Documentation ¶
Overview ¶
Package ebpf holds ebpf related files
Package ebpf holds ebpf related files ¶
Package ebpf holds ebpf related files ¶
Package ebpf holds ebpf related files
Index ¶
- Variables
- func IsSyscallWrapperRequired() (bool, error)
- func NewDefaultOptions() manager.Options
- func NewRuntimeSecurityManager(supportsRingBuffers, useFentry bool) *manager.Manager
- type BytesMapItem
- type OffsetGuesserLoader
- type ProbeLoader
- type StringMapItem
- type Uint16MapItem
- type Uint32MapItem
- type Uint64MapItem
- type Uint8MapItem
Constants ¶
This section is empty.
Variables ¶
var ( ZeroUint8MapItem = BytesMapItem([]byte{0}) ZeroUint32MapItem = BytesMapItem([]byte{0, 0, 0, 0}) ZeroUint64MapItem = BytesMapItem([]byte{0, 0, 0, 0, 0, 0, 0, 0}) )
Zero table items
var ( // BufferSelectorSyscallMonitorKey is the key used to select the active syscall monitor buffer key BufferSelectorSyscallMonitorKey = ZeroUint32MapItem // BufferSelectorERPCMonitorKey is the key used to select the active eRPC monitor buffer key BufferSelectorERPCMonitorKey = Uint32MapItem(1) // BufferSelectorDiscarderMonitorKey is the key used to select the active discarder monitor buffer key BufferSelectorDiscarderMonitorKey = Uint32MapItem(2) // BufferSelectorApproverMonitorKey is the key used to select the active approver monitor buffer key BufferSelectorApproverMonitorKey = Uint32MapItem(3) )
Functions ¶
func IsSyscallWrapperRequired ¶
IsSyscallWrapperRequired checks whether the wrapper is required
func NewDefaultOptions ¶
NewDefaultOptions returns a new instance of the default runtime security manager options
func NewRuntimeSecurityManager ¶
NewRuntimeSecurityManager returns a new instance of the runtime security module manager
Types ¶
type BytesMapItem ¶
type BytesMapItem []byte
BytesMapItem describes a raw table key or value
func (BytesMapItem) MarshalBinary ¶
func (i BytesMapItem) MarshalBinary() ([]byte, error)
MarshalBinary returns the binary representation of a BytesMapItem
type OffsetGuesserLoader ¶
type OffsetGuesserLoader struct {
// contains filtered or unexported fields
}
OffsetGuesserLoader defines an eBPF Loader
func NewOffsetGuesserLoader ¶
func NewOffsetGuesserLoader(config *config.Config) *OffsetGuesserLoader
NewOffsetGuesserLoader returns a new OffsetGuesserLoader
func (*OffsetGuesserLoader) Close ¶
func (l *OffsetGuesserLoader) Close() error
Close the OffsetGuesserLoader
func (*OffsetGuesserLoader) Load ¶
func (l *OffsetGuesserLoader) Load() (bytecode.AssetReader, error)
Load eBPF programs
type ProbeLoader ¶
type ProbeLoader struct {
// contains filtered or unexported fields
}
ProbeLoader defines an eBPF ProbeLoader
func NewProbeLoader ¶
func NewProbeLoader(config *config.Config, useSyscallWrapper, useRingBuffer bool, useFentry bool, statsdClient statsd.ClientInterface) *ProbeLoader
NewProbeLoader returns a new Loader
func (*ProbeLoader) Load ¶
func (l *ProbeLoader) Load() (bytecode.AssetReader, bool, error)
Load eBPF programs
type StringMapItem ¶
type StringMapItem struct {
// contains filtered or unexported fields
}
StringMapItem describes an string table key or value
func NewStringMapItem ¶
func NewStringMapItem(str string, size int) *StringMapItem
NewStringMapItem returns a new StringMapItem
func (*StringMapItem) MarshalBinary ¶
func (i *StringMapItem) MarshalBinary() ([]byte, error)
MarshalBinary returns the binary representation of a StringMapItem
type Uint16MapItem ¶
type Uint16MapItem uint16
Uint16MapItem describes an uint16 table key or value
func (Uint16MapItem) MarshalBinary ¶
func (i Uint16MapItem) MarshalBinary() ([]byte, error)
MarshalBinary returns the binary representation of a Uint16MapItem
type Uint32MapItem ¶
type Uint32MapItem uint32
Uint32MapItem describes an uint32 table key or value
func (Uint32MapItem) MarshalBinary ¶
func (i Uint32MapItem) MarshalBinary() ([]byte, error)
MarshalBinary returns the binary representation of a Uint32MapItem
type Uint64MapItem ¶
type Uint64MapItem uint64
Uint64MapItem describes an uint64 table key or value
func (Uint64MapItem) MarshalBinary ¶
func (i Uint64MapItem) MarshalBinary() ([]byte, error)
MarshalBinary returns the binary representation of a Uint64MapItem
type Uint8MapItem ¶
type Uint8MapItem uint8
Uint8MapItem describes an uint8 table key or value
func (Uint8MapItem) MarshalBinary ¶
func (i Uint8MapItem) MarshalBinary() ([]byte, error)
MarshalBinary returns the binary representation of a Uint8MapItem