events

package
v0.0.0-...-d7a781d Latest Latest
Warning

This package is not in the latest version of its module.

Go to latest
Published: Mar 7, 2023 License: Apache-2.0 Imports: 19 Imported by: 0

Documentation

Index

Constants

View Source
const (
	// BPFObjectNameLen is the maximum length of a map or program name
	BPFObjectNameLen = 16
	// BPFTagLen is the length of a bpf program tag
	BPFTagLen = 8
)
View Source
const (
	CgroupNameLength = 128
	TaskCommLength   = 16
)
View Source
const (
	// Entry indicates that the entry kprobe should be expanded
	Entry = 1 << 0
	// Exit indicates that the exit kretprobe should be expanded
	Exit = 1 << 1
	// ExpandTime32 indicates that the _time32 suffix should be added to the provided probe if needed
	ExpandTime32 = 1 << 2

	// EntryAndExit indicates that both the entry kprobe and exit kretprobe should be expanded
	EntryAndExit = Entry | Exit
)
View Source
const (
	// KRIEUID is the UID used to uniquely identify kernel space programs
	KRIEUID = "krie"
)
View Source
const MaxKernelParameterCount = 25

MaxKernelParameterCount is the hardcoded maximum count of kernel parameters that KRIE can check

View Source
const ModuleNameLen = 56

ModuleNameLen is the length of the name of a kernel module

View Source
const SymbolNameLength = 64

SymbolNameLength is the length of the name of a kernel symbol

Variables

View Source
var (
	// BPFCmdConstants is the list of BPF commands
	BPFCmdConstants = map[string]BPFCmd{
		"BPF_MAP_CREATE":                  BpfMapCreateCmd,
		"BPF_MAP_LOOKUP_ELEM":             BpfMapLookupElemCmd,
		"BPF_MAP_UPDATE_ELEM":             BpfMapUpdateElemCmd,
		"BPF_MAP_DELETE_ELEM":             BpfMapDeleteElemCmd,
		"BPF_MAP_GET_NEXT_KEY":            BpfMapGetNextKeyCmd,
		"BPF_PROG_LOAD":                   BpfProgLoadCmd,
		"BPF_OBJ_PIN":                     BpfObjPinCmd,
		"BPF_OBJ_GET":                     BpfObjGetCmd,
		"BPF_PROG_ATTACH":                 BpfProgAttachCmd,
		"BPF_PROG_DETACH":                 BpfProgDetachCmd,
		"BPF_PROG_TEST_RUN":               BpfProgTestRunCmd,
		"BPF_PROG_RUN":                    BpfProgTestRunCmd,
		"BPF_PROG_GET_NEXT_ID":            BpfProgGetNextIDCmd,
		"BPF_MAP_GET_NEXT_ID":             BpfMapGetNextIDCmd,
		"BPF_PROG_GET_FD_BY_ID":           BpfProgGetFdByIDCmd,
		"BPF_MAP_GET_FD_BY_ID":            BpfMapGetFdByIDCmd,
		"BPF_OBJ_GET_INFO_BY_FD":          BpfObjGetInfoByFdCmd,
		"BPF_PROG_QUERY":                  BpfProgQueryCmd,
		"BPF_RAW_TRACEPOINT_OPEN":         BpfRawTracepointOpenCmd,
		"BPF_BTF_LOAD":                    BpfBtfLoadCmd,
		"BPF_BTF_GET_FD_BY_ID":            BpfBtfGetFdByIDCmd,
		"BPF_TASK_FD_QUERY":               BpfTaskFdQueryCmd,
		"BPF_MAP_LOOKUP_AND_DELETE_ELEM":  BpfMapLookupAndDeleteElemCmd,
		"BPF_MAP_FREEZE":                  BpfMapFreezeCmd,
		"BPF_BTF_GET_NEXT_ID":             BpfBtfGetNextIDCmd,
		"BPF_MAP_LOOKUP_BATCH":            BpfMapLookupBatchCmd,
		"BPF_MAP_LOOKUP_AND_DELETE_BATCH": BpfMapLookupAndDeleteBatchCmd,
		"BPF_MAP_UPDATE_BATCH":            BpfMapUpdateBatchCmd,
		"BPF_MAP_DELETE_BATCH":            BpfMapDeleteBatchCmd,
		"BPF_LINK_CREATE":                 BpfLinkCreateCmd,
		"BPF_LINK_UPDATE":                 BpfLinkUpdateCmd,
		"BPF_LINK_GET_FD_BY_ID":           BpfLinkGetFdByIDCmd,
		"BPF_LINK_GET_NEXT_ID":            BpfLinkGetNextIDCmd,
		"BPF_ENABLE_STATS":                BpfEnableStatsCmd,
		"BPF_ITER_CREATE":                 BpfIterCreateCmd,
		"BPF_LINK_DETACH":                 BpfLinkDetachCmd,
		"BPF_PROG_BIND_MAP":               BpfProgBindMapCmd,
	}

	// BPFFilterCmdConstants is the list of BPF Filter commands
	BPFFilterCmdConstants = map[string]BPFFilterCmd{
		"SO_ATTACH_FILTER": SoAttachFilter,
		"SO_DETACH_FILTER": SoDetachFilter,
		"SO_LOCK_FILTER":   SoLockFilter,
	}

	// BPFHelperFuncConstants is the list of BPF helper func constants
	BPFHelperFuncConstants = map[string]BPFHelperFunc{}/* 166 elements not displayed */

	// BPFMapTypeConstants is the list of BPF map type constants
	BPFMapTypeConstants = map[string]BPFMapType{
		"BPF_MAP_TYPE_UNSPEC":                BpfMapTypeUnspec,
		"BPF_MAP_TYPE_HASH":                  BpfMapTypeHash,
		"BPF_MAP_TYPE_ARRAY":                 BpfMapTypeArray,
		"BPF_MAP_TYPE_PROG_ARRAY":            BpfMapTypeProgArray,
		"BPF_MAP_TYPE_PERF_EVENT_ARRAY":      BpfMapTypePerfEventArray,
		"BPF_MAP_TYPE_PERCPU_HASH":           BpfMapTypePercpuHash,
		"BPF_MAP_TYPE_PERCPU_ARRAY":          BpfMapTypePercpuArray,
		"BPF_MAP_TYPE_STACK_TRACE":           BpfMapTypeStackTrace,
		"BPF_MAP_TYPE_CGROUP_ARRAY":          BpfMapTypeCgroupArray,
		"BPF_MAP_TYPE_LRU_HASH":              BpfMapTypeLruHash,
		"BPF_MAP_TYPE_LRU_PERCPU_HASH":       BpfMapTypeLruPercpuHash,
		"BPF_MAP_TYPE_LPM_TRIE":              BpfMapTypeLpmTrie,
		"BPF_MAP_TYPE_ARRAY_OF_MAPS":         BpfMapTypeArrayOfMaps,
		"BPF_MAP_TYPE_HASH_OF_MAPS":          BpfMapTypeHashOfMaps,
		"BPF_MAP_TYPE_DEVMAP":                BpfMapTypeDevmap,
		"BPF_MAP_TYPE_SOCKMAP":               BpfMapTypeSockmap,
		"BPF_MAP_TYPE_CPUMAP":                BpfMapTypeCPUmap,
		"BPF_MAP_TYPE_XSKMAP":                BpfMapTypeXskmap,
		"BPF_MAP_TYPE_SOCKHASH":              BpfMapTypeSockhash,
		"BPF_MAP_TYPE_CGROUP_STORAGE":        BpfMapTypeCgroupStorage,
		"BPF_MAP_TYPE_REUSEPORT_SOCKARRAY":   BpfMapTypeReuseportSockarray,
		"BPF_MAP_TYPE_PERCPU_CGROUP_STORAGE": BpfMapTypePercpuCgroupStorage,
		"BPF_MAP_TYPE_QUEUE":                 BpfMapTypeQueue,
		"BPF_MAP_TYPE_STACK":                 BpfMapTypeStack,
		"BPF_MAP_TYPE_SK_STORAGE":            BpfMapTypeSkStorage,
		"BPF_MAP_TYPE_DEVMAP_HASH":           BpfMapTypeDevmapHash,
		"BPF_MAP_TYPE_STRUCT_OPS":            BpfMapTypeStructOps,
		"BPF_MAP_TYPE_RINGBUF":               BpfMapTypeRingbuf,
		"BPF_MAP_TYPE_INODE_STORAGE":         BpfMapTypeInodeStorage,
		"BPF_MAP_TYPE_TASK_STORAGE":          BpfMapTypeTaskStorage,
	}

	// BPFProgramTypeConstants is the list of BPF program type constants
	BPFProgramTypeConstants = map[string]BPFProgramType{
		"BPF_PROG_TYPE_UNSPEC":                  BpfProgTypeUnspec,
		"BPF_PROG_TYPE_SOCKET_FILTER":           BpfProgTypeSocketFilter,
		"BPF_PROG_TYPE_KPROBE":                  BpfProgTypeKprobe,
		"BPF_PROG_TYPE_SCHED_CLS":               BpfProgTypeSchedCls,
		"BPF_PROG_TYPE_SCHED_ACT":               BpfProgTypeSchedAct,
		"BPF_PROG_TYPE_TRACEPOINT":              BpfProgTypeTracepoint,
		"BPF_PROG_TYPE_XDP":                     BpfProgTypeXdp,
		"BPF_PROG_TYPE_PERF_EVENT":              BpfProgTypePerfEvent,
		"BPF_PROG_TYPE_CGROUP_SKB":              BpfProgTypeCgroupSkb,
		"BPF_PROG_TYPE_CGROUP_SOCK":             BpfProgTypeCgroupSock,
		"BPF_PROG_TYPE_LWT_IN":                  BpfProgTypeLwtIn,
		"BPF_PROG_TYPE_LWT_OUT":                 BpfProgTypeLwtOut,
		"BPF_PROG_TYPE_LWT_XMIT":                BpfProgTypeLwtXmit,
		"BPF_PROG_TYPE_SOCK_OPS":                BpfProgTypeSockOps,
		"BPF_PROG_TYPE_SK_SKB":                  BpfProgTypeSkSkb,
		"BPF_PROG_TYPE_CGROUP_DEVICE":           BpfProgTypeCgroupDevice,
		"BPF_PROG_TYPE_SK_MSG":                  BpfProgTypeSkMsg,
		"BPF_PROG_TYPE_RAW_TRACEPOINT":          BpfProgTypeRawTracepoint,
		"BPF_PROG_TYPE_CGROUP_SOCK_ADDR":        BpfProgTypeCgroupSockAddr,
		"BPF_PROG_TYPE_LWT_SEG6LOCAL":           BpfProgTypeLwtSeg6local,
		"BPF_PROG_TYPE_LIRC_MODE2":              BpfProgTypeLircMode2,
		"BPF_PROG_TYPE_SK_REUSEPORT":            BpfProgTypeSkReuseport,
		"BPF_PROG_TYPE_FLOW_DISSECTOR":          BpfProgTypeFlowDissector,
		"BPF_PROG_TYPE_CGROUP_SYSCTL":           BpfProgTypeCgroupSysctl,
		"BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE": BpfProgTypeRawTracepointWritable,
		"BPF_PROG_TYPE_CGROUP_SOCKOPT":          BpfProgTypeCgroupSockopt,
		"BPF_PROG_TYPE_TRACING":                 BpfProgTypeTracing,
		"BPF_PROG_TYPE_STRUCT_OPS":              BpfProgTypeStructOps,
		"BPF_PROG_TYPE_EXT":                     BpfProgTypeExt,
		"BPF_PROG_TYPE_LSM":                     BpfProgTypeLsm,
		"BPF_PROG_TYPE_SK_LOOKUP":               BpfProgTypeSkLookup,
	}

	// BPFAttachTypeConstants is the list of BPF attach type constants
	BPFAttachTypeConstants = map[string]BPFAttachType{
		"BPF_CGROUP_INET_INGRESS":      BpfCgroupInetIngress,
		"BPF_CGROUP_INET_EGRESS":       BpfCgroupInetEgress,
		"BPF_CGROUP_INET_SOCK_CREATE":  BpfCgroupInetSockCreate,
		"BPF_CGROUP_SOCK_OPS":          BpfCgroupSockOps,
		"BPF_SK_SKB_STREAM_PARSER":     BpfSkSkbStreamParser,
		"BPF_SK_SKB_STREAM_VERDICT":    BpfSkSkbStreamVerdict,
		"BPF_CGROUP_DEVICE":            BpfCgroupDevice,
		"BPF_SK_MSG_VERDICT":           BpfSkMsgVerdict,
		"BPF_CGROUP_INET4_BIND":        BpfCgroupInet4Bind,
		"BPF_CGROUP_INET6_BIND":        BpfCgroupInet6Bind,
		"BPF_CGROUP_INET4_CONNECT":     BpfCgroupInet4Connect,
		"BPF_CGROUP_INET6_CONNECT":     BpfCgroupInet6Connect,
		"BPF_CGROUP_INET4_POST_BIND":   BpfCgroupInet4PostBind,
		"BPF_CGROUP_INET6_POST_BIND":   BpfCgroupInet6PostBind,
		"BPF_CGROUP_UDP4_SENDMSG":      BpfCgroupUDP4Sendmsg,
		"BPF_CGROUP_UDP6_SENDMSG":      BpfCgroupUDP6Sendmsg,
		"BPF_LIRC_MODE2":               BpfLircMode2,
		"BPF_FLOW_DISSECTOR":           BpfFlowDissector,
		"BPF_CGROUP_SYSCTL":            BpfCgroupSysctl,
		"BPF_CGROUP_UDP4_RECVMSG":      BpfCgroupUDP4Recvmsg,
		"BPF_CGROUP_UDP6_RECVMSG":      BpfCgroupUDP6Recvmsg,
		"BPF_CGROUP_GETSOCKOPT":        BpfCgroupGetsockopt,
		"BPF_CGROUP_SETSOCKOPT":        BpfCgroupSetsockopt,
		"BPF_TRACE_RAW_TP":             BpfTraceRawTp,
		"BPF_TRACE_FENTRY":             BpfTraceFentry,
		"BPF_TRACE_FEXIT":              BpfTraceFexit,
		"BPF_MODIFY_RETURN":            BpfModifyReturn,
		"BPF_LSM_MAC":                  BpfLsmMac,
		"BPF_TRACE_ITER":               BpfTraceIter,
		"BPF_CGROUP_INET4_GETPEERNAME": BpfCgroupInet4Getpeername,
		"BPF_CGROUP_INET6_GETPEERNAME": BpfCgroupInet6Getpeername,
		"BPF_CGROUP_INET4_GETSOCKNAME": BpfCgroupInet4Getsockname,
		"BPF_CGROUP_INET6_GETSOCKNAME": BpfCgroupInet6Getsockname,
		"BPF_XDP_DEVMAP":               BpfXdpDevmap,
		"BPF_CGROUP_INET_SOCK_RELEASE": BpfCgroupInetSockRelease,
		"BPF_XDP_CPUMAP":               BpfXdpCPUmap,
		"BPF_SK_LOOKUP":                BpfSkLookup,
		"BPF_XDP":                      BpfXdp,
		"BPF_SK_SKB_VERDICT":           BpfSkSkbVerdict,
	}

	// L3ProtocolConstants is the list of supported L3 protocols
	L3ProtocolConstants = map[string]L3Protocol{
		"ETH_P_LOOP":            EthPLOOP,
		"ETH_P_PUP":             EthPPUP,
		"ETH_P_PUPAT":           EthPPUPAT,
		"ETH_P_TSN":             EthPTSN,
		"ETH_P_IP":              EthPIP,
		"ETH_P_X25":             EthPX25,
		"ETH_P_ARP":             EthPARP,
		"ETH_P_BPQ":             EthPBPQ,
		"ETH_P_IEEEPUP":         EthPIEEEPUP,
		"ETH_P_IEEEPUPAT":       EthPIEEEPUPAT,
		"ETH_P_BATMAN":          EthPBATMAN,
		"ETH_P_DEC":             EthPDEC,
		"ETH_P_DNADL":           EthPDNADL,
		"ETH_P_DNARC":           EthPDNARC,
		"ETH_P_DNART":           EthPDNART,
		"ETH_P_LAT":             EthPLAT,
		"ETH_P_DIAG":            EthPDIAG,
		"ETH_P_CUST":            EthPCUST,
		"ETH_P_SCA":             EthPSCA,
		"ETH_P_TEB":             EthPTEB,
		"ETH_P_RARP":            EthPRARP,
		"ETH_P_ATALK":           EthPATALK,
		"ETH_P_AARP":            EthPAARP,
		"ETH_P_8021_Q":          EthP8021Q,
		"ETH_P_ERSPAN":          EthPERSPAN,
		"ETH_P_IPX":             EthPIPX,
		"ETH_P_IPV6":            EthPIPV6,
		"ETH_P_PAUSE":           EthPPAUSE,
		"ETH_P_SLOW":            EthPSLOW,
		"ETH_P_WCCP":            EthPWCCP,
		"ETH_P_MPLSUC":          EthPMPLSUC,
		"ETH_P_MPLSMC":          EthPMPLSMC,
		"ETH_P_ATMMPOA":         EthPATMMPOA,
		"ETH_P_PPPDISC":         EthPPPPDISC,
		"ETH_P_PPPSES":          EthPPPPSES,
		"ETH_P__LINK_CTL":       EthPLinkCTL,
		"ETH_P_ATMFATE":         EthPATMFATE,
		"ETH_P_PAE":             EthPPAE,
		"ETH_P_AOE":             EthPAOE,
		"ETH_P_8021_AD":         EthP8021AD,
		"ETH_P_802_EX1":         EthP802EX1,
		"ETH_P_TIPC":            EthPTIPC,
		"ETH_P_MACSEC":          EthPMACSEC,
		"ETH_P_8021_AH":         EthP8021AH,
		"ETH_P_MVRP":            EthPMVRP,
		"ETH_P_1588":            EthP1588,
		"ETH_P_NCSI":            EthPNCSI,
		"ETH_P_PRP":             EthPPRP,
		"ETH_P_FCOE":            EthPFCOE,
		"ETH_P_IBOE":            EthPIBOE,
		"ETH_P_TDLS":            EthPTDLS,
		"ETH_P_FIP":             EthPFIP,
		"ETH_P_80221":           EthP80221,
		"ETH_P_HSR":             EthPHSR,
		"ETH_P_NSH":             EthPNSH,
		"ETH_P_LOOPBACK":        EthPLOOPBACK,
		"ETH_P_QINQ1":           EthPQINQ1,
		"ETH_P_QINQ2":           EthPQINQ2,
		"ETH_P_QINQ3":           EthPQINQ3,
		"ETH_P_EDSA":            EthPEDSA,
		"ETH_P_IFE":             EthPIFE,
		"ETH_P_AFIUCV":          EthPAFIUCV,
		"ETH_P_8023_MIN":        EthP8023MIN,
		"ETH_P_IPV6_HOP_BY_HOP": EthPIPV6HopByHop,
		"ETH_P_8023":            EthP8023,
		"ETH_P_AX25":            EthPAX25,
		"ETH_P_ALL":             EthPALL,
		"ETH_P_8022":            EthP8022,
		"ETH_P_SNAP":            EthPSNAP,
		"ETH_P_DDCMP":           EthPDDCMP,
		"ETH_P_WANPPP":          EthPWANPPP,
		"ETH_P_PPPMP":           EthPPPPMP,
		"ETH_P_LOCALTALK":       EthPLOCALTALK,
		"ETH_P_CAN":             EthPCAN,
		"ETH_P_CANFD":           EthPCANFD,
		"ETH_P_PPPTALK":         EthPPPPTALK,
		"ETH_P_TR8022":          EthPTR8022,
		"ETH_P_MOBITEX":         EthPMOBITEX,
		"ETH_P_CONTROL":         EthPCONTROL,
		"ETH_P_IRDA":            EthPIRDA,
		"ETH_P_ECONET":          EthPECONET,
		"ETH_P_HDLC":            EthPHDLC,
		"ETH_P_ARCNET":          EthPARCNET,
		"ETH_P_DSA":             EthPDSA,
		"ETH_P_TRAILER":         EthPTRAILER,
		"ETH_P_PHONET":          EthPPHONET,
		"ETH_P_IEEE802154":      EthPIEEE802154,
		"ETH_P_CAIF":            EthPCAIF,
		"ETH_P_XDSA":            EthPXDSA,
		"ETH_P_MAP":             EthPMAP,
	}

	KProbeCommandConstants = map[string]KProbeCommand{
		"REGISTER_KPROBE":      1,
		"UNREGISTER_KPROBE":    2,
		"REGISTER_KRETPROBE":   3,
		"UNREGISTER_KRETPROBE": 4,
		"ENABLE_KPROBE":        5,
		"DISABLE_KPROBE":       6,
		"DISARM_ALL_KPROBES":   7,
		"ARM_ALL_KPROBES":      8,
	}

	KProbeTypeConstants = map[string]KProbeType{
		"KPROBE_TYPE":    1,
		"KRETPROBE_TYPE": 2,
	}

	SysCtlActionConstants = map[string]SysCtlAction{
		"SYSCTL_SHOT":     0,
		"SYSCTL_OK":       1,
		"SYSCTL_OVERRIDE": 2,
		"SYSCTL_EINVAL":   3,
		"SYSCTL_ERANGE":   4,
	}

	ActionConstants = map[string]Action{
		"nop":      NopAction,
		"log":      LogAction,
		"block":    BlockAction,
		"kill":     KillAction,
		"paranoid": ParanoidAction,
	}

	HookPointConstants = map[string]HookPoint{
		"prepare_kernel_cred": 0,
		"commit_creds":        1,
	}
)
View Source
var ByteOrder binary.ByteOrder

ByteOrder holds the hosts byte order

View Source
var (
	// ErrNotEnoughData is the error returned when the provided buffer is too small
	ErrNotEnoughData = fmt.Errorf("not enough data")
)
View Source
var RuntimeArch string

RuntimeArch holds the CPU architecture of the running machine

Functions

func AllExcludedFunctions

func AllExcludedFunctions() []string

AllExcludedFunctions returns the list of excluded functions

func AllProbes

func AllProbes(events EventTypeList) []*manager.Probe

AllProbes returns all the probes

func AllProbesSelectors

func AllProbesSelectors(events EventTypeList) []manager.ProbesSelector

AllProbesSelectors returns all the probes selectors

func AllTailCallRoutes

func AllTailCallRoutes(events EventTypeList) []manager.TailCallRoute

AllTailCallRoutes returns all the tail call routes

func ExpandSyscallProbes

func ExpandSyscallProbes(probe *manager.Probe, flag int, compat ...bool) []*manager.Probe

ExpandSyscallProbes returns the list of available hook probes for the syscall func name of the provided probe

func ExpandSyscallProbesSelector

func ExpandSyscallProbesSelector(id manager.ProbeIdentificationPair, flag int, compat ...bool) []manager.ProbesSelector

ExpandSyscallProbesSelector returns the list of a ProbesSelector required to query all the probes available for a syscall

func GetCheckHelperCallInputType

func GetCheckHelperCallInputType() uint64

GetCheckHelperCallInputType returns 1 or 2 defending on the prototype of the check_helper_call function in the current kernel

func GetHostByteOrder

func GetHostByteOrder() binary.ByteOrder

GetHostByteOrder guesses the hosts byte order

func HasOneMillionInstructionsAvailable

func HasOneMillionInstructionsAvailable() bool

HasOneMillionInstructionsAvailable returns true if the current kernel accepts programs with 1 million instructions

func IsBPFLSMAvailable

func IsBPFLSMAvailable() bool

func IsBPFOverrideReturnAvailable

func IsBPFOverrideReturnAvailable() uint64

IsBPFOverrideReturnAvailable returns true if the bpf_override_return helper is available in the current kernel

func IsBPFSendSignalHelperAvailable

func IsBPFSendSignalHelperAvailable() uint64

IsBPFSendSignalHelperAvailable returns true if the bpf_send_signal helper is available in the current kernel

func IsCgroupSysctlProgramAvailable

func IsCgroupSysctlProgramAvailable() bool

IsCgroupSysctlProgramAvailable returns true if the cgroup sysctl program type is available in the current kernel

func ShouldUseSyscallExitTracepoints

func ShouldUseSyscallExitTracepoints() uint64

ShouldUseSyscallExitTracepoints returns true if the kernel version is old and we need to use tracepoints to handle syscall exits instead of kretprobes

func UnmarshalString

func UnmarshalString(data []byte, size int) (string, error)

UnmarshalString unmarshal string

Types

type Action

type Action uint32

Action is an action taken by KRIE

const (
	NopAction Action = iota
	LogAction
	BlockAction
	KillAction
	ParanoidAction
)

func (Action) MarshalJSON

func (a Action) MarshalJSON() ([]byte, error)

func (Action) String

func (a Action) String() string

func (*Action) UnmarshalYAML

func (a *Action) UnmarshalYAML(value *yaml.Node) error

type AddressFamily

type AddressFamily uint16

AddressFamily represents an address family

func (AddressFamily) MarshalJSON

func (af AddressFamily) MarshalJSON() ([]byte, error)

func (AddressFamily) String

func (af AddressFamily) String() string

type BPFAttachType

type BPFAttachType uint32

BPFAttachType is used to define attach type constants

const (
	// BpfCgroupInetIngress attach type
	BpfCgroupInetIngress BPFAttachType = iota + 1
	// BpfCgroupInetEgress attach type
	BpfCgroupInetEgress
	// BpfCgroupInetSockCreate attach type
	BpfCgroupInetSockCreate
	// BpfCgroupSockOps attach type
	BpfCgroupSockOps
	// BpfSkSkbStreamParser attach type
	BpfSkSkbStreamParser
	// BpfSkSkbStreamVerdict attach type
	BpfSkSkbStreamVerdict
	// BpfCgroupDevice attach type
	BpfCgroupDevice
	// BpfSkMsgVerdict attach type
	BpfSkMsgVerdict
	// BpfCgroupInet4Bind attach type
	BpfCgroupInet4Bind
	// BpfCgroupInet6Bind attach type
	BpfCgroupInet6Bind
	// BpfCgroupInet4Connect attach type
	BpfCgroupInet4Connect
	// BpfCgroupInet6Connect attach type
	BpfCgroupInet6Connect
	// BpfCgroupInet4PostBind attach type
	BpfCgroupInet4PostBind
	// BpfCgroupInet6PostBind attach type
	BpfCgroupInet6PostBind
	// BpfCgroupUDP4Sendmsg attach type
	BpfCgroupUDP4Sendmsg
	// BpfCgroupUDP6Sendmsg attach type
	BpfCgroupUDP6Sendmsg
	// BpfLircMode2 attach type
	BpfLircMode2
	// BpfFlowDissector attach type
	BpfFlowDissector
	// BpfCgroupSysctl attach type
	BpfCgroupSysctl
	// BpfCgroupUDP4Recvmsg attach type
	BpfCgroupUDP4Recvmsg
	// BpfCgroupUDP6Recvmsg attach type
	BpfCgroupUDP6Recvmsg
	// BpfCgroupGetsockopt attach type
	BpfCgroupGetsockopt
	// BpfCgroupSetsockopt attach type
	BpfCgroupSetsockopt
	// BpfTraceRawTp attach type
	BpfTraceRawTp
	// BpfTraceFentry attach type
	BpfTraceFentry
	// BpfTraceFexit attach type
	BpfTraceFexit
	// BpfModifyReturn attach type
	BpfModifyReturn
	// BpfLsmMac attach type
	BpfLsmMac
	// BpfTraceIter attach type
	BpfTraceIter
	// BpfCgroupInet4Getpeername attach type
	BpfCgroupInet4Getpeername
	// BpfCgroupInet6Getpeername attach type
	BpfCgroupInet6Getpeername
	// BpfCgroupInet4Getsockname attach type
	BpfCgroupInet4Getsockname
	// BpfCgroupInet6Getsockname attach type
	BpfCgroupInet6Getsockname
	// BpfXdpDevmap attach type
	BpfXdpDevmap
	// BpfCgroupInetSockRelease attach type
	BpfCgroupInetSockRelease
	// BpfXdpCPUmap attach type
	BpfXdpCPUmap
	// BpfSkLookup attach type
	BpfSkLookup
	// BpfXdp attach type
	BpfXdp
	// BpfSkSkbVerdict attach type
	BpfSkSkbVerdict
)

func (BPFAttachType) MarshalJSON

func (t BPFAttachType) MarshalJSON() ([]byte, error)

func (BPFAttachType) String

func (t BPFAttachType) String() string

type BPFCmd

type BPFCmd uint64

BPFCmd represents a BPF command

const (
	// BpfMapCreateCmd command
	BpfMapCreateCmd BPFCmd = iota
	// BpfMapLookupElemCmd command
	BpfMapLookupElemCmd
	// BpfMapUpdateElemCmd command
	BpfMapUpdateElemCmd
	// BpfMapDeleteElemCmd command
	BpfMapDeleteElemCmd
	// BpfMapGetNextKeyCmd command
	BpfMapGetNextKeyCmd
	// BpfProgLoadCmd command
	BpfProgLoadCmd
	// BpfObjPinCmd command
	BpfObjPinCmd
	// BpfObjGetCmd command
	BpfObjGetCmd
	// BpfProgAttachCmd command
	BpfProgAttachCmd
	// BpfProgDetachCmd command
	BpfProgDetachCmd
	// BpfProgTestRunCmd command
	BpfProgTestRunCmd
	// BpfProgGetNextIDCmd command
	BpfProgGetNextIDCmd
	// BpfMapGetNextIDCmd command
	BpfMapGetNextIDCmd
	// BpfProgGetFdByIDCmd command
	BpfProgGetFdByIDCmd
	// BpfMapGetFdByIDCmd command
	BpfMapGetFdByIDCmd
	// BpfObjGetInfoByFdCmd command
	BpfObjGetInfoByFdCmd
	// BpfProgQueryCmd command
	BpfProgQueryCmd
	// BpfRawTracepointOpenCmd command
	BpfRawTracepointOpenCmd
	// BpfBtfLoadCmd command
	BpfBtfLoadCmd
	// BpfBtfGetFdByIDCmd command
	BpfBtfGetFdByIDCmd
	// BpfTaskFdQueryCmd command
	BpfTaskFdQueryCmd
	// BpfMapLookupAndDeleteElemCmd command
	BpfMapLookupAndDeleteElemCmd
	// BpfMapFreezeCmd command
	BpfMapFreezeCmd
	// BpfBtfGetNextIDCmd command
	BpfBtfGetNextIDCmd
	// BpfMapLookupBatchCmd command
	BpfMapLookupBatchCmd
	// BpfMapLookupAndDeleteBatchCmd command
	BpfMapLookupAndDeleteBatchCmd
	// BpfMapUpdateBatchCmd command
	BpfMapUpdateBatchCmd
	// BpfMapDeleteBatchCmd command
	BpfMapDeleteBatchCmd
	// BpfLinkCreateCmd command
	BpfLinkCreateCmd
	// BpfLinkUpdateCmd command
	BpfLinkUpdateCmd
	// BpfLinkGetFdByIDCmd command
	BpfLinkGetFdByIDCmd
	// BpfLinkGetNextIDCmd command
	BpfLinkGetNextIDCmd
	// BpfEnableStatsCmd command
	BpfEnableStatsCmd
	// BpfIterCreateCmd command
	BpfIterCreateCmd
	// BpfLinkDetachCmd command
	BpfLinkDetachCmd
	// BpfProgBindMapCmd command
	BpfProgBindMapCmd
)

func (BPFCmd) MarshalJSON

func (cmd BPFCmd) MarshalJSON() ([]byte, error)

func (BPFCmd) String

func (cmd BPFCmd) String() string

type BPFEvent

type BPFEvent struct {
	Map     BPFMap
	Program BPFProgram
	Cmd     BPFCmd
}

BPFEvent represents a BPF event

func (*BPFEvent) UnmarshallBinary

func (e *BPFEvent) UnmarshallBinary(data []byte) (int, error)

UnmarshallBinary unmarshalls a binary representation of itself

type BPFEventSerializer

type BPFEventSerializer struct {
	Map     *BPFMap     `json:"map,omitempty"`
	Program *BPFProgram `json:"program,omitempty"`
	Cmd     BPFCmd      `json:"cmd"`
}

BPFEventSerializer is used to serialize BPFEvent easyjson:json

func NewBPFEventSerializer

func NewBPFEventSerializer(e *BPFEvent) *BPFEventSerializer

NewBPFEventSerializer returns a new instance of BPFEventSerializer

func (BPFEventSerializer) MarshalEasyJSON

func (v BPFEventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*BPFEventSerializer) UnmarshalEasyJSON

func (v *BPFEventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type BPFFilterCmd

type BPFFilterCmd uint32

BPFFilterCmd represents a BPF filter command

const (
	// SoAttachFilter command
	SoAttachFilter BPFFilterCmd = 26
	// SoDetachFilter command
	SoDetachFilter BPFFilterCmd = 27
	// SoLockFilter command
	SoLockFilter BPFFilterCmd = 44
)

func (BPFFilterCmd) MarshalJSON

func (cmd BPFFilterCmd) MarshalJSON() ([]byte, error)

func (BPFFilterCmd) String

func (cmd BPFFilterCmd) String() string

type BPFFilterEvent

type BPFFilterEvent struct {
	Cmd      BPFFilterCmd  `json:"cmd,omitempty"`
	Family   AddressFamily `json:"family,omitempty"`
	Type     SocketType    `json:"type,omitempty"`
	Protocol L3Protocol    `json:"protocol,omitempty"`
	ProgLen  uint16        `json:"prog_len,omitempty"`
}

BPFFilterEvent represents a BPF event

func (*BPFFilterEvent) UnmarshallBinary

func (e *BPFFilterEvent) UnmarshallBinary(data []byte) (int, error)

UnmarshallBinary unmarshalls a binary representation of itself

type BPFFilterEventSerializer

type BPFFilterEventSerializer struct {
	*BPFFilterEvent
}

BPFFilterEventSerializer is used to serialize BPFFilterEvent easyjson:json

func NewBPFFilterEventSerializer

func NewBPFFilterEventSerializer(e *BPFFilterEvent) *BPFFilterEventSerializer

NewBPFFilterEventSerializer returns a new instance of BPFFilterEventSerializer

func (BPFFilterEventSerializer) MarshalEasyJSON

func (v BPFFilterEventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*BPFFilterEventSerializer) UnmarshalEasyJSON

func (v *BPFFilterEventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type BPFHelperFunc

type BPFHelperFunc uint32

BPFHelperFunc represents a BPF helper function

const (
	// BpfUnspec helper function
	BpfUnspec BPFHelperFunc = iota
	// BpfMapLookupElem helper function
	BpfMapLookupElem
	// BpfMapUpdateElem helper function
	BpfMapUpdateElem
	// BpfMapDeleteElem helper function
	BpfMapDeleteElem
	// BpfProbeRead helper function
	BpfProbeRead
	// BpfKtimeGetNs helper function
	BpfKtimeGetNs
	// BpfTracePrintk helper function
	BpfTracePrintk
	// BpfGetPrandomU32 helper function
	BpfGetPrandomU32
	// BpfGetSmpProcessorID helper function
	BpfGetSmpProcessorID
	// BpfSkbStoreBytes helper function
	BpfSkbStoreBytes
	// BpfL3CsumReplace helper function
	BpfL3CsumReplace
	// BpfL4CsumReplace helper function
	BpfL4CsumReplace
	// BpfTailCall helper function
	BpfTailCall
	// BpfCloneRedirect helper function
	BpfCloneRedirect
	// BpfGetCurrentPidTgid helper function
	BpfGetCurrentPidTgid
	// BpfGetCurrentUIDGid helper function
	BpfGetCurrentUIDGid
	// BpfGetCurrentComm helper function
	BpfGetCurrentComm
	// BpfGetCgroupClassid helper function
	BpfGetCgroupClassid
	// BpfSkbVlanPush helper function
	BpfSkbVlanPush
	// BpfSkbVlanPop helper function
	BpfSkbVlanPop
	// BpfSkbGetTunnelKey helper function
	BpfSkbGetTunnelKey
	// BpfSkbSetTunnelKey helper function
	BpfSkbSetTunnelKey
	// BpfPerfEventRead helper function
	BpfPerfEventRead
	// BpfRedirect helper function
	BpfRedirect
	// BpfGetRouteRealm helper function
	BpfGetRouteRealm
	// BpfPerfEventOutput helper function
	BpfPerfEventOutput
	// BpfSkbLoadBytes helper function
	BpfSkbLoadBytes
	// BpfGetStackid helper function
	BpfGetStackid
	// BpfCsumDiff helper function
	BpfCsumDiff
	// BpfSkbGetTunnelOpt helper function
	BpfSkbGetTunnelOpt
	// BpfSkbSetTunnelOpt helper function
	BpfSkbSetTunnelOpt
	// BpfSkbChangeProto helper function
	BpfSkbChangeProto
	// BpfSkbChangeType helper function
	BpfSkbChangeType
	// BpfSkbUnderCgroup helper function
	BpfSkbUnderCgroup
	// BpfGetHashRecalc helper function
	BpfGetHashRecalc
	// BpfGetCurrentTask helper function
	BpfGetCurrentTask
	// BpfProbeWriteUser helper function
	BpfProbeWriteUser
	// BpfCurrentTaskUnderCgroup helper function
	BpfCurrentTaskUnderCgroup
	// BpfSkbChangeTail helper function
	BpfSkbChangeTail
	// BpfSkbPullData helper function
	BpfSkbPullData
	// BpfCsumUpdate helper function
	BpfCsumUpdate
	// BpfSetHashInvalid helper function
	BpfSetHashInvalid
	// BpfGetNumaNodeID helper function
	BpfGetNumaNodeID
	// BpfSkbChangeHead helper function
	BpfSkbChangeHead
	// BpfXdpAdjustHead helper function
	BpfXdpAdjustHead
	// BpfProbeReadStr helper function
	BpfProbeReadStr
	// BpfGetSocketCookie helper function
	BpfGetSocketCookie
	// BpfGetSocketUID helper function
	BpfGetSocketUID
	// BpfSetHash helper function
	BpfSetHash
	// BpfSetsockopt helper function
	BpfSetsockopt
	// BpfSkbAdjustRoom helper function
	BpfSkbAdjustRoom
	// BpfRedirectMap helper function
	BpfRedirectMap
	// BpfSkRedirectMap helper function
	BpfSkRedirectMap
	// BpfSockMapUpdate helper function
	BpfSockMapUpdate
	// BpfXdpAdjustMeta helper function
	BpfXdpAdjustMeta
	// BpfPerfEventReadValue helper function
	BpfPerfEventReadValue
	// BpfPerfProgReadValue helper function
	BpfPerfProgReadValue
	// BpfGetsockopt helper function
	BpfGetsockopt
	// BpfOverrideReturn helper function
	BpfOverrideReturn
	// BpfSockOpsCbFlagsSet helper function
	BpfSockOpsCbFlagsSet
	// BpfMsgRedirectMap helper function
	BpfMsgRedirectMap
	// BpfMsgApplyBytes helper function
	BpfMsgApplyBytes
	// BpfMsgCorkBytes helper function
	BpfMsgCorkBytes
	// BpfMsgPullData helper function
	BpfMsgPullData
	// BpfBind helper function
	BpfBind
	// BpfXdpAdjustTail helper function
	BpfXdpAdjustTail
	// BpfSkbGetXfrmState helper function
	BpfSkbGetXfrmState
	// BpfGetStack helper function
	BpfGetStack
	// BpfSkbLoadBytesRelative helper function
	BpfSkbLoadBytesRelative
	// BpfFibLookup helper function
	BpfFibLookup
	// BpfSockHashUpdate helper function
	BpfSockHashUpdate
	// BpfMsgRedirectHash helper function
	BpfMsgRedirectHash
	// BpfSkRedirectHash helper function
	BpfSkRedirectHash
	// BpfLwtPushEncap helper function
	BpfLwtPushEncap
	// BpfLwtSeg6StoreBytes helper function
	BpfLwtSeg6StoreBytes
	// BpfLwtSeg6AdjustSrh helper function
	BpfLwtSeg6AdjustSrh
	// BpfLwtSeg6Action helper function
	BpfLwtSeg6Action
	// BpfRcRepeat helper function
	BpfRcRepeat
	// BpfRcKeydown helper function
	BpfRcKeydown
	// BpfSkbCgroupID helper function
	BpfSkbCgroupID
	// BpfGetCurrentCgroupID helper function
	BpfGetCurrentCgroupID
	// BpfGetLocalStorage helper function
	BpfGetLocalStorage
	// BpfSkSelectReuseport helper function
	BpfSkSelectReuseport
	// BpfSkbAncestorCgroupID helper function
	BpfSkbAncestorCgroupID
	// BpfSkLookupTCP helper function
	BpfSkLookupTCP
	// BpfSkLookupUDP helper function
	BpfSkLookupUDP
	// BpfSkRelease helper function
	BpfSkRelease
	// BpfMapPushElem helper function
	BpfMapPushElem
	// BpfMapPopElem helper function
	BpfMapPopElem
	// BpfMapPeekElem helper function
	BpfMapPeekElem
	// BpfMsgPushData helper function
	BpfMsgPushData
	// BpfMsgPopData helper function
	BpfMsgPopData
	// BpfRcPointerRel helper function
	BpfRcPointerRel
	// BpfSpinLock helper function
	BpfSpinLock
	// BpfSpinUnlock helper function
	BpfSpinUnlock
	// BpfSkFullsock helper function
	BpfSkFullsock
	// BpfTCPSock helper function
	BpfTCPSock
	// BpfSkbEcnSetCe helper function
	BpfSkbEcnSetCe
	// BpfGetListenerSock helper function
	BpfGetListenerSock
	// BpfSkcLookupTCP helper function
	BpfSkcLookupTCP
	// BpfTCPCheckSyncookie helper function
	BpfTCPCheckSyncookie
	// BpfSysctlGetName helper function
	BpfSysctlGetName
	// BpfSysctlGetCurrentValue helper function
	BpfSysctlGetCurrentValue
	// BpfSysctlGetNewValue helper function
	BpfSysctlGetNewValue
	// BpfSysctlSetNewValue helper function
	BpfSysctlSetNewValue
	// BpfStrtol helper function
	BpfStrtol
	// BpfStrtoul helper function
	BpfStrtoul
	// BpfSkStorageGet helper function
	BpfSkStorageGet
	// BpfSkStorageDelete helper function
	BpfSkStorageDelete
	// BpfSendSignal helper function
	BpfSendSignal
	// BpfTCPGenSyncookie helper function
	BpfTCPGenSyncookie
	// BpfSkbOutput helper function
	BpfSkbOutput
	// BpfProbeReadUser helper function
	BpfProbeReadUser
	// BpfProbeReadKernel helper function
	BpfProbeReadKernel
	// BpfProbeReadUserStr helper function
	BpfProbeReadUserStr
	// BpfProbeReadKernelStr helper function
	BpfProbeReadKernelStr
	// BpfTCPSendAck helper function
	BpfTCPSendAck
	// BpfSendSignalThread helper function
	BpfSendSignalThread
	// BpfJiffies64 helper function
	BpfJiffies64
	// BpfReadBranchRecords helper function
	BpfReadBranchRecords
	// BpfGetNsCurrentPidTgid helper function
	BpfGetNsCurrentPidTgid
	// BpfXdpOutput helper function
	BpfXdpOutput
	// BpfGetNetnsCookie helper function
	BpfGetNetnsCookie
	// BpfGetCurrentAncestorCgroupID helper function
	BpfGetCurrentAncestorCgroupID
	// BpfSkAssign helper function
	BpfSkAssign
	// BpfKtimeGetBootNs helper function
	BpfKtimeGetBootNs
	// BpfSeqPrintf helper function
	BpfSeqPrintf
	// BpfSeqWrite helper function
	BpfSeqWrite
	// BpfSkCgroupID helper function
	BpfSkCgroupID
	// BpfSkAncestorCgroupID helper function
	BpfSkAncestorCgroupID
	// BpfRingbufOutput helper function
	BpfRingbufOutput
	// BpfRingbufReserve helper function
	BpfRingbufReserve
	// BpfRingbufSubmit helper function
	BpfRingbufSubmit
	// BpfRingbufDiscard helper function
	BpfRingbufDiscard
	// BpfRingbufQuery helper function
	BpfRingbufQuery
	// BpfCsumLevel helper function
	BpfCsumLevel
	// BpfSkcToTCP6Sock helper function
	BpfSkcToTCP6Sock
	// BpfSkcToTCPSock helper function
	BpfSkcToTCPSock
	// BpfSkcToTCPTimewaitSock helper function
	BpfSkcToTCPTimewaitSock
	// BpfSkcToTCPRequestSock helper function
	BpfSkcToTCPRequestSock
	// BpfSkcToUDP6Sock helper function
	BpfSkcToUDP6Sock
	// BpfGetTaskStack helper function
	BpfGetTaskStack
	// BpfLoadHdrOpt helper function
	BpfLoadHdrOpt
	// BpfStoreHdrOpt helper function
	BpfStoreHdrOpt
	// BpfReserveHdrOpt helper function
	BpfReserveHdrOpt
	// BpfInodeStorageGet helper function
	BpfInodeStorageGet
	// BpfInodeStorageDelete helper function
	BpfInodeStorageDelete
	// BpfDPath helper function
	BpfDPath
	// BpfCopyFromUser helper function
	BpfCopyFromUser
	// BpfSnprintfBtf helper function
	BpfSnprintfBtf
	// BpfSeqPrintfBtf helper function
	BpfSeqPrintfBtf
	// BpfSkbCgroupClassid helper function
	BpfSkbCgroupClassid
	// BpfRedirectNeigh helper function
	BpfRedirectNeigh
	// BpfPerCPUPtr helper function
	BpfPerCPUPtr
	// BpfThisCPUPtr helper function
	BpfThisCPUPtr
	// BpfRedirectPeer helper function
	BpfRedirectPeer
	// BpfTaskStorageGet helper function
	BpfTaskStorageGet
	// BpfTaskStorageDelete helper function
	BpfTaskStorageDelete
	// BpfGetCurrentTaskBtf helper function
	BpfGetCurrentTaskBtf
	// BpfBprmOptsSet helper function
	BpfBprmOptsSet
	// BpfKtimeGetCoarseNs helper function
	BpfKtimeGetCoarseNs
	// BpfImaInodeHash helper function
	BpfImaInodeHash
	// BpfSockFromFile helper function
	BpfSockFromFile
	// BpfCheckMtu helper function
	BpfCheckMtu
	// BpfForEachMapElem helper function
	BpfForEachMapElem
	// BpfSnprintf helper function
	BpfSnprintf
)

func (BPFHelperFunc) String

func (f BPFHelperFunc) String() string

type BPFHelperFuncList

type BPFHelperFuncList []BPFHelperFunc

BPFHelperFuncList represents a list of eBPF helpers

func (BPFHelperFuncList) MarshalJSON

func (l BPFHelperFuncList) MarshalJSON() ([]byte, error)

func (BPFHelperFuncList) String

func (l BPFHelperFuncList) String() string

type BPFMap

type BPFMap struct {
	ID   uint32     `json:"id"`
	Type BPFMapType `json:"type,omitempty"`
	Name string     `json:"name,omitempty"`
}

BPFMap represents a BPF map

func (*BPFMap) UnmarshalBinary

func (m *BPFMap) UnmarshalBinary(data []byte) (int, error)

UnmarshalBinary unmarshalls a binary representation of itself

type BPFMapType

type BPFMapType uint32

BPFMapType is used to define map type constants

const (
	// BpfMapTypeUnspec map type
	BpfMapTypeUnspec BPFMapType = iota
	// BpfMapTypeHash map type
	BpfMapTypeHash
	// BpfMapTypeArray map type
	BpfMapTypeArray
	// BpfMapTypeProgArray map type
	BpfMapTypeProgArray
	// BpfMapTypePerfEventArray map type
	BpfMapTypePerfEventArray
	// BpfMapTypePercpuHash map type
	BpfMapTypePercpuHash
	// BpfMapTypePercpuArray map type
	BpfMapTypePercpuArray
	// BpfMapTypeStackTrace map type
	BpfMapTypeStackTrace
	// BpfMapTypeCgroupArray map type
	BpfMapTypeCgroupArray
	// BpfMapTypeLruHash map type
	BpfMapTypeLruHash
	// BpfMapTypeLruPercpuHash map type
	BpfMapTypeLruPercpuHash
	// BpfMapTypeLpmTrie map type
	BpfMapTypeLpmTrie
	// BpfMapTypeArrayOfMaps map type
	BpfMapTypeArrayOfMaps
	// BpfMapTypeHashOfMaps map type
	BpfMapTypeHashOfMaps
	// BpfMapTypeDevmap map type
	BpfMapTypeDevmap
	// BpfMapTypeSockmap map type
	BpfMapTypeSockmap
	// BpfMapTypeCPUmap map type
	BpfMapTypeCPUmap
	// BpfMapTypeXskmap map type
	BpfMapTypeXskmap
	// BpfMapTypeSockhash map type
	BpfMapTypeSockhash
	// BpfMapTypeCgroupStorage map type
	BpfMapTypeCgroupStorage
	// BpfMapTypeReuseportSockarray map type
	BpfMapTypeReuseportSockarray
	// BpfMapTypePercpuCgroupStorage map type
	BpfMapTypePercpuCgroupStorage
	// BpfMapTypeQueue map type
	BpfMapTypeQueue
	// BpfMapTypeStack map type
	BpfMapTypeStack
	// BpfMapTypeSkStorage map type
	BpfMapTypeSkStorage
	// BpfMapTypeDevmapHash map type
	BpfMapTypeDevmapHash
	// BpfMapTypeStructOps map type
	BpfMapTypeStructOps
	// BpfMapTypeRingbuf map type
	BpfMapTypeRingbuf
	// BpfMapTypeInodeStorage map type
	BpfMapTypeInodeStorage
	// BpfMapTypeTaskStorage map type
	BpfMapTypeTaskStorage
)

func (BPFMapType) MarshalJSON

func (t BPFMapType) MarshalJSON() ([]byte, error)

func (BPFMapType) String

func (t BPFMapType) String() string

type BPFProgram

type BPFProgram struct {
	ID         uint32            `json:"id"`
	Type       BPFProgramType    `json:"type,omitempty"`
	AttachType BPFAttachType     `json:"attach_type,omitempty"`
	Helpers    BPFHelperFuncList `json:"helpers,omitempty"`
	Name       string            `json:"name,omitempty"`
	Tag        string            `json:"tag,omitempty"`
}

BPFProgram represents a BPF program

func (*BPFProgram) UnmarshalBinary

func (p *BPFProgram) UnmarshalBinary(data []byte) (int, error)

UnmarshalBinary unmarshalls a binary representation of itself

type BPFProgramType

type BPFProgramType uint32

BPFProgramType is used to define program type constants

const (
	// BpfProgTypeUnspec program type
	BpfProgTypeUnspec BPFProgramType = iota
	// BpfProgTypeSocketFilter program type
	BpfProgTypeSocketFilter
	// BpfProgTypeKprobe program type
	BpfProgTypeKprobe
	// BpfProgTypeSchedCls program type
	BpfProgTypeSchedCls
	// BpfProgTypeSchedAct program type
	BpfProgTypeSchedAct
	// BpfProgTypeTracepoint program type
	BpfProgTypeTracepoint
	// BpfProgTypeXdp program type
	BpfProgTypeXdp
	// BpfProgTypePerfEvent program type
	BpfProgTypePerfEvent
	// BpfProgTypeCgroupSkb program type
	BpfProgTypeCgroupSkb
	// BpfProgTypeCgroupSock program type
	BpfProgTypeCgroupSock
	// BpfProgTypeLwtIn program type
	BpfProgTypeLwtIn
	// BpfProgTypeLwtOut program type
	BpfProgTypeLwtOut
	// BpfProgTypeLwtXmit program type
	BpfProgTypeLwtXmit
	// BpfProgTypeSockOps program type
	BpfProgTypeSockOps
	// BpfProgTypeSkSkb program type
	BpfProgTypeSkSkb
	// BpfProgTypeCgroupDevice program type
	BpfProgTypeCgroupDevice
	// BpfProgTypeSkMsg program type
	BpfProgTypeSkMsg
	// BpfProgTypeRawTracepoint program type
	BpfProgTypeRawTracepoint
	// BpfProgTypeCgroupSockAddr program type
	BpfProgTypeCgroupSockAddr
	// BpfProgTypeLwtSeg6local program type
	BpfProgTypeLwtSeg6local
	// BpfProgTypeLircMode2 program type
	BpfProgTypeLircMode2
	// BpfProgTypeSkReuseport program type
	BpfProgTypeSkReuseport
	// BpfProgTypeFlowDissector program type
	BpfProgTypeFlowDissector
	// BpfProgTypeCgroupSysctl program type
	BpfProgTypeCgroupSysctl
	// BpfProgTypeRawTracepointWritable program type
	BpfProgTypeRawTracepointWritable
	// BpfProgTypeCgroupSockopt program type
	BpfProgTypeCgroupSockopt
	// BpfProgTypeTracing program type
	BpfProgTypeTracing
	// BpfProgTypeStructOps program type
	BpfProgTypeStructOps
	// BpfProgTypeExt program type
	BpfProgTypeExt
	// BpfProgTypeLsm program type
	BpfProgTypeLsm
	// BpfProgTypeSkLookup program type
	BpfProgTypeSkLookup
)

func (BPFProgramType) MarshalJSON

func (t BPFProgramType) MarshalJSON() ([]byte, error)

func (BPFProgramType) String

func (t BPFProgramType) String() string

type CgroupContext

type CgroupContext struct {
	SubsystemID CgroupSubsystemID `json:"-"`
	ID          uint32            `json:"id"`
	Name        string            `json:"name,omitempty"`
}

CgroupContext is used to parse the cgroup context of an event

func (*CgroupContext) UnmarshalBinary

func (cc *CgroupContext) UnmarshalBinary(data []byte) (int, error)

UnmarshalBinary unmarshalls a binary representation of itself

type CgroupSubsystemID

type CgroupSubsystemID uint32

CgroupSubsystemID is used to parse a cgroup subsystem ID

const (
	CgroupSubsystemCPUSet CgroupSubsystemID = iota
	CgroupSubsystemCPU
	CgroupSubsystemCPUAcct
	CgroupSubsystemIO
	CgroupSubsystemMemory
	CgroupSubsystemDevices
	CgroupSubsystemFreezer
	CgroupSubsystemNetCLS
	CgroupSubsystemPerfEvent
	CgroupSubsystemNetPrio
	CgroupSubsystemHugeTLB
	CgroupSubsystemPIDs
	CgroupSubsystemRDMA
	CgroupSubsystemMisc
	CgroupSubsystemMax
)

func (CgroupSubsystemID) MarshalJSON

func (id CgroupSubsystemID) MarshalJSON() ([]byte, error)

func (CgroupSubsystemID) String

func (id CgroupSubsystemID) String() string

type Cgroups

Cgroups is used to wrap the CgroupContext and ease serialization

func (Cgroups) MarshalJSON

func (c Cgroups) MarshalJSON() ([]byte, error)

type CredentialsContext

type CredentialsContext struct {
	UID            uint32 `json:"uid"`
	GID            uint32 `json:"gid"`
	SUID           uint32 `json:"suid"`
	SGID           uint32 `json:"sgid"`
	EUID           uint32 `json:"euid"`
	EGID           uint32 `json:"egid"`
	FSUID          uint32 `json:"fsuid"`
	FSGID          uint32 `json:"fsgid"`
	SecureBits     uint32 `json:"secure_bits"`
	CapInheritable uint64 `json:"cap_inheritable"`
	CapPermitted   uint64 `json:"cap_permitted"`
	CapEffective   uint64 `json:"cap_effective"`
	CapBSET        uint64 `json:"cap_bset"`
	CapAmbiant     uint64 `json:"cap_ambiant"`
}

CredentialsContext is used to parse the credentials context of an event

func (*CredentialsContext) UnmarshalBinary

func (cc *CredentialsContext) UnmarshalBinary(data []byte) (int, error)

UnmarshalBinary unmarshalls a binary representation of itself

type DeleteModuleEvent

type DeleteModuleEvent struct {
	Name string `json:"name"`
}

DeleteModuleEvent is used to parse an delete_module event

func (*DeleteModuleEvent) UnmarshallBinary

func (dm *DeleteModuleEvent) UnmarshallBinary(data []byte) (int, error)

UnmarshallBinary unmarshalls a binary representation of itself

type DeleteModuleEventSerializer

type DeleteModuleEventSerializer struct {
	*DeleteModuleEvent
}

DeleteModuleEventSerializer is used to serialize DeleteModuleEvent easyjson:json

func NewDeleteModuleSerializer

func NewDeleteModuleSerializer(dm *DeleteModuleEvent) *DeleteModuleEventSerializer

NewDeleteModuleSerializer returns a new instance of DeleteModuleEventSerializer

func (DeleteModuleEventSerializer) MarshalEasyJSON

func (v DeleteModuleEventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*DeleteModuleEventSerializer) UnmarshalEasyJSON

func (v *DeleteModuleEventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type Event

type Event struct {
	Kernel  KernelEvent
	Process ProcessContext

	// audit events
	InitModule     InitModuleEvent
	DeleteModule   DeleteModuleEvent
	BPFEvent       BPFEvent
	BPFFilterEvent BPFFilterEvent
	PTraceEvent    PTraceEvent
	KProbeEvent    KProbeEvent
	SysCtlEvent    SysCtlEvent

	// krie events
	HookedSyscallEvent   HookedSyscallEvent
	EventCheckEvent      EventCheckEvent
	KernelParameterEvent KernelParameterEvent
	RegisterCheckEvent   RegisterCheckEvent
}

Event is used to parse the events sent from kernel space

func NewEvent

func NewEvent() *Event

NewEvent returns a new Event instance

func (*Event) MarshalJSON

func (e *Event) MarshalJSON() ([]byte, error)

func (Event) String

func (e Event) String() string

type EventCheckEvent

type EventCheckEvent struct {
	CheckedEventType EventType `json:"checked_event_type"`
}

EventCheckEvent represents a event_check event

func (*EventCheckEvent) UnmarshallBinary

func (e *EventCheckEvent) UnmarshallBinary(data []byte) (int, error)

UnmarshallBinary unmarshalls a binary representation of itself

type EventCheckEventSerializer

type EventCheckEventSerializer struct {
	*EventCheckEvent
}

EventCheckEventSerializer is used to serialize EventCheckEvent easyjson:json

func NewEventCheckEventSerializer

func NewEventCheckEventSerializer(e *EventCheckEvent) *EventCheckEventSerializer

NewEventCheckEventSerializer returns a new instance of PtraceEventSerializer

func (EventCheckEventSerializer) MarshalEasyJSON

func (v EventCheckEventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*EventCheckEventSerializer) UnmarshalEasyJSON

func (v *EventCheckEventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type EventSerializer

type EventSerializer struct {
	*KernelEventSerializer    `json:"event,omitempty"`
	*ProcessContextSerializer `json:"process,omitempty"`

	// audit events
	*InitModuleEventSerializer   `json:"init_module,omitempty"`
	*DeleteModuleEventSerializer `json:"delete_module,omitempty"`
	*BPFEventSerializer          `json:"bpf,omitempty"`
	*BPFFilterEventSerializer    `json:"bpf_filter,omitempty"`
	*PtraceEventSerializer       `json:"ptrace,omitempty"`
	*KProbeEventSerializer       `json:"kprobe,omitempty"`
	*SysCtlEventEventSerializer  `json:"sysctl,omitempty"`

	// krie events
	*HookedSyscallEventSerializer   `json:"hooked_syscall,omitempty"`
	*EventCheckEventSerializer      `json:"event_check,omitempty"`
	*KernelParameterEventSerializer `json:"kernel_parameter,omitempty"`
	*RegisterCheckEventSerializer   `json:"register_check,omitempty"`
}

EventSerializer is used to serialize Event easyjson:json

func NewEventSerializer

func NewEventSerializer(event *Event) *EventSerializer

NewEventSerializer returns a new EventSerializer instance for the provided Event

func (EventSerializer) MarshalEasyJSON

func (v EventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*EventSerializer) UnmarshalEasyJSON

func (v *EventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type EventType

type EventType uint32

EventType describes the type of an event sent from the kernel

const (
	// UnknownEventType unknow event
	UnknownEventType EventType = iota
	// InitModuleEventType is the event type of an init module event
	InitModuleEventType
	// DeleteModuleEventType is the event type of a delete module event
	DeleteModuleEventType
	// BPFEventType is the event type of a BPF event
	BPFEventType
	// BPFFilterEventType is the event type of a bpf_filter event
	BPFFilterEventType
	// PTraceEventType is the event type of a ptrace event
	PTraceEventType
	// KProbeEventType is the event type of a kprobe event
	KProbeEventType
	// SysCtlEventType is the event type of a sysctl event
	SysCtlEventType
	// HookedSyscallTableEventType is the event type of a hooked_syscall_table event
	HookedSyscallTableEventType
	// HookedSyscallEventType is the event type of a hooked_syscall event
	HookedSyscallEventType
	// EventCheckEventType is the event type of an event_check event
	EventCheckEventType
	// KernelParameterEventType is the event type of a kernel_parameter event
	KernelParameterEventType
	// PeriodicKernelParameterEventType is the event type of a periodic_kernel_parameter event
	PeriodicKernelParameterEventType
	// RegisterCheckEventType is the event type of a register_check event
	RegisterCheckEventType
	// MaxEventType is used internally to get the maximum number of events.
	MaxEventType
)

func ParseEventType

func ParseEventType(input string) EventType

ParseEventType returns an event type from its string representation

func (EventType) MarshalJSON

func (t EventType) MarshalJSON() ([]byte, error)

func (EventType) String

func (t EventType) String() string

type EventTypeList

type EventTypeList []EventType

EventTypeList is a list of EventType

func (*EventTypeList) Contains

func (etl *EventTypeList) Contains(et EventType) bool

Contains return true if the list of event types is empty or if it contains the provided event type

func (*EventTypeList) Insert

func (etl *EventTypeList) Insert(et EventType)

Insert inserts an event type in a list of event type

func (EventTypeList) String

func (etl EventTypeList) String() string

func (*EventTypeList) UnmarshalYAML

func (etl *EventTypeList) UnmarshalYAML(value *yaml.Node) error

UnmarshalYAML parses a string representation of a list of event types

type HookPoint

type HookPoint uint32

HookPoint is used to recognize a hook point from kernel space

func (HookPoint) MarshalJSON

func (hp HookPoint) MarshalJSON() ([]byte, error)

func (HookPoint) String

func (hp HookPoint) String() string

type HookedSyscallEvent

type HookedSyscallEvent struct {
	Syscall      *Syscall     `json:"syscall,omitempty"`
	IA32Syscall  *IA32Syscall `json:"ia_32_syscall,omitempty"`
	SyscallTable SyscallTable `json:"syscall_table"`

	InitialHandler KernelSymbol `json:"initial_handler"`
	NewHandler     KernelSymbol `json:"new_handler"`
}

HookedSyscallEvent represents a hooked_syscall or hooked_syscall_table event

func (*HookedSyscallEvent) UnmarshallBinary

func (e *HookedSyscallEvent) UnmarshallBinary(data []byte) (int, error)

UnmarshallBinary unmarshalls a binary representation of itself

type HookedSyscallEventSerializer

type HookedSyscallEventSerializer struct {
	*HookedSyscallEvent
}

HookedSyscallEventSerializer is used to serialize HookedSyscallEvent easyjson:json

func NewHookedSyscallEventSerializer

func NewHookedSyscallEventSerializer(e *HookedSyscallEvent) *HookedSyscallEventSerializer

NewHookedSyscallEventSerializer returns a new instance of HookedSyscallEventSerializer

func (HookedSyscallEventSerializer) MarshalEasyJSON

func (v HookedSyscallEventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*HookedSyscallEventSerializer) UnmarshalEasyJSON

func (v *HookedSyscallEventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type IA32Syscall

type IA32Syscall int

IA32Syscall represents a IA32Syscall identifier

const (
	IA32SysRestartSyscall             IA32Syscall = 0
	IA32SysExit                       IA32Syscall = 1
	IA32SysFork                       IA32Syscall = 2
	IA32SysRead                       IA32Syscall = 3
	IA32SysWrite                      IA32Syscall = 4
	IA32CompatSysOpen                 IA32Syscall = 5
	IA32SysClose                      IA32Syscall = 6
	IA32SysWaitpid                    IA32Syscall = 7
	IA32SysCreat                      IA32Syscall = 8
	IA32SysLink                       IA32Syscall = 9
	IA32SysUnlink                     IA32Syscall = 10
	IA32CompatSysExecve               IA32Syscall = 11
	IA32SysChdir                      IA32Syscall = 12
	IA32SysTime32                     IA32Syscall = 13
	IA32SysMknod                      IA32Syscall = 14
	IA32SysChmod                      IA32Syscall = 15
	IA32SysLchown16                   IA32Syscall = 16
	IA32Break                         IA32Syscall = 17
	IA32SysStat                       IA32Syscall = 18
	IA32CompatSysLseek                IA32Syscall = 19
	IA32SysGetpid                     IA32Syscall = 20
	IA32SysMount                      IA32Syscall = 21
	IA32SysOldumount                  IA32Syscall = 22
	IA32SysSetuid16                   IA32Syscall = 23
	IA32SysGetuid16                   IA32Syscall = 24
	IA32SysStime32                    IA32Syscall = 25
	IA32CompatSysPtrace               IA32Syscall = 26
	IA32SysAlarm                      IA32Syscall = 27
	IA32SysFstat                      IA32Syscall = 28
	IA32SysPause                      IA32Syscall = 29
	IA32SysUtime32                    IA32Syscall = 30
	IA32Stty                          IA32Syscall = 31
	IA32Gtty                          IA32Syscall = 32
	IA32SysAccess                     IA32Syscall = 33
	IA32SysNice                       IA32Syscall = 34
	IA32Ftime                         IA32Syscall = 35
	IA32SysSync                       IA32Syscall = 36
	IA32SysKill                       IA32Syscall = 37
	IA32SysRename                     IA32Syscall = 38
	IA32SysMkdir                      IA32Syscall = 39
	IA32SysRmdir                      IA32Syscall = 40
	IA32SysDup                        IA32Syscall = 41
	IA32SysPipe                       IA32Syscall = 42
	IA32CompatSysTimes                IA32Syscall = 43
	IA32Prof                          IA32Syscall = 44
	IA32SysBrk                        IA32Syscall = 45
	IA32SysSetgid16                   IA32Syscall = 46
	IA32SysGetgid16                   IA32Syscall = 47
	IA32SysSignal                     IA32Syscall = 48
	IA32SysGeteuid16                  IA32Syscall = 49
	IA32SysGetegid16                  IA32Syscall = 50
	IA32SysAcct                       IA32Syscall = 51
	IA32SysUmount                     IA32Syscall = 52
	IA32Lock                          IA32Syscall = 53
	IA32CompatSysIoctl                IA32Syscall = 54
	IA32CompatSysFcntl64              IA32Syscall = 55
	IA32Mpx                           IA32Syscall = 56
	IA32SysSetpgid                    IA32Syscall = 57
	IA32Ulimit                        IA32Syscall = 58
	IA32SysOlduname                   IA32Syscall = 59
	IA32SysUmask                      IA32Syscall = 60
	IA32SysChroot                     IA32Syscall = 61
	IA32CompatSysUstat                IA32Syscall = 62
	IA32SysDup2                       IA32Syscall = 63
	IA32SysGetppid                    IA32Syscall = 64
	IA32SysGetpgrp                    IA32Syscall = 65
	IA32SysSetsid                     IA32Syscall = 66
	IA32CompatSysSigaction            IA32Syscall = 67
	IA32SysSgetmask                   IA32Syscall = 68
	IA32SysSsetmask                   IA32Syscall = 69
	IA32SysSetreuid16                 IA32Syscall = 70
	IA32SysSetregid16                 IA32Syscall = 71
	IA32SysSigsuspend                 IA32Syscall = 72
	IA32CompatSysSigpending           IA32Syscall = 73
	IA32SysSethostname                IA32Syscall = 74
	IA32CompatSysSetrlimit            IA32Syscall = 75
	IA32CompatSysOldGetrlimit         IA32Syscall = 76
	IA32CompatSysGetrusage            IA32Syscall = 77
	IA32CompatSysGettimeofday         IA32Syscall = 78
	IA32CompatSysSettimeofday         IA32Syscall = 79
	IA32SysGetgroups16                IA32Syscall = 80
	IA32SysSetgroups16                IA32Syscall = 81
	IA32CompatSysOldSelect            IA32Syscall = 82
	IA32SysSymlink                    IA32Syscall = 83
	IA32SysLstat                      IA32Syscall = 84
	IA32SysReadlink                   IA32Syscall = 85
	IA32SysUselib                     IA32Syscall = 86
	IA32SysSwapon                     IA32Syscall = 87
	IA32SysReboot                     IA32Syscall = 88
	IA32CompatSysOldReaddir           IA32Syscall = 89
	IA32CompatSysIa32Mmap             IA32Syscall = 90
	IA32SysMunmap                     IA32Syscall = 91
	IA32CompatSysTruncate             IA32Syscall = 92
	IA32CompatSysFtruncate            IA32Syscall = 93
	IA32SysFchmod                     IA32Syscall = 94
	IA32SysFchown16                   IA32Syscall = 95
	IA32SysGetpriority                IA32Syscall = 96
	IA32SysSetpriority                IA32Syscall = 97
	IA32Profil                        IA32Syscall = 98
	IA32CompatSysStatfs               IA32Syscall = 99
	IA32CompatSysFstatfs              IA32Syscall = 100
	IA32SysIoperm                     IA32Syscall = 101
	IA32CompatSysSocketcall           IA32Syscall = 102
	IA32SysSyslog                     IA32Syscall = 103
	IA32CompatSysSetitimer            IA32Syscall = 104
	IA32CompatSysGetitimer            IA32Syscall = 105
	IA32CompatSysStat                 IA32Syscall = 106
	IA32CompatSysLstat                IA32Syscall = 107
	IA32CompatSysFstat                IA32Syscall = 108
	IA32SysUname                      IA32Syscall = 109
	IA32SysIopl                       IA32Syscall = 110
	IA32SysVhangup                    IA32Syscall = 111
	IA32Idle                          IA32Syscall = 112
	IA32CompatSysWait4                IA32Syscall = 114
	IA32SysSwapoff                    IA32Syscall = 115
	IA32CompatSysSysinfo              IA32Syscall = 116
	IA32CompatSysIpc                  IA32Syscall = 117
	IA32SysFsync                      IA32Syscall = 118
	IA32CompatSysSigreturn            IA32Syscall = 119
	IA32CompatSysIa32Clone            IA32Syscall = 120
	IA32SysSetdomainname              IA32Syscall = 121
	IA32SysNewUname                   IA32Syscall = 122
	IA32SysModifyLdt                  IA32Syscall = 123
	IA32SysAdjtimexTime32             IA32Syscall = 124
	IA32SysMprotect                   IA32Syscall = 125
	IA32CompatSysSigprocmask          IA32Syscall = 126
	IA32CreateModule                  IA32Syscall = 127
	IA32SysInitModule                 IA32Syscall = 128
	IA32SysDeleteModule               IA32Syscall = 129
	IA32GetKernelSyms                 IA32Syscall = 130
	IA32SysQuotactl                   IA32Syscall = 131
	IA32SysGetpgid                    IA32Syscall = 132
	IA32SysFchdir                     IA32Syscall = 133
	IA32SysSysfs                      IA32Syscall = 135
	IA32SysPersonality                IA32Syscall = 136
	IA32AfsSyscall                    IA32Syscall = 137
	IA32SysSetfsuid16                 IA32Syscall = 138
	IA32SysSetfsgid16                 IA32Syscall = 139
	IA32SysLlseek                     IA32Syscall = 140
	IA32CompatSysGetdents             IA32Syscall = 141
	IA32CompatSysSelect               IA32Syscall = 142
	IA32SysFlock                      IA32Syscall = 143
	IA32SysMsync                      IA32Syscall = 144
	IA32SysReadv                      IA32Syscall = 145
	IA32SysWritev                     IA32Syscall = 146
	IA32SysGetsid                     IA32Syscall = 147
	IA32SysFdatasync                  IA32Syscall = 148
	IA32SysMlock                      IA32Syscall = 150
	IA32SysMunlock                    IA32Syscall = 151
	IA32SysMlockall                   IA32Syscall = 152
	IA32SysMunlockall                 IA32Syscall = 153
	IA32SysSchedSetparam              IA32Syscall = 154
	IA32SysSchedGetparam              IA32Syscall = 155
	IA32SysSchedSetscheduler          IA32Syscall = 156
	IA32SysSchedGetscheduler          IA32Syscall = 157
	IA32SysSchedYield                 IA32Syscall = 158
	IA32SysSchedGetPriorityMax        IA32Syscall = 159
	IA32SysSchedGetPriorityMin        IA32Syscall = 160
	IA32SysSchedRrGetIntervalTime32   IA32Syscall = 161
	IA32SysNanosleepTime32            IA32Syscall = 162
	IA32SysMremap                     IA32Syscall = 163
	IA32SysSetresuid16                IA32Syscall = 164
	IA32SysGetresuid16                IA32Syscall = 165
	IA32QueryModule                   IA32Syscall = 167
	IA32SysPoll                       IA32Syscall = 168
	IA32Nfsservctl                    IA32Syscall = 169
	IA32SysSetresgid16                IA32Syscall = 170
	IA32SysGetresgid16                IA32Syscall = 171
	IA32SysPrctl                      IA32Syscall = 172
	IA32CompatSysRtSigreturn          IA32Syscall = 173
	IA32CompatSysRtSigaction          IA32Syscall = 174
	IA32CompatSysRtSigprocmask        IA32Syscall = 175
	IA32CompatSysRtSigpending         IA32Syscall = 176
	IA32CompatSysRtSigtimedwaitTime32 IA32Syscall = 177
	IA32CompatSysRtSigqueueinfo       IA32Syscall = 178
	IA32CompatSysRtSigsuspend         IA32Syscall = 179
	IA32SysIa32Pread64                IA32Syscall = 180
	IA32SysIa32Pwrite64               IA32Syscall = 181
	IA32SysChown16                    IA32Syscall = 182
	IA32SysGetcwd                     IA32Syscall = 183
	IA32SysCapget                     IA32Syscall = 184
	IA32SysCapset                     IA32Syscall = 185
	IA32CompatSysSigaltstack          IA32Syscall = 186
	IA32CompatSysSendfile             IA32Syscall = 187
	IA32Getpmsg                       IA32Syscall = 188
	IA32Putpmsg                       IA32Syscall = 189
	IA32SysVfork                      IA32Syscall = 190
	IA32CompatSysGetrlimit            IA32Syscall = 191
	IA32SysMmapPgoff                  IA32Syscall = 192
	IA32SysIa32Truncate64             IA32Syscall = 193
	IA32SysIa32Ftruncate64            IA32Syscall = 194
	IA32CompatSysIa32Stat64           IA32Syscall = 195
	IA32CompatSysIa32Lstat64          IA32Syscall = 196
	IA32CompatSysIa32Fstat64          IA32Syscall = 197
	IA32SysLchown                     IA32Syscall = 198
	IA32SysGetuid                     IA32Syscall = 199
	IA32SysGetgid                     IA32Syscall = 200
	IA32SysGeteuid                    IA32Syscall = 201
	IA32SysGetegid                    IA32Syscall = 202
	IA32SysSetreuid                   IA32Syscall = 203
	IA32SysSetregid                   IA32Syscall = 204
	IA32SysGetgroups                  IA32Syscall = 205
	IA32SysSetgroups                  IA32Syscall = 206
	IA32SysFchown                     IA32Syscall = 207
	IA32SysSetresuid                  IA32Syscall = 208
	IA32SysGetresuid                  IA32Syscall = 209
	IA32SysSetresgid                  IA32Syscall = 210
	IA32SysGetresgid                  IA32Syscall = 211
	IA32SysChown                      IA32Syscall = 212
	IA32SysSetuid                     IA32Syscall = 213
	IA32SysSetgid                     IA32Syscall = 214
	IA32SysSetfsuid                   IA32Syscall = 215
	IA32SysSetfsgid                   IA32Syscall = 216
	IA32SysPivotRoot                  IA32Syscall = 217
	IA32SysMincore                    IA32Syscall = 218
	IA32SysMadvise                    IA32Syscall = 219
	IA32SysGetdents64                 IA32Syscall = 220
	IA32CompatSysFcntl642             IA32Syscall = 221
	IA32SysGettid                     IA32Syscall = 224
	IA32SysIa32Readahead              IA32Syscall = 225
	IA32SysSetxattr                   IA32Syscall = 226
	IA32SysLsetxattr                  IA32Syscall = 227
	IA32SysFsetxattr                  IA32Syscall = 228
	IA32SysGetxattr                   IA32Syscall = 229
	IA32SysLgetxattr                  IA32Syscall = 230
	IA32SysFgetxattr                  IA32Syscall = 231
	IA32SysListxattr                  IA32Syscall = 232
	IA32SysLlistxattr                 IA32Syscall = 233
	IA32SysFlistxattr                 IA32Syscall = 234
	IA32SysRemovexattr                IA32Syscall = 235
	IA32SysLremovexattr               IA32Syscall = 236
	IA32SysFremovexattr               IA32Syscall = 237
	IA32SysTkill                      IA32Syscall = 238
	IA32SysSendfile64                 IA32Syscall = 239
	IA32SysFutexTime32                IA32Syscall = 240
	IA32CompatSysSchedSetaffinity     IA32Syscall = 241
	IA32CompatSysSchedGetaffinity     IA32Syscall = 242
	IA32SysSetThreadArea              IA32Syscall = 243
	IA32SysGetThreadArea              IA32Syscall = 244
	IA32CompatSysIoSetup              IA32Syscall = 245
	IA32SysIoDestroy                  IA32Syscall = 246
	IA32SysIoGeteventsTime32          IA32Syscall = 247
	IA32CompatSysIoSubmit             IA32Syscall = 248
	IA32SysIoCancel                   IA32Syscall = 249
	IA32SysIa32Fadvise64              IA32Syscall = 250
	IA32SysExitGroup                  IA32Syscall = 252
	IA32CompatSysLookupDcookie        IA32Syscall = 253
	IA32SysEpollCreate                IA32Syscall = 254
	IA32SysEpollCtl                   IA32Syscall = 255
	IA32SysEpollWait                  IA32Syscall = 256
	IA32SysRemapFilePages             IA32Syscall = 257
	IA32SysSetTidAddress              IA32Syscall = 258
	IA32CompatSysTimerCreate          IA32Syscall = 259
	IA32SysTimerSettime32             IA32Syscall = 260
	IA32SysTimerGettime32             IA32Syscall = 261
	IA32SysTimerGetoverrun            IA32Syscall = 262
	IA32SysTimerDelete                IA32Syscall = 263
	IA32SysClockSettime32             IA32Syscall = 264
	IA32SysClockGettime32             IA32Syscall = 265
	IA32SysClockGetresTime32          IA32Syscall = 266
	IA32SysClockNanosleepTime32       IA32Syscall = 267
	IA32CompatSysStatfs64             IA32Syscall = 268
	IA32CompatSysFstatfs64            IA32Syscall = 269
	IA32SysTgkill                     IA32Syscall = 270
	IA32SysUtimesTime32               IA32Syscall = 271
	IA32SysIa32Fadvise6464            IA32Syscall = 272
	IA32Vserver                       IA32Syscall = 273
	IA32SysMbind                      IA32Syscall = 274
	IA32SysGetMempolicy               IA32Syscall = 275
	IA32SysSetMempolicy               IA32Syscall = 276
	IA32CompatSysMqOpen               IA32Syscall = 277
	IA32SysMqUnlink                   IA32Syscall = 278
	IA32SysMqTimedsendTime32          IA32Syscall = 279
	IA32SysMqTimedreceiveTime32       IA32Syscall = 280
	IA32CompatSysMqNotify             IA32Syscall = 281
	IA32CompatSysMqGetsetattr         IA32Syscall = 282
	IA32CompatSysKexecLoad            IA32Syscall = 283
	IA32CompatSysWaitid               IA32Syscall = 284
	IA32SysAddKey                     IA32Syscall = 286
	IA32SysRequestKey                 IA32Syscall = 287
	IA32CompatSysKeyctl               IA32Syscall = 288
	IA32SysIoprioSet                  IA32Syscall = 289
	IA32SysIoprioGet                  IA32Syscall = 290
	IA32SysInotifyInit                IA32Syscall = 291
	IA32SysInotifyAddWatch            IA32Syscall = 292
	IA32SysInotifyRmWatch             IA32Syscall = 293
	IA32SysMigratePages               IA32Syscall = 294
	IA32CompatSysOpenat               IA32Syscall = 295
	IA32SysMkdirat                    IA32Syscall = 296
	IA32SysMknodat                    IA32Syscall = 297
	IA32SysFchownat                   IA32Syscall = 298
	IA32SysFutimesatTime32            IA32Syscall = 299
	IA32CompatSysIa32Fstatat64        IA32Syscall = 300
	IA32SysUnlinkat                   IA32Syscall = 301
	IA32SysRenameat                   IA32Syscall = 302
	IA32SysLinkat                     IA32Syscall = 303
	IA32SysSymlinkat                  IA32Syscall = 304
	IA32SysReadlinkat                 IA32Syscall = 305
	IA32SysFchmodat                   IA32Syscall = 306
	IA32SysFaccessat                  IA32Syscall = 307
	IA32CompatSysPselect6Time32       IA32Syscall = 308
	IA32CompatSysPpollTime32          IA32Syscall = 309
	IA32SysUnshare                    IA32Syscall = 310
	IA32CompatSysSetRobustList        IA32Syscall = 311
	IA32CompatSysGetRobustList        IA32Syscall = 312
	IA32SysSplice                     IA32Syscall = 313
	IA32SysIa32SyncFileRange          IA32Syscall = 314
	IA32SysTee                        IA32Syscall = 315
	IA32SysVmsplice                   IA32Syscall = 316
	IA32SysMovePages                  IA32Syscall = 317
	IA32SysGetcpu                     IA32Syscall = 318
	IA32SysEpollPwait                 IA32Syscall = 319
	IA32SysUtimensatTime32            IA32Syscall = 320
	IA32CompatSysSignalfd             IA32Syscall = 321
	IA32SysTimerfdCreate              IA32Syscall = 322
	IA32SysEventfd                    IA32Syscall = 323
	IA32SysIa32Fallocate              IA32Syscall = 324
	IA32SysTimerfdSettime32           IA32Syscall = 325
	IA32SysTimerfdGettime32           IA32Syscall = 326
	IA32CompatSysSignalfd4            IA32Syscall = 327
	IA32SysEventfd2                   IA32Syscall = 328
	IA32SysEpollCreate1               IA32Syscall = 329
	IA32SysDup3                       IA32Syscall = 330
	IA32SysPipe2                      IA32Syscall = 331
	IA32SysInotifyInit1               IA32Syscall = 332
	IA32CompatSysPreadv               IA32Syscall = 333
	IA32CompatSysPwritev              IA32Syscall = 334
	IA32CompatSysRtTgsigqueueinfo     IA32Syscall = 335
	IA32SysPerfEventOpen              IA32Syscall = 336
	IA32CompatSysRecvmmsgTime32       IA32Syscall = 337
	IA32SysFanotifyInit               IA32Syscall = 338
	IA32CompatSysFanotifyMark         IA32Syscall = 339
	IA32SysPrlimit64                  IA32Syscall = 340
	IA32SysNameToHandleAt             IA32Syscall = 341
	IA32CompatSysOpenByHandleAt       IA32Syscall = 342
	IA32SysClockAdjtime32             IA32Syscall = 343
	IA32SysSyncfs                     IA32Syscall = 344
	IA32CompatSysSendmmsg             IA32Syscall = 345
	IA32SysSetns                      IA32Syscall = 346
	IA32SysProcessVmReadv             IA32Syscall = 347
	IA32SysProcessVmWritev            IA32Syscall = 348
	IA32SysKcmp                       IA32Syscall = 349
	IA32SysFinitModule                IA32Syscall = 350
	IA32SysSchedSetattr               IA32Syscall = 351
	IA32SysSchedGetattr               IA32Syscall = 352
	IA32SysRenameat2                  IA32Syscall = 353
	IA32SysSeccomp                    IA32Syscall = 354
	IA32SysGetrandom                  IA32Syscall = 355
	IA32SysMemfdCreate                IA32Syscall = 356
	IA32SysBpf                        IA32Syscall = 357
	IA32CompatSysExecveat             IA32Syscall = 358
	IA32SysSocket                     IA32Syscall = 359
	IA32SysSocketpair                 IA32Syscall = 360
	IA32SysBind                       IA32Syscall = 361
	IA32SysConnect                    IA32Syscall = 362
	IA32SysListen                     IA32Syscall = 363
	IA32SysAccept4                    IA32Syscall = 364
	IA32SysGetsockopt                 IA32Syscall = 365
	IA32SysSetsockopt                 IA32Syscall = 366
	IA32SysGetsockname                IA32Syscall = 367
	IA32SysGetpeername                IA32Syscall = 368
	IA32SysSendto                     IA32Syscall = 369
	IA32CompatSysSendmsg              IA32Syscall = 370
	IA32CompatSysRecvfrom             IA32Syscall = 371
	IA32CompatSysRecvmsg              IA32Syscall = 372
	IA32SysShutdown                   IA32Syscall = 373
	IA32SysUserfaultfd                IA32Syscall = 374
	IA32SysMembarrier                 IA32Syscall = 375
	IA32SysMlock2                     IA32Syscall = 376
	IA32SysCopyFileRange              IA32Syscall = 377
	IA32CompatSysPreadv2              IA32Syscall = 378
	IA32CompatSysPwritev2             IA32Syscall = 379
	IA32SysPkeyMprotect               IA32Syscall = 380
	IA32SysPkeyAlloc                  IA32Syscall = 381
	IA32SysPkeyFree                   IA32Syscall = 382
	IA32SysStatx                      IA32Syscall = 383
	IA32CompatSysArchPrctl            IA32Syscall = 384
	IA32CompatSysIoPgetevents         IA32Syscall = 385
	IA32SysRseq                       IA32Syscall = 386
	IA32SysSemget                     IA32Syscall = 393
	IA32CompatSysSemctl               IA32Syscall = 394
	IA32SysShmget                     IA32Syscall = 395
	IA32CompatSysShmctl               IA32Syscall = 396
	IA32CompatSysShmat                IA32Syscall = 397
	IA32SysShmdt                      IA32Syscall = 398
	IA32SysMsgget                     IA32Syscall = 399
	IA32CompatSysMsgsnd               IA32Syscall = 400
	IA32CompatSysMsgrcv               IA32Syscall = 401
	IA32CompatSysMsgctl               IA32Syscall = 402
	IA32SysClockGettime               IA32Syscall = 403
	IA32SysClockSettime               IA32Syscall = 404
	IA32SysClockAdjtime               IA32Syscall = 405
	IA32SysClockGetres                IA32Syscall = 406
	IA32SysClockNanosleep             IA32Syscall = 407
	IA32SysTimerGettime               IA32Syscall = 408
	IA32SysTimerSettime               IA32Syscall = 409
	IA32SysTimerfdGettime             IA32Syscall = 410
	IA32SysTimerfdSettime             IA32Syscall = 411
	IA32SysUtimensat                  IA32Syscall = 412
	IA32CompatSysPselect6Time64       IA32Syscall = 413
	IA32CompatSysPpollTime64          IA32Syscall = 414
	IA32SysIoPgetevents               IA32Syscall = 416
	IA32CompatSysRecvmmsgTime64       IA32Syscall = 417
	IA32SysMqTimedsend                IA32Syscall = 418
	IA32SysMqTimedreceive             IA32Syscall = 419
	IA32SysSemtimedop                 IA32Syscall = 420
	IA32CompatSysRtSigtimedwaitTime64 IA32Syscall = 421
	IA32SysFutex                      IA32Syscall = 422
	IA32SysSchedRrGetInterval         IA32Syscall = 423
	IA32SysPidfdSendSignal            IA32Syscall = 424
	IA32SysIoUringSetup               IA32Syscall = 425
	IA32SysIoUringEnter               IA32Syscall = 426
	IA32SysIoUringRegister            IA32Syscall = 427
	IA32SysOpenTree                   IA32Syscall = 428
	IA32SysMoveMount                  IA32Syscall = 429
	IA32SysFsopen                     IA32Syscall = 430
	IA32SysFsconfig                   IA32Syscall = 431
	IA32SysFsmount                    IA32Syscall = 432
	IA32SysFspick                     IA32Syscall = 433
	IA32SysPidfdOpen                  IA32Syscall = 434
	IA32SysClone3                     IA32Syscall = 435
	IA32SysCloseRange                 IA32Syscall = 436
	IA32SysOpenat2                    IA32Syscall = 437
	IA32SysPidfdGetfd                 IA32Syscall = 438
	IA32SysFaccessat2                 IA32Syscall = 439
	IA32SysProcessMadvise             IA32Syscall = 440
	IA32CompatSysEpollPwait2          IA32Syscall = 441
	IA32SysMountSetattr               IA32Syscall = 442
	IA32SysQuotactlFd                 IA32Syscall = 443
	IA32SysLandlockCreateRuleset      IA32Syscall = 444
	IA32SysLandlockAddRule            IA32Syscall = 445
	IA32SysLandlockRestrictSelf       IA32Syscall = 446
	IA32SysMemfdSecret                IA32Syscall = 447
	IA32SysProcessMrelease            IA32Syscall = 448
	IA32SysFutexWaitv                 IA32Syscall = 449
	IA32SysSetMempolicyHomeNode       IA32Syscall = 450
)

Linux IA32Syscall identifiers

func ParseIA32SyscallName

func ParseIA32SyscallName(name string) IA32Syscall

ParseIA32SyscallName returns the IA32Syscall number of the provided IA32Syscall name

func (IA32Syscall) MarshalBinary

func (i IA32Syscall) MarshalBinary() ([]byte, error)

func (IA32Syscall) MarshalText

func (i IA32Syscall) MarshalText() ([]byte, error)

MarshalText maps the IA32Syscall identifier to UTF-8-encoded text and returns the result

func (IA32Syscall) String

func (i IA32Syscall) String() string

func (*IA32Syscall) UnmarshalBinary

func (i *IA32Syscall) UnmarshalBinary(data []byte) error

func (*IA32Syscall) UnmarshalIA32Syscall

func (i *IA32Syscall) UnmarshalIA32Syscall(data []byte) (int, error)

type InitModuleEvent

type InitModuleEvent struct {
	LoadedFromMemory bool   `json:"loaded_from_memory"`
	Name             string `json:"name"`
}

InitModuleEvent is used to parse an init_module event

func (*InitModuleEvent) UnmarshallBinary

func (e *InitModuleEvent) UnmarshallBinary(data []byte) (int, error)

UnmarshallBinary unmarshalls a binary representation of itself

type InitModuleEventSerializer

type InitModuleEventSerializer struct {
	*InitModuleEvent
}

InitModuleEventSerializer is used to serialize InitModuleEvent easyjson:json

func NewInitModuleSerializer

func NewInitModuleSerializer(im *InitModuleEvent) *InitModuleEventSerializer

NewInitModuleSerializer returns a new instance of InitModuleEventSerializer

func (InitModuleEventSerializer) MarshalEasyJSON

func (v InitModuleEventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*InitModuleEventSerializer) UnmarshalEasyJSON

func (v *InitModuleEventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type KProbeCommand

type KProbeCommand uint32

KProbeCommand kprobe command

func (KProbeCommand) MarshalJSON

func (kc KProbeCommand) MarshalJSON() ([]byte, error)

func (KProbeCommand) String

func (kc KProbeCommand) String() string

type KProbeEvent

type KProbeEvent struct {
	Address MemoryPointer `json:"address,omitempty"`
	Symbol  string        `json:"string,omitempty"`
	Command KProbeCommand `json:"command"`
	Type    KProbeType    `json:"type"`
}

KProbeEvent represents a ptrace event

func (*KProbeEvent) UnmarshallBinary

func (e *KProbeEvent) UnmarshallBinary(data []byte) (int, error)

UnmarshallBinary unmarshalls a binary representation of itself

type KProbeEventSerializer

type KProbeEventSerializer struct {
	*KProbeEvent
}

KProbeEventSerializer is used to serialize KProbeEvent easyjson:json

func NewKProbeEventSerializer

func NewKProbeEventSerializer(e *KProbeEvent) *KProbeEventSerializer

NewKProbeEventSerializer returns a new instance of KProbeEventSerializer

func (KProbeEventSerializer) MarshalEasyJSON

func (v KProbeEventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*KProbeEventSerializer) UnmarshalEasyJSON

func (v *KProbeEventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type KProbeType

type KProbeType uint32

KProbeType kprobe type

func (KProbeType) MarshalJSON

func (kt KProbeType) MarshalJSON() ([]byte, error)

func (KProbeType) String

func (kt KProbeType) String() string

type KernelEvent

type KernelEvent struct {
	Time   time.Time `json:"time"`
	Retval int64     `json:"retval"`
	CPU    uint32    `json:"cpu"`
	Type   EventType `json:"type"`
	Action Action    `json:"action"`
}

KernelEvent represents the default kernel event context

func (*KernelEvent) UnmarshalBinary

func (ke *KernelEvent) UnmarshalBinary(data []byte, resolver *TimeResolver) (int, error)

UnmarshalBinary unmarshalls a binary representation of itself

type KernelEventSerializer

type KernelEventSerializer struct {
	*KernelEvent
}

KernelEventSerializer is used to serialize KernelEvent easyjson:json

func NewKernelEventSerializer

func NewKernelEventSerializer(ke *KernelEvent) *KernelEventSerializer

NewKernelEventSerializer returns a new instance of KernelEventSerializer

func (KernelEventSerializer) MarshalEasyJSON

func (v KernelEventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*KernelEventSerializer) UnmarshalEasyJSON

func (v *KernelEventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type KernelParameterEvent

type KernelParameterEvent struct {
	Parameter     KernelSymbol `json:"parameter,omitempty"`
	ExpectedValue uint64       `json:"expected_value"`
	ActualValue   uint64       `json:"actual_value"`
}

KernelParameterEvent represents a kernel_parameter event

func (*KernelParameterEvent) UnmarshallBinary

func (e *KernelParameterEvent) UnmarshallBinary(data []byte) (int, error)

UnmarshallBinary unmarshalls a binary representation of itself

type KernelParameterEventSerializer

type KernelParameterEventSerializer struct {
	*KernelParameterEvent
}

KernelParameterEventSerializer is used to serialize KernelParameterEvent easyjson:json

func NewKernelParameterEventSerializer

func NewKernelParameterEventSerializer(e *KernelParameterEvent) *KernelParameterEventSerializer

NewKernelParameterEventSerializer returns a new instance of KernelParameterEventSerializer

func (KernelParameterEventSerializer) MarshalEasyJSON

func (v KernelParameterEventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*KernelParameterEventSerializer) UnmarshalEasyJSON

func (v *KernelParameterEventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type KernelParameterOptions

type KernelParameterOptions struct {
	Action         Action            `yaml:"action"`
	PeriodicAction Action            `yaml:"periodic_action"`
	Ticker         int64             `yaml:"ticker"`
	List           []ParameterOption `yaml:"list"`
}

KernelParameterOptions is used to configure the kernel_parameter events

func NewKernelParameterOptions

func NewKernelParameterOptions() *KernelParameterOptions

NewKernelParameterOptions returns a new instance of KernelParameterOptions

func (KernelParameterOptions) IsValid

func (o KernelParameterOptions) IsValid() error

type KernelSymbol

type KernelSymbol struct {
	Address MemoryPointer `json:"address,omitempty"`
	Symbol  string        `json:"symbol,omitempty"`
	Module  string        `json:"module,omitempty"`
}

KernelSymbol is used to identify a kernel syscall handler

type L3Protocol

type L3Protocol uint16

L3Protocol Network protocols

const (
	// EthPLOOP Ethernet Loopback packet
	EthPLOOP L3Protocol = 0x0060
	// EthPPUP Xerox PUP packet
	EthPPUP L3Protocol = 0x0200
	// EthPPUPAT Xerox PUP Addr Trans packet
	EthPPUPAT L3Protocol = 0x0201
	// EthPTSN TSN (IEEE 1722) packet
	EthPTSN L3Protocol = 0x22F0
	// EthPIP Internet Protocol packet
	EthPIP L3Protocol = 0x0800
	// EthPX25 CCITT X.25
	EthPX25 L3Protocol = 0x0805
	// EthPARP Address Resolution packet
	EthPARP L3Protocol = 0x0806
	// EthPBPQ G8BPQ AX.25 Ethernet Packet    [ NOT AN OFFICIALLY REGISTERED ID ]
	EthPBPQ L3Protocol = 0x08FF
	// EthPIEEEPUP Xerox IEEE802.3 PUP packet
	EthPIEEEPUP L3Protocol = 0x0a00
	// EthPIEEEPUPAT Xerox IEEE802.3 PUP Addr Trans packet
	EthPIEEEPUPAT L3Protocol = 0x0a01
	// EthPBATMAN B.A.T.M.A.N.-Advanced packet [ NOT AN OFFICIALLY REGISTERED ID ]
	EthPBATMAN L3Protocol = 0x4305
	// EthPDEC DEC Assigned proto
	EthPDEC L3Protocol = 0x6000
	// EthPDNADL DEC DNA Dump/Load
	EthPDNADL L3Protocol = 0x6001
	// EthPDNARC DEC DNA Remote Console
	EthPDNARC L3Protocol = 0x6002
	// EthPDNART DEC DNA Routing
	EthPDNART L3Protocol = 0x6003
	// EthPLAT DEC LAT
	EthPLAT L3Protocol = 0x6004
	// EthPDIAG DEC Diagnostics
	EthPDIAG L3Protocol = 0x6005
	// EthPCUST DEC Customer use
	EthPCUST L3Protocol = 0x6006
	// EthPSCA DEC Systems Comms Arch
	EthPSCA L3Protocol = 0x6007
	// EthPTEB Trans Ether Bridging
	EthPTEB L3Protocol = 0x6558
	// EthPRARP Reverse Addr Res packet
	EthPRARP L3Protocol = 0x8035
	// EthPATALK Appletalk DDP
	EthPATALK L3Protocol = 0x809B
	// EthPAARP Appletalk AARP
	EthPAARP L3Protocol = 0x80F3
	// EthP8021Q 802.1Q VLAN Extended Header
	EthP8021Q L3Protocol = 0x8100
	// EthPERSPAN ERSPAN type II
	EthPERSPAN L3Protocol = 0x88BE
	// EthPIPX IPX over DIX
	EthPIPX L3Protocol = 0x8137
	// EthPIPV6 IPv6 over bluebook
	EthPIPV6 L3Protocol = 0x86DD
	// EthPPAUSE IEEE Pause frames. See 802.3 31B
	EthPPAUSE L3Protocol = 0x8808
	// EthPSLOW Slow Protocol. See 802.3ad 43B
	EthPSLOW L3Protocol = 0x8809
	// EthPWCCP Web-cache coordination protocol defined in draft-wilson-wrec-wccp-v2-00.txt
	EthPWCCP L3Protocol = 0x883E
	// EthPMPLSUC MPLS Unicast traffic
	EthPMPLSUC L3Protocol = 0x8847
	// EthPMPLSMC MPLS Multicast traffic
	EthPMPLSMC L3Protocol = 0x8848
	// EthPATMMPOA MultiProtocol Over ATM
	EthPATMMPOA L3Protocol = 0x884c
	// EthPPPPDISC PPPoE discovery messages
	EthPPPPDISC L3Protocol = 0x8863
	// EthPPPPSES PPPoE session messages
	EthPPPPSES L3Protocol = 0x8864
	// EthPLinkCTL HPNA, wlan link local tunnel
	EthPLinkCTL L3Protocol = 0x886c
	// EthPATMFATE Frame-based ATM Transport over Ethernet
	EthPATMFATE L3Protocol = 0x8884
	// EthPPAE Port Access Entity (IEEE 802.1X)
	EthPPAE L3Protocol = 0x888E
	// EthPAOE ATA over Ethernet
	EthPAOE L3Protocol = 0x88A2
	// EthP8021AD 802.1ad Service VLAN
	EthP8021AD L3Protocol = 0x88A8
	// EthP802EX1 802.1 Local Experimental 1.
	EthP802EX1 L3Protocol = 0x88B5
	// EthPTIPC TIPC
	EthPTIPC L3Protocol = 0x88CA
	// EthPMACSEC 802.1ae MACsec
	EthPMACSEC L3Protocol = 0x88E5
	// EthP8021AH 802.1ah Backbone Service Tag
	EthP8021AH L3Protocol = 0x88E7
	// EthPMVRP 802.1Q MVRP
	EthPMVRP L3Protocol = 0x88F5
	// EthP1588 IEEE 1588 Timesync
	EthP1588 L3Protocol = 0x88F7
	// EthPNCSI NCSI protocol
	EthPNCSI L3Protocol = 0x88F8
	// EthPPRP IEC 62439-3 PRP/HSRv0
	EthPPRP L3Protocol = 0x88FB
	// EthPFCOE Fibre Channel over Ethernet
	EthPFCOE L3Protocol = 0x8906
	// EthPIBOE Infiniband over Ethernet
	EthPIBOE L3Protocol = 0x8915
	// EthPTDLS TDLS
	EthPTDLS L3Protocol = 0x890D
	// EthPFIP FCoE Initialization Protocol
	EthPFIP L3Protocol = 0x8914
	// EthP80221 IEEE 802.21 Media Independent Handover Protocol
	EthP80221 L3Protocol = 0x8917
	// EthPHSR IEC 62439-3 HSRv1
	EthPHSR L3Protocol = 0x892F
	// EthPNSH Network Service Header
	EthPNSH L3Protocol = 0x894F
	// EthPLOOPBACK Ethernet loopback packet, per IEEE 802.3
	EthPLOOPBACK L3Protocol = 0x9000
	// EthPQINQ1 deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ]
	EthPQINQ1 L3Protocol = 0x9100
	// EthPQINQ2 deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ]
	EthPQINQ2 L3Protocol = 0x9200
	// EthPQINQ3 deprecated QinQ VLAN [ NOT AN OFFICIALLY REGISTERED ID ]
	EthPQINQ3 L3Protocol = 0x9300
	// EthPEDSA Ethertype DSA [ NOT AN OFFICIALLY REGISTERED ID ]
	EthPEDSA L3Protocol = 0xDADA
	// EthPIFE ForCES inter-FE LFB type
	EthPIFE L3Protocol = 0xED3E
	// EthPAFIUCV IBM afiucv [ NOT AN OFFICIALLY REGISTERED ID ]
	EthPAFIUCV L3Protocol = 0xFBFB
	// EthP8023MIN If the value in the ethernet type is less than this value then the frame is Ethernet II. Else it is 802.3
	EthP8023MIN L3Protocol = 0x0600
	// EthPIPV6HopByHop IPv6 Hop by hop option
	EthPIPV6HopByHop L3Protocol = 0x000
	// EthP8023 Dummy type for 802.3 frames
	EthP8023 L3Protocol = 0x0001
	// EthPAX25 Dummy protocol id for AX.25
	EthPAX25 L3Protocol = 0x0002
	// EthPALL Every packet (be careful!!!)
	EthPALL L3Protocol = 0x0003
	// EthP8022 802.2 frames
	EthP8022 L3Protocol = 0x0004
	// EthPSNAP Internal only
	EthPSNAP L3Protocol = 0x0005
	// EthPDDCMP DEC DDCMP: Internal only
	EthPDDCMP L3Protocol = 0x0006
	// EthPWANPPP Dummy type for WAN PPP frames*/
	EthPWANPPP L3Protocol = 0x0007
	// EthPPPPMP Dummy type for PPP MP frames
	EthPPPPMP L3Protocol = 0x0008
	// EthPLOCALTALK Localtalk pseudo type
	EthPLOCALTALK L3Protocol = 0x0009
	// EthPCAN CAN: Controller Area Network
	EthPCAN L3Protocol = 0x000C
	// EthPCANFD CANFD: CAN flexible data rate*/
	EthPCANFD L3Protocol = 0x000D
	// EthPPPPTALK Dummy type for Atalk over PPP*/
	EthPPPPTALK L3Protocol = 0x0010
	// EthPTR8022 802.2 frames
	EthPTR8022 L3Protocol = 0x0011
	// EthPMOBITEX Mobitex (kaz@cafe.net)
	EthPMOBITEX L3Protocol = 0x0015
	// EthPCONTROL Card specific control frames
	EthPCONTROL L3Protocol = 0x0016
	// EthPIRDA Linux-IrDA
	EthPIRDA L3Protocol = 0x0017
	// EthPECONET Acorn Econet
	EthPECONET L3Protocol = 0x0018
	// EthPHDLC HDLC frames
	EthPHDLC L3Protocol = 0x0019
	// EthPARCNET 1A for ArcNet :-)
	EthPARCNET L3Protocol = 0x001A
	// EthPDSA Distributed Switch Arch.
	EthPDSA L3Protocol = 0x001B
	// EthPTRAILER Trailer switch tagging
	EthPTRAILER L3Protocol = 0x001C
	// EthPPHONET Nokia Phonet frames
	EthPPHONET L3Protocol = 0x00F5
	// EthPIEEE802154 IEEE802.15.4 frame
	EthPIEEE802154 L3Protocol = 0x00F6
	// EthPCAIF ST-Ericsson CAIF protocol
	EthPCAIF L3Protocol = 0x00F7
	// EthPXDSA Multiplexed DSA protocol
	EthPXDSA L3Protocol = 0x00F8
	// EthPMAP Qualcomm multiplexing and aggregation protocol
	EthPMAP L3Protocol = 0x00F9
)

func (L3Protocol) MarshalJSON

func (proto L3Protocol) MarshalJSON() ([]byte, error)

func (L3Protocol) String

func (proto L3Protocol) String() string

type MemoryPointer

type MemoryPointer uint64

MemoryPointer is used to serialize memory addresses

func (MemoryPointer) MarshalJSON

func (mp MemoryPointer) MarshalJSON() ([]byte, error)

type NamespaceContext

type NamespaceContext struct {
	CgroupNamespace uint32 `json:"cgroup_namespace"`
	IPCNamespace    uint32 `json:"ipc_namespace"`
	NetNamespace    uint32 `json:"net_namespace"`
	MntNamespace    uint32 `json:"mnt_namespace"`
	PIDNamespace    uint32 `json:"pid_namespace"`
	TimeNamespace   uint32 `json:"time_namespace"`
	UserNamespace   uint32 `json:"user_namespace"`
	UTSNamespace    uint32 `json:"uts_namespace"`
}

NamespaceContext is used to parse the namespace context of an event

func (*NamespaceContext) UnmarshalBinary

func (nc *NamespaceContext) UnmarshalBinary(data []byte) (int, error)

UnmarshalBinary unmarshalls a binary representation of itself

type Options

type Options struct {
	InitModuleEvent         Action                  `yaml:"init_module"`
	DeleteModuleEvent       Action                  `yaml:"delete_module"`
	BPFEvent                Action                  `yaml:"bpf"`
	BPFFilterEvent          Action                  `yaml:"bpf_filter"`
	PTraceEvent             Action                  `yaml:"ptrace"`
	KProbeEvent             Action                  `yaml:"kprobe"`
	SysCtlEvent             *SysCtlOptions          `yaml:"sysctl"`
	HookedSyscallTableEvent Action                  `yaml:"hooked_syscall_table"`
	HookedSyscallEvent      Action                  `yaml:"hooked_syscall"`
	KernelParameterEvent    *KernelParameterOptions `yaml:"kernel_parameter"`
	RegisterCheckEvent      Action                  `yaml:"register_check"`
	// contains filtered or unexported fields
}

Options stores the options for each event type

func NewEventsOptions

func NewEventsOptions() *Options

NewEventsOptions returns a new initialized instance of EventsOptions

func (*Options) ActivatedEventTypes

func (o *Options) ActivatedEventTypes() EventTypeList

func (*Options) IsValid

func (o *Options) IsValid() error

func (*Options) ParseEventsActions

func (o *Options) ParseEventsActions() map[EventType]Action

type PTraceEvent

type PTraceEvent struct {
	Address MemoryPointer `json:"address,omitempty"`
	Request PTraceRequest `json:"request"`
	PID     uint32        `json:"pid,omitempty"`
}

PTraceEvent represents a ptrace event

func (*PTraceEvent) UnmarshallBinary

func (e *PTraceEvent) UnmarshallBinary(data []byte) (int, error)

UnmarshallBinary unmarshalls a binary representation of itself

type PTraceRequest

type PTraceRequest uint32

PTraceRequest represents a ptrace request value

func (PTraceRequest) MarshalJSON

func (f PTraceRequest) MarshalJSON() ([]byte, error)

func (PTraceRequest) String

func (f PTraceRequest) String() string

type ParameterOption

type ParameterOption struct {
	Symbol        string `yaml:"symbol"`
	Address       uint64 `yaml:"address"`
	ExpectedValue uint64 `yaml:"expected_value"`
	Size          uint64 `yaml:"size"`
}

ParameterOption is used to configure a kernel parameter that KRIE should check

type ProcessContext

type ProcessContext struct {
	Cgroups          Cgroups            `json:"cgroups"`
	NamespaceContext NamespaceContext   `json:"namespace_context"`
	Credentials      CredentialsContext `json:"credentials"`
	Comm             string             `json:"comm"`
	PID              uint32             `json:"pid"`
	TID              uint32             `json:"tid"`
}

ProcessContext is used to parse the process context of an event

func (*ProcessContext) UnmarshalBinary

func (pc *ProcessContext) UnmarshalBinary(data []byte) (int, error)

UnmarshalBinary unmarshalls a binary representation of itself

type ProcessContextSerializer

type ProcessContextSerializer struct {
	*ProcessContext
}

ProcessContextSerializer is used to serialize ProcessContext easyjson:json

func NewProcessContextSerializer

func NewProcessContextSerializer(pc *ProcessContext) *ProcessContextSerializer

NewProcessContextSerializer returns a new instance of ProcessContextSerializer

func (ProcessContextSerializer) MarshalEasyJSON

func (v ProcessContextSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*ProcessContextSerializer) UnmarshalEasyJSON

func (v *ProcessContextSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type PtraceEventSerializer

type PtraceEventSerializer struct {
	*PTraceEvent
}

PtraceEventSerializer is used to serialize PTraceEvent easyjson:json

func NewPtraceEventSerializer

func NewPtraceEventSerializer(e *PTraceEvent) *PtraceEventSerializer

NewPtraceEventSerializer returns a new instance of PtraceEventSerializer

func (PtraceEventSerializer) MarshalEasyJSON

func (v PtraceEventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*PtraceEventSerializer) UnmarshalEasyJSON

func (v *PtraceEventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type RegisterCheckEvent

type RegisterCheckEvent struct {
	StackPointer       MemoryPointer `json:"stack_pointer"`
	InstructionPointer MemoryPointer `json:"instruction_pointer"`
	FramePointer       MemoryPointer `json:"frame_pointer"`
	HookPoint          HookPoint     `json:"hook_point"`
}

RegisterCheckEvent represents a register_check event

func (*RegisterCheckEvent) UnmarshallBinary

func (e *RegisterCheckEvent) UnmarshallBinary(data []byte) (int, error)

UnmarshallBinary unmarshalls a binary representation of itself

type RegisterCheckEventSerializer

type RegisterCheckEventSerializer struct {
	*RegisterCheckEvent
}

RegisterCheckEventSerializer is used to serialize RegisterCheckEvent easyjson:json

func NewRegisterCheckEventSerializer

func NewRegisterCheckEventSerializer(e *RegisterCheckEvent) *RegisterCheckEventSerializer

NewRegisterCheckEventSerializer returns a new instance of PtraceEventSerializer

func (RegisterCheckEventSerializer) MarshalEasyJSON

func (v RegisterCheckEventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*RegisterCheckEventSerializer) UnmarshalEasyJSON

func (v *RegisterCheckEventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type SocketType

type SocketType uint32

SocketType socket type

func (SocketType) MarshalJSON

func (st SocketType) MarshalJSON() ([]byte, error)

func (SocketType) String

func (st SocketType) String() string

type SysCtlAction

type SysCtlAction uint64

SysCtlAction command

func (SysCtlAction) MarshalJSON

func (sca SysCtlAction) MarshalJSON() ([]byte, error)

func (SysCtlAction) String

func (sca SysCtlAction) String() string

type SysCtlEvent

type SysCtlEvent struct {
	WriteAccess            bool         `json:"write_access"`
	FilePosition           uint32       `json:"file_position"`
	Action                 SysCtlAction `json:"action"`
	Name                   string       `json:"name"`
	CurrentValue           string       `json:"current_value"`
	NewValue               string       `json:"new_value,omitempty"`
	NewValueOverriddenWith string       `json:"new_value_overridden_with,omitempty"`
}

SysCtlEvent represents a ptrace event

func (*SysCtlEvent) UnmarshallBinary

func (e *SysCtlEvent) UnmarshallBinary(data []byte) (int, error)

UnmarshallBinary unmarshalls a binary representation of itself

type SysCtlEventEventSerializer

type SysCtlEventEventSerializer struct {
	*SysCtlEvent
}

SysCtlEventEventSerializer is used to serialize SysCtlEvent easyjson:json

func NewSysCtlEventSerializer

func NewSysCtlEventSerializer(e *SysCtlEvent) *SysCtlEventEventSerializer

NewSysCtlEventSerializer returns a new instance of PtraceEventSerializer

func (SysCtlEventEventSerializer) MarshalEasyJSON

func (v SysCtlEventEventSerializer) MarshalEasyJSON(w *jwriter.Writer)

MarshalEasyJSON supports easyjson.Marshaler interface

func (*SysCtlEventEventSerializer) UnmarshalEasyJSON

func (v *SysCtlEventEventSerializer) UnmarshalEasyJSON(l *jlexer.Lexer)

UnmarshalEasyJSON supports easyjson.Unmarshaler interface

type SysCtlOptions

type SysCtlOptions struct {
	Action  Action                     `yaml:"action"`
	Default SysCtlParameter            `yaml:"default"`
	List    map[string]SysCtlParameter `yaml:"list"`
}

func NewSysCtlOptions

func NewSysCtlOptions() *SysCtlOptions

NewSysCtlOptions returns a new instance of SysCtlOptions

type SysCtlParameter

type SysCtlParameter struct {
	BlockWriteAccess       bool   `yaml:"block_write_access"`
	BlockReadAccess        bool   `yaml:"block_read_access"`
	OverrideInputValueWith string `yaml:"override_input_value_with"`
}

func (SysCtlParameter) MarshalBinary

func (scp SysCtlParameter) MarshalBinary() ([]byte, error)

MarshalBinary returns a binary representation of itself

type Syscall

type Syscall int

Syscall represents a syscall identifier

const (
	SysRead                  Syscall = 0
	SysWrite                 Syscall = 1
	SysOpen                  Syscall = 2
	SysClose                 Syscall = 3
	SysStat                  Syscall = 4
	SysFstat                 Syscall = 5
	SysLstat                 Syscall = 6
	SysPoll                  Syscall = 7
	SysLseek                 Syscall = 8
	SysMmap                  Syscall = 9
	SysMprotect              Syscall = 10
	SysMunmap                Syscall = 11
	SysBrk                   Syscall = 12
	SysRtSigaction           Syscall = 13
	SysRtSigprocmask         Syscall = 14
	SysRtSigreturn           Syscall = 15
	SysIoctl                 Syscall = 16
	SysPread64               Syscall = 17
	SysPwrite64              Syscall = 18
	SysReadv                 Syscall = 19
	SysWritev                Syscall = 20
	SysAccess                Syscall = 21
	SysPipe                  Syscall = 22
	SysSelect                Syscall = 23
	SysSchedYield            Syscall = 24
	SysMremap                Syscall = 25
	SysMsync                 Syscall = 26
	SysMincore               Syscall = 27
	SysMadvise               Syscall = 28
	SysShmget                Syscall = 29
	SysShmat                 Syscall = 30
	SysShmctl                Syscall = 31
	SysDup                   Syscall = 32
	SysDup2                  Syscall = 33
	SysPause                 Syscall = 34
	SysNanosleep             Syscall = 35
	SysGetitimer             Syscall = 36
	SysAlarm                 Syscall = 37
	SysSetitimer             Syscall = 38
	SysGetpid                Syscall = 39
	SysSendfile              Syscall = 40
	SysSocket                Syscall = 41
	SysConnect               Syscall = 42
	SysAccept                Syscall = 43
	SysSendto                Syscall = 44
	SysRecvfrom              Syscall = 45
	SysSendmsg               Syscall = 46
	SysRecvmsg               Syscall = 47
	SysShutdown              Syscall = 48
	SysBind                  Syscall = 49
	SysListen                Syscall = 50
	SysGetsockname           Syscall = 51
	SysGetpeername           Syscall = 52
	SysSocketpair            Syscall = 53
	SysSetsockopt            Syscall = 54
	SysGetsockopt            Syscall = 55
	SysClone                 Syscall = 56
	SysFork                  Syscall = 57
	SysVfork                 Syscall = 58
	SysExecve                Syscall = 59
	SysExit                  Syscall = 60
	SysWait4                 Syscall = 61
	SysKill                  Syscall = 62
	SysUname                 Syscall = 63
	SysSemget                Syscall = 64
	SysSemop                 Syscall = 65
	SysSemctl                Syscall = 66
	SysShmdt                 Syscall = 67
	SysMsgget                Syscall = 68
	SysMsgsnd                Syscall = 69
	SysMsgrcv                Syscall = 70
	SysMsgctl                Syscall = 71
	SysFcntl                 Syscall = 72
	SysFlock                 Syscall = 73
	SysFsync                 Syscall = 74
	SysFdatasync             Syscall = 75
	SysTruncate              Syscall = 76
	SysFtruncate             Syscall = 77
	SysGetdents              Syscall = 78
	SysGetcwd                Syscall = 79
	SysChdir                 Syscall = 80
	SysFchdir                Syscall = 81
	SysRename                Syscall = 82
	SysMkdir                 Syscall = 83
	SysRmdir                 Syscall = 84
	SysCreat                 Syscall = 85
	SysLink                  Syscall = 86
	SysUnlink                Syscall = 87
	SysSymlink               Syscall = 88
	SysReadlink              Syscall = 89
	SysChmod                 Syscall = 90
	SysFchmod                Syscall = 91
	SysChown                 Syscall = 92
	SysFchown                Syscall = 93
	SysLchown                Syscall = 94
	SysUmask                 Syscall = 95
	SysGettimeofday          Syscall = 96
	SysGetrlimit             Syscall = 97
	SysGetrusage             Syscall = 98
	SysSysinfo               Syscall = 99
	SysTimes                 Syscall = 100
	SysPtrace                Syscall = 101
	SysGetuid                Syscall = 102
	SysSyslog                Syscall = 103
	SysGetgid                Syscall = 104
	SysSetuid                Syscall = 105
	SysSetgid                Syscall = 106
	SysGeteuid               Syscall = 107
	SysGetegid               Syscall = 108
	SysSetpgid               Syscall = 109
	SysGetppid               Syscall = 110
	SysGetpgrp               Syscall = 111
	SysSetsid                Syscall = 112
	SysSetreuid              Syscall = 113
	SysSetregid              Syscall = 114
	SysGetgroups             Syscall = 115
	SysSetgroups             Syscall = 116
	SysSetresuid             Syscall = 117
	SysGetresuid             Syscall = 118
	SysSetresgid             Syscall = 119
	SysGetresgid             Syscall = 120
	SysGetpgid               Syscall = 121
	SysSetfsuid              Syscall = 122
	SysSetfsgid              Syscall = 123
	SysGetsid                Syscall = 124
	SysCapget                Syscall = 125
	SysCapset                Syscall = 126
	SysRtSigpending          Syscall = 127
	SysRtSigtimedwait        Syscall = 128
	SysRtSigqueueinfo        Syscall = 129
	SysRtSigsuspend          Syscall = 130
	SysSigaltstack           Syscall = 131
	SysUtime                 Syscall = 132
	SysMknod                 Syscall = 133
	SysUselib                Syscall = 134
	SysPersonality           Syscall = 135
	SysUstat                 Syscall = 136
	SysStatfs                Syscall = 137
	SysFstatfs               Syscall = 138
	SysSysfs                 Syscall = 139
	SysGetpriority           Syscall = 140
	SysSetpriority           Syscall = 141
	SysSchedSetparam         Syscall = 142
	SysSchedGetparam         Syscall = 143
	SysSchedSetscheduler     Syscall = 144
	SysSchedGetscheduler     Syscall = 145
	SysSchedGetPriorityMax   Syscall = 146
	SysSchedGetPriorityMin   Syscall = 147
	SysSchedRrGetInterval    Syscall = 148
	SysMlock                 Syscall = 149
	SysMunlock               Syscall = 150
	SysMlockall              Syscall = 151
	SysMunlockall            Syscall = 152
	SysVhangup               Syscall = 153
	SysModifyLdt             Syscall = 154
	SysPivotRoot             Syscall = 155
	SysSysctl                Syscall = 156
	SysPrctl                 Syscall = 157
	SysArchPrctl             Syscall = 158
	SysAdjtimex              Syscall = 159
	SysSetrlimit             Syscall = 160
	SysChroot                Syscall = 161
	SysSync                  Syscall = 162
	SysAcct                  Syscall = 163
	SysSettimeofday          Syscall = 164
	SysMount                 Syscall = 165
	SysUmount2               Syscall = 166
	SysSwapon                Syscall = 167
	SysSwapoff               Syscall = 168
	SysReboot                Syscall = 169
	SysSethostname           Syscall = 170
	SysSetdomainname         Syscall = 171
	SysIopl                  Syscall = 172
	SysIoperm                Syscall = 173
	SysCreateModule          Syscall = 174
	SysInitModule            Syscall = 175
	SysDeleteModule          Syscall = 176
	SysGetKernelSyms         Syscall = 177
	SysQueryModule           Syscall = 178
	SysQuotactl              Syscall = 179
	SysNfsservctl            Syscall = 180
	SysGetpmsg               Syscall = 181
	SysPutpmsg               Syscall = 182
	SysAfsSyscall            Syscall = 183
	SysTuxcall               Syscall = 184
	SysSecurity              Syscall = 185
	SysGettid                Syscall = 186
	SysReadahead             Syscall = 187
	SysSetxattr              Syscall = 188
	SysLsetxattr             Syscall = 189
	SysFsetxattr             Syscall = 190
	SysGetxattr              Syscall = 191
	SysLgetxattr             Syscall = 192
	SysFgetxattr             Syscall = 193
	SysListxattr             Syscall = 194
	SysLlistxattr            Syscall = 195
	SysFlistxattr            Syscall = 196
	SysRemovexattr           Syscall = 197
	SysLremovexattr          Syscall = 198
	SysFremovexattr          Syscall = 199
	SysTkill                 Syscall = 200
	SysTime                  Syscall = 201
	SysFutex                 Syscall = 202
	SysSchedSetaffinity      Syscall = 203
	SysSchedGetaffinity      Syscall = 204
	SysSetThreadArea         Syscall = 205
	SysIoSetup               Syscall = 206
	SysIoDestroy             Syscall = 207
	SysIoGetevents           Syscall = 208
	SysIoSubmit              Syscall = 209
	SysIoCancel              Syscall = 210
	SysGetThreadArea         Syscall = 211
	SysLookupDcookie         Syscall = 212
	SysEpollCreate           Syscall = 213
	SysEpollCtlOld           Syscall = 214
	SysEpollWaitOld          Syscall = 215
	SysRemapFilePages        Syscall = 216
	SysGetdents64            Syscall = 217
	SysSetTidAddress         Syscall = 218
	SysRestartSyscall        Syscall = 219
	SysSemtimedop            Syscall = 220
	SysFadvise64             Syscall = 221
	SysTimerCreate           Syscall = 222
	SysTimerSettime          Syscall = 223
	SysTimerGettime          Syscall = 224
	SysTimerGetoverrun       Syscall = 225
	SysTimerDelete           Syscall = 226
	SysClockSettime          Syscall = 227
	SysClockGettime          Syscall = 228
	SysClockGetres           Syscall = 229
	SysClockNanosleep        Syscall = 230
	SysExitGroup             Syscall = 231
	SysEpollWait             Syscall = 232
	SysEpollCtl              Syscall = 233
	SysTgkill                Syscall = 234
	SysUtimes                Syscall = 235
	SysVserver               Syscall = 236
	SysMbind                 Syscall = 237
	SysSetMempolicy          Syscall = 238
	SysGetMempolicy          Syscall = 239
	SysMqOpen                Syscall = 240
	SysMqUnlink              Syscall = 241
	SysMqTimedsend           Syscall = 242
	SysMqTimedreceive        Syscall = 243
	SysMqNotify              Syscall = 244
	SysMqGetsetattr          Syscall = 245
	SysKexecLoad             Syscall = 246
	SysWaitid                Syscall = 247
	SysAddKey                Syscall = 248
	SysRequestKey            Syscall = 249
	SysKeyctl                Syscall = 250
	SysIoprioSet             Syscall = 251
	SysIoprioGet             Syscall = 252
	SysInotifyInit           Syscall = 253
	SysInotifyAddWatch       Syscall = 254
	SysInotifyRmWatch        Syscall = 255
	SysMigratePages          Syscall = 256
	SysOpenat                Syscall = 257
	SysMkdirat               Syscall = 258
	SysMknodat               Syscall = 259
	SysFchownat              Syscall = 260
	SysFutimesat             Syscall = 261
	SysNewfstatat            Syscall = 262
	SysUnlinkat              Syscall = 263
	SysRenameat              Syscall = 264
	SysLinkat                Syscall = 265
	SysSymlinkat             Syscall = 266
	SysReadlinkat            Syscall = 267
	SysFchmodat              Syscall = 268
	SysFaccessat             Syscall = 269
	SysPselect6              Syscall = 270
	SysPpoll                 Syscall = 271
	SysUnshare               Syscall = 272
	SysSetRobustList         Syscall = 273
	SysGetRobustList         Syscall = 274
	SysSplice                Syscall = 275
	SysTee                   Syscall = 276
	SysSyncFileRange         Syscall = 277
	SysVmsplice              Syscall = 278
	SysMovePages             Syscall = 279
	SysUtimensat             Syscall = 280
	SysEpollPwait            Syscall = 281
	SysSignalfd              Syscall = 282
	SysTimerfdCreate         Syscall = 283
	SysEventfd               Syscall = 284
	SysFallocate             Syscall = 285
	SysTimerfdSettime        Syscall = 286
	SysTimerfdGettime        Syscall = 287
	SysAccept4               Syscall = 288
	SysSignalfd4             Syscall = 289
	SysEventfd2              Syscall = 290
	SysEpollCreate1          Syscall = 291
	SysDup3                  Syscall = 292
	SysPipe2                 Syscall = 293
	SysInotifyInit1          Syscall = 294
	SysPreadv                Syscall = 295
	SysPwritev               Syscall = 296
	SysRtTgsigqueueinfo      Syscall = 297
	SysPerfEventOpen         Syscall = 298
	SysRecvmmsg              Syscall = 299
	SysFanotifyInit          Syscall = 300
	SysFanotifyMark          Syscall = 301
	SysPrlimit64             Syscall = 302
	SysNameToHandleAt        Syscall = 303
	SysOpenByHandleAt        Syscall = 304
	SysClockAdjtime          Syscall = 305
	SysSyncfs                Syscall = 306
	SysSendmmsg              Syscall = 307
	SysSetns                 Syscall = 308
	SysGetcpu                Syscall = 309
	SysProcessVmReadv        Syscall = 310
	SysProcessVmWritev       Syscall = 311
	SysKcmp                  Syscall = 312
	SysFinitModule           Syscall = 313
	SysSchedSetattr          Syscall = 314
	SysSchedGetattr          Syscall = 315
	SysRenameat2             Syscall = 316
	SysSeccomp               Syscall = 317
	SysGetrandom             Syscall = 318
	SysMemfdCreate           Syscall = 319
	SysKexecFileLoad         Syscall = 320
	SysBpf                   Syscall = 321
	SysExecveat              Syscall = 322
	SysUserfaultfd           Syscall = 323
	SysMembarrier            Syscall = 324
	SysMlock2                Syscall = 325
	SysCopyFileRange         Syscall = 326
	SysPreadv2               Syscall = 327
	SysPwritev2              Syscall = 328
	SysPkeyMprotect          Syscall = 329
	SysPkeyAlloc             Syscall = 330
	SysPkeyFree              Syscall = 331
	SysStatx                 Syscall = 332
	SysIoPgetevents          Syscall = 333
	SysRseq                  Syscall = 334
	SysPidfdSendSignal       Syscall = 424
	SysIoUringSetup          Syscall = 425
	SysIoUringEnter          Syscall = 426
	SysIoUringRegister       Syscall = 427
	SysOpenTree              Syscall = 428
	SysMoveMount             Syscall = 429
	SysFsopen                Syscall = 430
	SysFsconfig              Syscall = 431
	SysFsmount               Syscall = 432
	SysFspick                Syscall = 433
	SysPidfdOpen             Syscall = 434
	SysClone3                Syscall = 435
	SysCloseRange            Syscall = 436
	SysOpenat2               Syscall = 437
	SysPidfdGetfd            Syscall = 438
	SysFaccessat2            Syscall = 439
	SysProcessMadvise        Syscall = 440
	SysEpollPwait2           Syscall = 441
	SysMountSetattr          Syscall = 442
	SysQuotactlFd            Syscall = 443
	SysLandlockCreateRuleset Syscall = 444
	SysLandlockAddRule       Syscall = 445
	SysLandlockRestrictSelf  Syscall = 446
	SysMemfdSecret           Syscall = 447
	SysLastSyscall           Syscall = 448
)

Linux syscall identifiers

func ParseSyscallName

func ParseSyscallName(name string) Syscall

ParseSyscallName returns the Syscall number of the provided syscall name

func (Syscall) MarshalBinary

func (i Syscall) MarshalBinary() ([]byte, error)

func (Syscall) MarshalText

func (i Syscall) MarshalText() ([]byte, error)

MarshalText maps the syscall identifier to UTF-8-encoded text and returns the result

func (Syscall) String

func (i Syscall) String() string

func (*Syscall) UnmarshalBinary

func (i *Syscall) UnmarshalBinary(data []byte) error

func (*Syscall) UnmarshalSyscall

func (i *Syscall) UnmarshalSyscall(data []byte) (int, error)

type SyscallTable

type SyscallTable uint32

SyscallTable is used to represent a syscall table

const (
	SysCallTable SyscallTable = iota
	X32SysCallTable
	IA32SysCallTable
)

func (SyscallTable) MarshalJSON

func (st SyscallTable) MarshalJSON() ([]byte, error)

func (SyscallTable) String

func (st SyscallTable) String() string

type TimeResolver

type TimeResolver struct {
	// contains filtered or unexported fields
}

TimeResolver converts kernel monotonic timestamps to absolute times

func NewTimeResolver

func NewTimeResolver() (*TimeResolver, error)

NewTimeResolver returns a new time resolver

func (*TimeResolver) ApplyBootTime

func (tr *TimeResolver) ApplyBootTime(timestamp time.Time) time.Time

ApplyBootTime return the time re-aligned from the boot time

func (*TimeResolver) ComputeMonotonicTimestamp

func (tr *TimeResolver) ComputeMonotonicTimestamp(timestamp time.Time) int64

ComputeMonotonicTimestamp converts an absolute time to a kernel monotonic timestamp

func (*TimeResolver) ResolveMonotonicTimestamp

func (tr *TimeResolver) ResolveMonotonicTimestamp(timestamp uint64) time.Time

ResolveMonotonicTimestamp converts a kernel monotonic timestamp to an absolute time

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL