eventchecker

type BinaryPropertiesChecker struct {
	Setuid            *uint32                              `json:"setuid,omitempty"`
	Setgid            *uint32                              `json:"setgid,omitempty"`
	PrivilegesChanged *ProcessPrivilegesChangedListMatcher `json:"privilegesChanged,omitempty"`
	File              *FilePropertiesChecker               `json:"file,omitempty"`
}

type CapabilitiesChecker struct {
	Permitted   *CapabilitiesTypeListMatcher `json:"permitted,omitempty"`
	Effective   *CapabilitiesTypeListMatcher `json:"effective,omitempty"`
	Inheritable *CapabilitiesTypeListMatcher `json:"inheritable,omitempty"`
}

type CapabilitiesTypeChecker tetragon.CapabilitiesType

type CapabilitiesTypeListMatcher struct {
	Operator listmatcher.Operator       `json:"operator"`
	Values   []*CapabilitiesTypeChecker `json:"values"`
}

type ContainerChecker struct {
	Id             *stringmatcher.StringMatcher       `json:"id,omitempty"`
	Name           *stringmatcher.StringMatcher       `json:"name,omitempty"`
	Image          *ImageChecker                      `json:"image,omitempty"`
	StartTime      *timestampmatcher.TimestampMatcher `json:"startTime,omitempty"`
	Pid            *uint32                            `json:"pid,omitempty"`
	MaybeExecProbe *bool                              `json:"maybeExecProbe,omitempty"`
}

type Event tetragon.Event

type EventChecker interface {
	// CheckEvent checks a single event
	CheckEvent(Event) error
	// CheckEvent checks a single gRPC response
	CheckResponse(*tetragon.GetEventsResponse) error
}

type FilePropertiesChecker struct {
	Inode *InodePropertiesChecker      `json:"inode,omitempty"`
	Path  *stringmatcher.StringMatcher `json:"path,omitempty"`
}

type FnEventChecker struct {
	// NextCheckFn checks an event and returns a boolean value indicating
	// whether the checker has concluded, and an error indicating whether the
	// check was successful. The boolean value allows short-circuiting checks.
	//
	// Specifically:
	// (false,  nil): this event check was successful, but need to check more events
	// (false, !nil): this event check not was successful, but need to check more events
	// (true,   nil): checker was successful, no need to check more events
	// (true,  !nil): checker failed, no need to check more events
	NextCheckFn func(Event, *logrus.Logger) (bool, error)
	// FinalCheckFn indicates that the sequence of events has ended, and asks the
	// checker to make a final decision. Any cleanup should also be performed here.
	FinalCheckFn func(*logrus.Logger) error
}

type ImageChecker struct {
	Id   *stringmatcher.StringMatcher `json:"id,omitempty"`
	Name *stringmatcher.StringMatcher `json:"name,omitempty"`
}

type InodePropertiesChecker struct {
	Number *uint64 `json:"number,omitempty"`
	Links  *uint32 `json:"links,omitempty"`
}

type KernelModuleChecker struct {
	Name        *stringmatcher.StringMatcher `json:"name,omitempty"`
	SignatureOk *bool                        `json:"signatureOk,omitempty"`
	Tainted     *TaintedBitsTypeListMatcher  `json:"tainted,omitempty"`
}

type KprobeActionChecker tetragon.KprobeAction

type KprobeArgumentChecker struct {
	StringArg             *stringmatcher.StringMatcher `json:"stringArg,omitempty"`
	IntArg                *int32                       `json:"intArg,omitempty"`
	SkbArg                *KprobeSkbChecker            `json:"skbArg,omitempty"`
	SizeArg               *uint64                      `json:"sizeArg,omitempty"`
	BytesArg              *bytesmatcher.BytesMatcher   `json:"bytesArg,omitempty"`
	PathArg               *KprobePathChecker           `json:"pathArg,omitempty"`
	FileArg               *KprobeFileChecker           `json:"fileArg,omitempty"`
	TruncatedBytesArg     *KprobeTruncatedBytesChecker `json:"truncatedBytesArg,omitempty"`
	SockArg               *KprobeSockChecker           `json:"sockArg,omitempty"`
	CredArg               *KprobeCredChecker           `json:"credArg,omitempty"`
	LongArg               *int64                       `json:"longArg,omitempty"`
	BpfAttrArg            *KprobeBpfAttrChecker        `json:"bpfAttrArg,omitempty"`
	PerfEventArg          *KprobePerfEventChecker      `json:"perfEventArg,omitempty"`
	BpfMapArg             *KprobeBpfMapChecker         `json:"bpfMapArg,omitempty"`
	UintArg               *uint32                      `json:"uintArg,omitempty"`
	UserNamespaceArg      *KprobeUserNamespaceChecker  `json:"userNamespaceArg,omitempty"`
	CapabilityArg         *KprobeCapabilityChecker     `json:"capabilityArg,omitempty"`
	ProcessCredentialsArg *ProcessCredentialsChecker   `json:"processCredentialsArg,omitempty"`
	UserNsArg             *UserNamespaceChecker        `json:"userNsArg,omitempty"`
	ModuleArg             *KernelModuleChecker         `json:"moduleArg,omitempty"`
	KernelCapTArg         *stringmatcher.StringMatcher `json:"kernelCapTArg,omitempty"`
	CapInheritableArg     *stringmatcher.StringMatcher `json:"capInheritableArg,omitempty"`
	CapPermittedArg       *stringmatcher.StringMatcher `json:"capPermittedArg,omitempty"`
	CapEffectiveArg       *stringmatcher.StringMatcher `json:"capEffectiveArg,omitempty"`
	LinuxBinprmArg        *KprobeLinuxBinprmChecker    `json:"linuxBinprmArg,omitempty"`
	NetDevArg             *KprobeNetDevChecker         `json:"netDevArg,omitempty"`
	Label                 *stringmatcher.StringMatcher `json:"label,omitempty"`
}

type KprobeArgumentListMatcher struct {
	Operator listmatcher.Operator     `json:"operator"`
	Values   []*KprobeArgumentChecker `json:"values"`
}

type KprobeBpfAttrChecker struct {
	ProgType *stringmatcher.StringMatcher `json:"ProgType,omitempty"`
	InsnCnt  *uint32                      `json:"InsnCnt,omitempty"`
	ProgName *stringmatcher.StringMatcher `json:"ProgName,omitempty"`
}

type KprobeBpfMapChecker struct {
	MapType    *stringmatcher.StringMatcher `json:"MapType,omitempty"`
	KeySize    *uint32                      `json:"KeySize,omitempty"`
	ValueSize  *uint32                      `json:"ValueSize,omitempty"`
	MaxEntries *uint32                      `json:"MaxEntries,omitempty"`
	MapName    *stringmatcher.StringMatcher `json:"MapName,omitempty"`
}

type KprobeCapabilityChecker struct {
	Value *int32                       `json:"value,omitempty"`
	Name  *stringmatcher.StringMatcher `json:"name,omitempty"`
}

type KprobeCredChecker struct {
	Permitted   *CapabilitiesTypeListMatcher `json:"permitted,omitempty"`
	Effective   *CapabilitiesTypeListMatcher `json:"effective,omitempty"`
	Inheritable *CapabilitiesTypeListMatcher `json:"inheritable,omitempty"`
}

type KprobeFileChecker struct {
	Mount      *stringmatcher.StringMatcher `json:"mount,omitempty"`
	Path       *stringmatcher.StringMatcher `json:"path,omitempty"`
	Flags      *stringmatcher.StringMatcher `json:"flags,omitempty"`
	Permission *stringmatcher.StringMatcher `json:"permission,omitempty"`
}

type KprobeLinuxBinprmChecker struct {
	Path       *stringmatcher.StringMatcher `json:"path,omitempty"`
	Flags      *stringmatcher.StringMatcher `json:"flags,omitempty"`
	Permission *stringmatcher.StringMatcher `json:"permission,omitempty"`
}

type KprobeNetDevChecker struct {
	Name *stringmatcher.StringMatcher `json:"name,omitempty"`
}

type KprobePathChecker struct {
	Mount      *stringmatcher.StringMatcher `json:"mount,omitempty"`
	Path       *stringmatcher.StringMatcher `json:"path,omitempty"`
	Flags      *stringmatcher.StringMatcher `json:"flags,omitempty"`
	Permission *stringmatcher.StringMatcher `json:"permission,omitempty"`
}

type KprobePerfEventChecker struct {
	KprobeFunc  *stringmatcher.StringMatcher `json:"KprobeFunc,omitempty"`
	Type        *stringmatcher.StringMatcher `json:"Type,omitempty"`
	Config      *uint64                      `json:"Config,omitempty"`
	ProbeOffset *uint64                      `json:"ProbeOffset,omitempty"`
}

type KprobeSkbChecker struct {
	Hash        *uint32                      `json:"hash,omitempty"`
	Len         *uint32                      `json:"len,omitempty"`
	Priority    *uint32                      `json:"priority,omitempty"`
	Mark        *uint32                      `json:"mark,omitempty"`
	Saddr       *stringmatcher.StringMatcher `json:"saddr,omitempty"`
	Daddr       *stringmatcher.StringMatcher `json:"daddr,omitempty"`
	Sport       *uint32                      `json:"sport,omitempty"`
	Dport       *uint32                      `json:"dport,omitempty"`
	Proto       *uint32                      `json:"proto,omitempty"`
	SecPathLen  *uint32                      `json:"secPathLen,omitempty"`
	SecPathOlen *uint32                      `json:"secPathOlen,omitempty"`
	Protocol    *stringmatcher.StringMatcher `json:"protocol,omitempty"`
	Family      *stringmatcher.StringMatcher `json:"family,omitempty"`
}

type KprobeSockChecker struct {
	Family   *stringmatcher.StringMatcher `json:"family,omitempty"`
	Type     *stringmatcher.StringMatcher `json:"type,omitempty"`
	Protocol *stringmatcher.StringMatcher `json:"protocol,omitempty"`
	Mark     *uint32                      `json:"mark,omitempty"`
	Priority *uint32                      `json:"priority,omitempty"`
	Saddr    *stringmatcher.StringMatcher `json:"saddr,omitempty"`
	Daddr    *stringmatcher.StringMatcher `json:"daddr,omitempty"`
	Sport    *uint32                      `json:"sport,omitempty"`
	Dport    *uint32                      `json:"dport,omitempty"`
	Cookie   *uint64                      `json:"cookie,omitempty"`
	State    *stringmatcher.StringMatcher `json:"state,omitempty"`
}

type KprobeTruncatedBytesChecker struct {
	BytesArg *bytesmatcher.BytesMatcher `json:"bytesArg,omitempty"`
	OrigSize *uint64                    `json:"origSize,omitempty"`
}

type KprobeUserNamespaceChecker struct {
	Level *int32            `json:"level,omitempty"`
	Owner *uint32           `json:"owner,omitempty"`
	Group *uint32           `json:"group,omitempty"`
	Ns    *NamespaceChecker `json:"ns,omitempty"`
}

type MultiEventChecker interface {
	// NextEventCheck checks an event and returns a boolean value indicating
	// whether the checker has concluded, and an error indicating whether the
	// check was successful. The boolean value allows short-circuiting checks.
	//
	// Specifically:
	// (false,  nil): this event check was successful, but need to check more events
	// (false, !nil): this event check not was successful, but need to check more events
	// (true,   nil): checker was successful, no need to check more events
	// (true,  !nil): checker failed, no need to check more events
	NextEventCheck(Event, *logrus.Logger) (bool, error)

	// FinalCheck indicates that the sequence of events has ended, and
	// asks the checker to make a final decision. Once this function is
	// called, the checker is expected to return to its initial state so
	// that it can be reused. Hence, this function should only be called
	// once for each stream of events.
	FinalCheck(*logrus.Logger) error
}

type NamespaceChecker struct {
	Inum   *uint32 `json:"inum,omitempty"`
	IsHost *bool   `json:"isHost,omitempty"`
}

type NamespacesChecker struct {
	Uts             *NamespaceChecker `json:"uts,omitempty"`
	Ipc             *NamespaceChecker `json:"ipc,omitempty"`
	Mnt             *NamespaceChecker `json:"mnt,omitempty"`
	Pid             *NamespaceChecker `json:"pid,omitempty"`
	PidForChildren  *NamespaceChecker `json:"pidForChildren,omitempty"`
	Net             *NamespaceChecker `json:"net,omitempty"`
	Time            *NamespaceChecker `json:"time,omitempty"`
	TimeForChildren *NamespaceChecker `json:"timeForChildren,omitempty"`
	Cgroup          *NamespaceChecker `json:"cgroup,omitempty"`
	User            *NamespaceChecker `json:"user,omitempty"`
}

type OrderedEventChecker struct {
	// contains filtered or unexported fields
}

type PodChecker struct {
	Namespace    *stringmatcher.StringMatcher           `json:"namespace,omitempty"`
	Name         *stringmatcher.StringMatcher           `json:"name,omitempty"`
	Container    *ContainerChecker                      `json:"container,omitempty"`
	PodLabels    map[string]stringmatcher.StringMatcher `json:"podLabels,omitempty"`
	Workload     *stringmatcher.StringMatcher           `json:"workload,omitempty"`
	WorkloadKind *stringmatcher.StringMatcher           `json:"workloadKind,omitempty"`
}

type ProcessChecker struct {
	ExecId             *stringmatcher.StringMatcher       `json:"execId,omitempty"`
	Pid                *uint32                            `json:"pid,omitempty"`
	Uid                *uint32                            `json:"uid,omitempty"`
	Cwd                *stringmatcher.StringMatcher       `json:"cwd,omitempty"`
	Binary             *stringmatcher.StringMatcher       `json:"binary,omitempty"`
	Arguments          *stringmatcher.StringMatcher       `json:"arguments,omitempty"`
	Flags              *stringmatcher.StringMatcher       `json:"flags,omitempty"`
	StartTime          *timestampmatcher.TimestampMatcher `json:"startTime,omitempty"`
	Auid               *uint32                            `json:"auid,omitempty"`
	Pod                *PodChecker                        `json:"pod,omitempty"`
	Docker             *stringmatcher.StringMatcher       `json:"docker,omitempty"`
	ParentExecId       *stringmatcher.StringMatcher       `json:"parentExecId,omitempty"`
	Refcnt             *uint32                            `json:"refcnt,omitempty"`
	Cap                *CapabilitiesChecker               `json:"cap,omitempty"`
	Ns                 *NamespacesChecker                 `json:"ns,omitempty"`
	Tid                *uint32                            `json:"tid,omitempty"`
	ProcessCredentials *ProcessCredentialsChecker         `json:"processCredentials,omitempty"`
	BinaryProperties   *BinaryPropertiesChecker           `json:"binaryProperties,omitempty"`
}

type ProcessCredentialsChecker struct {
	Uid        *uint32                    `json:"uid,omitempty"`
	Gid        *uint32                    `json:"gid,omitempty"`
	Euid       *uint32                    `json:"euid,omitempty"`
	Egid       *uint32                    `json:"egid,omitempty"`
	Suid       *uint32                    `json:"suid,omitempty"`
	Sgid       *uint32                    `json:"sgid,omitempty"`
	Fsuid      *uint32                    `json:"fsuid,omitempty"`
	Fsgid      *uint32                    `json:"fsgid,omitempty"`
	Securebits *SecureBitsTypeListMatcher `json:"securebits,omitempty"`
	Caps       *CapabilitiesChecker       `json:"caps,omitempty"`
	UserNs     *UserNamespaceChecker      `json:"userNs,omitempty"`
}

type ProcessExecChecker struct {
	CheckerName string              `json:"checkerName"`
	Process     *ProcessChecker     `json:"process,omitempty"`
	Parent      *ProcessChecker     `json:"parent,omitempty"`
	Ancestors   *ProcessListMatcher `json:"ancestors,omitempty"`
}

type ProcessExitChecker struct {
	CheckerName string                             `json:"checkerName"`
	Process     *ProcessChecker                    `json:"process,omitempty"`
	Parent      *ProcessChecker                    `json:"parent,omitempty"`
	Signal      *stringmatcher.StringMatcher       `json:"signal,omitempty"`
	Status      *uint32                            `json:"status,omitempty"`
	Time        *timestampmatcher.TimestampMatcher `json:"time,omitempty"`
}

type ProcessKprobeChecker struct {
	CheckerName      string                       `json:"checkerName"`
	Process          *ProcessChecker              `json:"process,omitempty"`
	Parent           *ProcessChecker              `json:"parent,omitempty"`
	FunctionName     *stringmatcher.StringMatcher `json:"functionName,omitempty"`
	Args             *KprobeArgumentListMatcher   `json:"args,omitempty"`
	Return           *KprobeArgumentChecker       `json:"return,omitempty"`
	Action           *KprobeActionChecker         `json:"action,omitempty"`
	KernelStackTrace *StackTraceEntryListMatcher  `json:"kernelStackTrace,omitempty"`
	PolicyName       *stringmatcher.StringMatcher `json:"policyName,omitempty"`
	ReturnAction     *KprobeActionChecker         `json:"returnAction,omitempty"`
	Message          *stringmatcher.StringMatcher `json:"message,omitempty"`
	Tags             *StringListMatcher           `json:"tags,omitempty"`
	UserStackTrace   *StackTraceEntryListMatcher  `json:"userStackTrace,omitempty"`
}

type ProcessListMatcher struct {
	Operator listmatcher.Operator `json:"operator"`
	Values   []*ProcessChecker    `json:"values"`
}

type ProcessLoaderChecker struct {
	CheckerName string                       `json:"checkerName"`
	Process     *ProcessChecker              `json:"process,omitempty"`
	Path        *stringmatcher.StringMatcher `json:"path,omitempty"`
	Buildid     *bytesmatcher.BytesMatcher   `json:"buildid,omitempty"`
}

type ProcessPrivilegesChangedChecker tetragon.ProcessPrivilegesChanged

type ProcessPrivilegesChangedListMatcher struct {
	Operator listmatcher.Operator               `json:"operator"`
	Values   []*ProcessPrivilegesChangedChecker `json:"values"`
}

type ProcessTracepointChecker struct {
	CheckerName string                       `json:"checkerName"`
	Process     *ProcessChecker              `json:"process,omitempty"`
	Parent      *ProcessChecker              `json:"parent,omitempty"`
	Subsys      *stringmatcher.StringMatcher `json:"subsys,omitempty"`
	Event       *stringmatcher.StringMatcher `json:"event,omitempty"`
	Args        *KprobeArgumentListMatcher   `json:"args,omitempty"`
	PolicyName  *stringmatcher.StringMatcher `json:"policyName,omitempty"`
	Action      *KprobeActionChecker         `json:"action,omitempty"`
	Message     *stringmatcher.StringMatcher `json:"message,omitempty"`
	Tags        *StringListMatcher           `json:"tags,omitempty"`
}

type ProcessUprobeChecker struct {
	CheckerName string                       `json:"checkerName"`
	Process     *ProcessChecker              `json:"process,omitempty"`
	Parent      *ProcessChecker              `json:"parent,omitempty"`
	Path        *stringmatcher.StringMatcher `json:"path,omitempty"`
	Symbol      *stringmatcher.StringMatcher `json:"symbol,omitempty"`
	PolicyName  *stringmatcher.StringMatcher `json:"policyName,omitempty"`
	Message     *stringmatcher.StringMatcher `json:"message,omitempty"`
	Args        *KprobeArgumentListMatcher   `json:"args,omitempty"`
	Tags        *StringListMatcher           `json:"tags,omitempty"`
}

type RateLimitInfoChecker struct {
	CheckerName                  string  `json:"checkerName"`
	NumberOfDroppedProcessEvents *uint64 `json:"numberOfDroppedProcessEvents,omitempty"`
}

type SecureBitsTypeChecker tetragon.SecureBitsType

type SecureBitsTypeListMatcher struct {
	Operator listmatcher.Operator     `json:"operator"`
	Values   []*SecureBitsTypeChecker `json:"values"`
}

type StackTraceEntryChecker struct {
	Address *uint64                      `json:"address,omitempty"`
	Offset  *uint64                      `json:"offset,omitempty"`
	Symbol  *stringmatcher.StringMatcher `json:"symbol,omitempty"`
	Module  *stringmatcher.StringMatcher `json:"module,omitempty"`
}

type StackTraceEntryListMatcher struct {
	Operator listmatcher.Operator      `json:"operator"`
	Values   []*StackTraceEntryChecker `json:"values"`
}

type StringListMatcher struct {
	Operator listmatcher.Operator           `json:"operator"`
	Values   []*stringmatcher.StringMatcher `json:"values"`
}

type TaintedBitsTypeChecker tetragon.TaintedBitsType

type TaintedBitsTypeListMatcher struct {
	Operator listmatcher.Operator      `json:"operator"`
	Values   []*TaintedBitsTypeChecker `json:"values"`
}

type TestChecker struct {
	CheckerName string  `json:"checkerName"`
	Arg0        *uint64 `json:"arg0,omitempty"`
	Arg1        *uint64 `json:"arg1,omitempty"`
	Arg2        *uint64 `json:"arg2,omitempty"`
	Arg3        *uint64 `json:"arg3,omitempty"`
}

type UnorderedEventChecker struct {
	// contains filtered or unexported fields
}

type UserNamespaceChecker struct {
	Level *int32            `json:"level,omitempty"`
	Uid   *uint32           `json:"uid,omitempty"`
	Gid   *uint32           `json:"gid,omitempty"`
	Ns    *NamespaceChecker `json:"ns,omitempty"`
}