events

package
v0.0.0-...-9610229 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Dec 14, 2020 License: GPL-2.0 Imports: 12 Imported by: 0

Documentation

Overview

Package events provides event structures and data through eBPF.

Exec provides data on execve calls. This code is modified from iovisor/gobpf examples.

Index

Constants

This section is empty.

Variables

View Source 
var EventLog = ring.New(1000)

Contains the most recent 1000 events

Functions

func CStr 

func CStr(cString []byte) string

func ExecBPF 

func ExecBPF(evChan chan Event, ctx Ctx)

func ListenBPF 

func ListenBPF(evChan chan Event, ctx Ctx)

Credit to https://blog.yadutaf.fr/2016/03/30/turn-any-syscall-into-event-introducing-ebpf-kernel-probes/

func Log 

func Log(e Event)

logEvent writes the given event to the EventLog.

func OpenBPF 

func OpenBPF(evChan chan Event, ctx Ctx)

func ReadlineBPF 

func ReadlineBPF(evChan chan Event, ctx Ctx)

func TypeHeader 

func TypeHeader(e Event) string

Types

type Ctx 

type Ctx struct {
	LoadWg *sync.WaitGroup
	Load   chan string
	Error  chan string
	Quit   chan bool
}

func NewContext 

func NewContext() Ctx

type Event 

type Event interface {
	Print() string
	Write([]byte) (Event, error)
	FetchUid() uint32
	FetchPid() uint32
	FetchPwd() string
	FetchRetVal() int32
	FetchOther() interface{}
	IsRet() bool
	IsPwd() bool
	IsOther() bool
	SetPwd(string)
	SetRetVal(int32)
	SetOther([]interface{})
}

func WriteEventData 

func WriteEventData(newEvent Event, data []byte) (Event, error)

type Exec 

type Exec struct {
	Comm [commLen]byte
	Argv [argSize]byte
	// contains filtered or unexported fields
}

func (*Exec) FetchOther 

func (e *Exec) FetchOther() interface{}

func (*Exec) FetchPid 

func (e *Exec) FetchPid() uint32

func (*Exec) FetchPwd 

func (e *Exec) FetchPwd() string

func (*Exec) FetchRetVal 

func (e *Exec) FetchRetVal() int32

func (*Exec) FetchUid 

func (e *Exec) FetchUid() uint32

func (*Exec) IsOther 

func (e *Exec) IsOther() bool

func (*Exec) IsPwd 

func (e *Exec) IsPwd() bool

func (*Exec) IsRet 

func (e *Exec) IsRet() bool

func (*Exec) Print 

func (e *Exec) Print() string

func (*Exec) SetOther 

func (e *Exec) SetOther(args []interface{})

func (*Exec) SetPwd 

func (e *Exec) SetPwd(tmp string)

func (*Exec) SetRetVal 

func (e *Exec) SetRetVal(val int32)

func (*Exec) Write 

func (e *Exec) Write(data []byte) (Event, error)

type File 

type File struct {
	Filename string
	// contains filtered or unexported fields
}

func (*File) FetchOther 

func (e *File) FetchOther() interface{}

func (*File) FetchPid 

func (e *File) FetchPid() uint32

func (*File) FetchPwd 

func (e *File) FetchPwd() string

func (*File) FetchRetVal 

func (e *File) FetchRetVal() int32

func (*File) FetchUid 

func (e *File) FetchUid() uint32

func (*File) IsOther 

func (e *File) IsOther() bool

func (*File) IsPwd 

func (e *File) IsPwd() bool

func (*File) IsRet 

func (e *File) IsRet() bool

func (*File) Print 

func (e *File) Print() string

func (*File) SetOther 

func (e *File) SetOther(input []interface{})

func (*File) SetPwd 

func (e *File) SetPwd(tmp string)

func (*File) SetRetVal 

func (e *File) SetRetVal(val int32)

func (*File) Write 

func (e *File) Write(data []byte) (Event, error)

type Listen 

type Listen struct {
	Addr     uint32
	Port     uint16
	SockType int16
	Backlog  int32
	// contains filtered or unexported fields
}

func (*Listen) FetchOther 

func (e *Listen) FetchOther() interface{}

func (*Listen) FetchPid 

func (e *Listen) FetchPid() uint32

func (*Listen) FetchPwd 

func (e *Listen) FetchPwd() string

func (*Listen) FetchRetVal 

func (e *Listen) FetchRetVal() int32

func (*Listen) FetchUid 

func (e *Listen) FetchUid() uint32

func (*Listen) IsOther 

func (e *Listen) IsOther() bool

func (*Listen) IsPwd 

func (e *Listen) IsPwd() bool

func (*Listen) IsRet 

func (e *Listen) IsRet() bool

func (Listen) Print 

func (e Listen) Print() string

func (*Listen) SetOther 

func (e *Listen) SetOther(input []interface{})

func (*Listen) SetPwd 

func (e *Listen) SetPwd(tmp string)

func (*Listen) SetRetVal 

func (e *Listen) SetRetVal(val int32)

func (*Listen) Write 

func (e *Listen) Write(data []byte) (Event, error)

type LogItem 

type LogItem struct {
	Time time.Time
	Ev   Event
}

func GetAll 

func GetAll() []LogItem

type Open 

type Open struct {
	Dfd      int16
	Filename [fileNameSize]byte
	Flags    int32
	// contains filtered or unexported fields
}

func (*Open) FetchOther 

func (e *Open) FetchOther() interface{}

func (*Open) FetchPid 

func (e *Open) FetchPid() uint32

func (*Open) FetchPwd 

func (e *Open) FetchPwd() string

func (*Open) FetchRetVal 

func (e *Open) FetchRetVal() int32

func (*Open) FetchUid 

func (e *Open) FetchUid() uint32

func (*Open) IsOther 

func (e *Open) IsOther() bool

func (*Open) IsPwd 

func (e *Open) IsPwd() bool

func (*Open) IsRet 

func (e *Open) IsRet() bool

func (*Open) Print 

func (e *Open) Print() string

func (*Open) SetOther 

func (e *Open) SetOther(input []interface{})

func (*Open) SetPwd 

func (e *Open) SetPwd(tmp string)

func (*Open) SetRetVal 

func (e *Open) SetRetVal(val int32)

func (*Open) Write 

func (e *Open) Write(data []byte) (Event, error)

type Process 

type Process struct {
	// contains filtered or unexported fields
}

func (*Process) FetchOther 

func (e *Process) FetchOther() interface{}

func (*Process) FetchPid 

func (e *Process) FetchPid() uint32

func (*Process) FetchPwd 

func (e *Process) FetchPwd() string

func (*Process) FetchRetVal 

func (e *Process) FetchRetVal() int32

func (*Process) FetchUid 

func (e *Process) FetchUid() uint32

func (*Process) IsOther 

func (e *Process) IsOther() bool

func (*Process) IsPwd 

func (e *Process) IsPwd() bool

func (*Process) IsRet 

func (e *Process) IsRet() bool

func (*Process) Print 

func (e *Process) Print() string

func (*Process) SetOther 

func (e *Process) SetOther(input []interface{})

func (*Process) SetPwd 

func (e *Process) SetPwd(tmp string)

func (*Process) SetRetVal 

func (e *Process) SetRetVal(val int32)

func (*Process) Write 

func (e *Process) Write(data []byte) (Event, error)

type Readline 

type Readline struct {
	Str [80]byte
	// contains filtered or unexported fields
}

func (*Readline) FetchOther 

func (e *Readline) FetchOther() interface{}

func (*Readline) FetchPid 

func (e *Readline) FetchPid() uint32

func (*Readline) FetchPwd 

func (e *Readline) FetchPwd() string

func (*Readline) FetchRetVal 

func (e *Readline) FetchRetVal() int32

func (*Readline) FetchUid 

func (e *Readline) FetchUid() uint32

func (*Readline) IsOther 

func (e *Readline) IsOther() bool

func (*Readline) IsPwd 

func (e *Readline) IsPwd() bool

func (*Readline) IsRet 

func (e *Readline) IsRet() bool

func (*Readline) Print 

func (e *Readline) Print() string

func (*Readline) SetOther 

func (e *Readline) SetOther(input []interface{})

func (*Readline) SetPwd 

func (e *Readline) SetPwd(tmp string)

func (*Readline) SetRetVal 

func (e *Readline) SetRetVal(val int32)

func (*Readline) Write 

func (e *Readline) Write(data []byte) (Event, error)

type User 

type User struct {
	// contains filtered or unexported fields
}

func (*User) FetchOther 

func (e *User) FetchOther() interface{}

func (*User) FetchPid 

func (e *User) FetchPid() uint32

func (*User) FetchPwd 

func (e *User) FetchPwd() string

func (*User) FetchRetVal 

func (e *User) FetchRetVal() int32

func (*User) FetchUid 

func (e *User) FetchUid() uint32

func (*User) IsOther 

func (e *User) IsOther() bool

func (*User) IsPwd 

func (e *User) IsPwd() bool

func (*User) IsRet 

func (e *User) IsRet() bool

func (*User) Print 

func (e *User) Print() string

func (*User) SetOther 

func (e *User) SetOther(input []interface{})

func (*User) SetPwd 

func (e *User) SetPwd(tmp string)

func (*User) SetRetVal 

func (e *User) SetRetVal(val int32)

func (*User) Write 

func (e *User) Write(data []byte) (Event, error)

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.