of an activity dump
func (adlc *ActivityDumpLoadConfig) SetTimeout(duration time.Duration) {
adlc.Timeout = duration
adlc.EndTimestampRaw = adlc.StartTimestampRaw + uint64(duration)
}
// NetworkDeviceContext represents the network device context of a network event
type NetworkDeviceContext struct {
NetNS uint32 `field:"-" json:"-"`
IfIndex uint32 `field:"ifindex"` // SECLDoc[ifindex] Definition:`interface ifindex`
IfName string `field:"ifname,handler:ResolveNetworkDeviceIfName"` // SECLDoc[ifname] Definition:`interface ifname`
}
// IPPortContext is used to hold an IP and Port
type IPPortContext struct {
IPNet net.IPNet `field:"ip"` // SECLDoc[ip] Definition:`IP address`
Port uint16 `field:"port"` // SECLDoc[port] Definition:`Port number`
}
// NetworkContext represents the network context of the event
type NetworkContext struct {
Device NetworkDeviceContext `field:"device"` // network device on which the network packet was captured
L3Protocol uint16 `field:"l3_protocol"` // SECLDoc[l3_protocol] Definition:`l3 protocol of the network packet` Constants:`L3 protocols`
L4Protocol uint16 `field:"l4_protocol"` // SECLDoc[l4_protocol] Definition:`l4 protocol of the network packet` Constants:`L4 protocols`
Source IPPortContext `field:"source"` // source of the network packet
Destination IPPortContext `field:"destination"` // destination of the network packet
Size uint32 `field:"size"` // SECLDoc[size] Definition:`size in bytes of the network packet`
}
// DNSEvent represents a DNS event
type DNSEvent struct {
ID uint16 `field:"id" json:"-"` // SECLDoc[id] Definition:`[Experimental] the DNS request ID`
Name string `field:"question.name,opts:length" op_override:"eval.DNSNameCmp"` // SECLDoc[question.name] Definition:`the queried domain name`
Type uint16 `field:"question.type"` // SECLDoc[question.type] Definition:`a two octet code which specifies the DNS question type` Constants:`DNS qtypes`
Class uint16 `field:"question.class"` // SECLDoc[question.class] Definition:`the class looked up by the DNS question` Constants:`DNS qclasses`
Size uint16 `field:"question.length"` // SECLDoc[question.length] Definition:`the total DNS request size in bytes`
Count uint16 `field:"question.count"` // SECLDoc[question.count] Definition:`the total count of questions in the DNS request`
}