-
Notifications
You must be signed in to change notification settings - Fork 336
/
base.go
149 lines (127 loc) · 3.33 KB
/
base.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
// SPDX-License-Identifier: Apache-2.0
// Copyright Authors of Tetragon
package base
import (
"log"
"sync"
"github.com/cilium/tetragon/pkg/kernels"
"github.com/cilium/tetragon/pkg/ksyms"
"github.com/cilium/tetragon/pkg/logger"
"github.com/cilium/tetragon/pkg/sensors"
"github.com/cilium/tetragon/pkg/sensors/program"
)
var (
Execve = program.Builder(
ExecObj(),
"sched/sched_process_exec",
"tracepoint/sys_execve",
"event_execve",
"execve",
)
ExecveBprmCommit = program.Builder(
"bpf_execve_bprm_commit_creds.o",
"security_bprm_committing_creds",
"kprobe/security_bprm_committing_creds",
"tg_kp_bprm_committing_creds",
"kprobe",
)
Exit = program.Builder(
"bpf_exit.o",
"acct_process",
"kprobe/acct_process",
"event_exit",
"kprobe",
)
Fork = program.Builder(
"bpf_fork.o",
"wake_up_new_task",
"kprobe/wake_up_new_task",
"kprobe_pid_clear",
"kprobe",
)
/* Event Ring map */
TCPMonMap = program.MapBuilder("tcpmon_map", Execve)
/* Networking and Process Monitoring maps */
ExecveMap = program.MapBuilder("execve_map", Execve)
ExecveTailCallsMap = program.MapBuilderPin("execve_calls", "execve_calls", Execve)
ExecveJoinMap = program.MapBuilder("tg_execve_joined_info_map", ExecveBprmCommit)
/* Tetragon runtime configuration */
TetragonConfMap = program.MapBuilder("tg_conf_map", Execve)
/* Internal statistics for debugging */
ExecveStats = program.MapBuilder("execve_map_stats", Execve)
ExecveJoinMapStats = program.MapBuilder("tg_execve_joined_info_map_stats", ExecveBprmCommit)
StatsMap = program.MapBuilder("tg_stats_map", Execve)
sensor = sensors.Sensor{
Name: "__base__",
}
sensorInit sync.Once
)
func setupExitProgram() {
ks, err := ksyms.KernelSymbols()
if err == nil {
has_acct_process := ks.IsAvailable("acct_process")
has_disassociate_ctty := ks.IsAvailable("disassociate_ctty")
/* Preffer acct_process over disassociate_ctty */
if has_acct_process {
Exit.Attach = "acct_process"
Exit.Label = "kprobe/acct_process"
} else if has_disassociate_ctty {
Exit.Attach = "disassociate_ctty"
Exit.Label = "kprobe/disassociate_ctty"
} else {
log.Fatal("Failed to detect exit probe symbol.")
}
}
logger.GetLogger().Infof("Exit probe on %s", Exit.Attach)
}
func GetExecveMap() *program.Map {
return ExecveMap
}
func GetExecveMapStats() *program.Map {
return ExecveStats
}
func GetTetragonConfMap() *program.Map {
return TetragonConfMap
}
func GetDefaultPrograms() []*program.Program {
progs := []*program.Program{
Exit,
Fork,
Execve,
ExecveBprmCommit,
}
return progs
}
func GetDefaultMaps() []*program.Map {
maps := []*program.Map{
ExecveMap,
ExecveJoinMap,
ExecveStats,
ExecveJoinMapStats,
ExecveTailCallsMap,
TCPMonMap,
TetragonConfMap,
StatsMap,
}
return maps
}
// GetInitialSensor returns the base sensor
func GetInitialSensor() *sensors.Sensor {
sensorInit.Do(func() {
setupExitProgram()
sensor.Progs = GetDefaultPrograms()
sensor.Maps = GetDefaultMaps()
})
return &sensor
}
// ExecObj returns the exec object based on the kernel version
func ExecObj() string {
if kernels.EnableV61Progs() {
return "bpf_execve_event_v61.o"
} else if kernels.MinKernelVersion("5.11") {
return "bpf_execve_event_v511.o"
} else if kernels.EnableLargeProgs() {
return "bpf_execve_event_v53.o"
}
return "bpf_execve_event.o"
}