Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add file hash to exec events #225

Merged
merged 4 commits into from
Mar 20, 2024
Merged

Add file hash to exec events #225

merged 4 commits into from
Mar 20, 2024
+1,677 −196

Commits on Mar 20, 2024

  1. Make e2e test more robust

    @patrickpichler
    patrickpichler committed Mar 20, 2024
    Configuration menu
    Copy the full SHA
    cfae687 View commit details
    Browse the repository at this point in the history

  2. Add daemon enrichment service 

    With the enrichment service it is now possible to easily add event
enrichers, that run outside of the main event reporting hot loop. This
can be useful to e.g. calculate hashes for files, as the enrichment
process has multiple workers available.
    @patrickpichler
    patrickpichler committed Mar 20, 2024
    Configuration menu
    Copy the full SHA
    2f2161e View commit details
    Browse the repository at this point in the history

  3. Add sha256 sum of executed binaries 

    Exec events now feature a sha256 hash field, of the executed binary.
File access is done via the `/proc` filesystem. In order to also catch
short living processes, kvisor also tries accessing the file via other
processes in the same mount namespace.

For this to work in virtualised environments, such as kind, kvisor now
also translates PIDs from the origin PID namespace, to the namespace it
is running in.
    @patrickpichler
    patrickpichler committed Mar 20, 2024
    Configuration menu
    Copy the full SHA
    2eeb9ec View commit details
    Browse the repository at this point in the history

  4. Switch to always run in hostPID namespace 

    It is no longer feasable to run kvisor with `hostPID: false`, as various
features depend on this (e.g. the translation for container related PIDs).
Hence the option to configure it via the helm chart has been removed.

Additionally, the mount of the hosts `/proc` directory has also been
dropped, as it is no longer required.
    @patrickpichler
    patrickpichler committed Mar 20, 2024
    Configuration menu
    Copy the full SHA
    c95014e View commit details
    Browse the repository at this point in the history