From 1aad72663a81205722c4102cfdb62bc789cb1936 Mon Sep 17 00:00:00 2001 From: Fabricio Voznika Date: Tue, 30 Aug 2022 10:46:45 -0700 Subject: [PATCH] Add landing page for Runtime Monitoring PiperOrigin-RevId: 471033778 --- g3doc/user_guide/BUILD | 94 ++++++++++++---------- g3doc/user_guide/runtime_monitoring.md | 20 +++++ pkg/sentry/seccheck/sinks/remote/README.md | 13 +-- website/BUILD | 1 + 4 files changed, 80 insertions(+), 48 deletions(-) create mode 100644 g3doc/user_guide/runtime_monitoring.md diff --git a/g3doc/user_guide/BUILD b/g3doc/user_guide/BUILD index 41d22942a..77e7528d0 100644 --- a/g3doc/user_guide/BUILD +++ b/g3doc/user_guide/BUILD @@ -13,6 +13,57 @@ doc( weight = "0", ) +doc( + name = "install", + src = "install.md", + category = "User Guide", + permalink = "/docs/user_guide/install/", + weight = "10", +) + +doc( + name = "production", + src = "production.md", + category = "User Guide", + data = [ + "sandboxing-tradeoffs.png", + ], + permalink = "/docs/user_guide/production/", + weight = "20", +) + +doc( + name = "platforms", + src = "platforms.md", + category = "User Guide", + permalink = "/docs/user_guide/platforms/", + weight = "30", +) + +doc( + name = "filesystem", + src = "filesystem.md", + category = "User Guide", + permalink = "/docs/user_guide/filesystem/", + weight = "40", +) + +doc( + name = "networking", + src = "networking.md", + category = "User Guide", + permalink = "/docs/user_guide/networking/", + weight = "50", +) + +doc( + name = "runtime_monitoring", + src = "runtime_monitoring.md", + category = "User Guide", + permalink = "/docs/user_guide/runtimemonitor/", + weight = "55", +) + doc( name = "checkpoint_restore", src = "checkpoint_restore.md", @@ -36,46 +87,3 @@ doc( permalink = "/docs/user_guide/faq/", weight = "90", ) - -doc( - name = "filesystem", - src = "filesystem.md", - category = "User Guide", - permalink = "/docs/user_guide/filesystem/", - weight = "40", -) - -doc( - name = "networking", - src = "networking.md", - category = "User Guide", - permalink = "/docs/user_guide/networking/", - weight = "50", -) - -doc( - name = "install", - src = "install.md", - category = "User Guide", - permalink = "/docs/user_guide/install/", - weight = "10", -) - -doc( - name = "platforms", - src = "platforms.md", - category = "User Guide", - permalink = "/docs/user_guide/platforms/", - weight = "30", -) - -doc( - name = "production", - src = "production.md", - category = "User Guide", - data = [ - "sandboxing-tradeoffs.png", - ], - permalink = "/docs/user_guide/production/", - weight = "20", -) diff --git a/g3doc/user_guide/runtime_monitoring.md b/g3doc/user_guide/runtime_monitoring.md new file mode 100644 index 000000000..88c8c69ef --- /dev/null +++ b/g3doc/user_guide/runtime_monitoring.md @@ -0,0 +1,20 @@ +# Runtime Monitoring + +The runtime monitoring feature provides an interface to observe runtime behavior +of applications running inside gVisor. Although it can be used for many +purposes, it was built with the primary focus on threat detection. Out of the +box, gVisor comes with support to stream application actions (called trace +points) to an external process, that is used to validate the actions and alert +when abnormal behavior is detected. Trace points are available for all syscalls +and other important events in the system, e.g. container start. More trace +points can be easily added as needed. The trace points are sent to a process +running alongside the sandbox, which is isolated from the sandbox for security +reasons. Additionally, the monitoring process can be shared by many sandboxes. + +You can use the following links to learn more: + +* [Overview](https://github.com/google/gvisor/blob/master/pkg/sentry/seccheck/README.md) +* [How to implement a monitoring process](https://github.com/google/gvisor/blob/master/pkg/sentry/seccheck/sinks/remote/README.md) +* [Design document](https://docs.google.com/document/d/1RQQKzeFpO-zOoBHZLA-tr5Ed_bvAOLDqgGgKhqUff2A) +* [Configuring Falco with gVisor](https://gvisor.dev/docs/tutorials/falco/) +* [Tracereplay tool for testing](https://github.com/google/gvisor/blob/master/tools/tracereplay/README.md) diff --git a/pkg/sentry/seccheck/sinks/remote/README.md b/pkg/sentry/seccheck/sinks/remote/README.md index 886b4639f..2b98b7949 100644 --- a/pkg/sentry/seccheck/sinks/remote/README.md +++ b/pkg/sentry/seccheck/sinks/remote/README.md @@ -1,10 +1,13 @@ # Introduction -The remote sink implements a protocol that allows a remote process to receive a -stream of trace points being triggered inside the sandbox. The remote sink uses -Unix-domain socket (UDS) to connect to the remote process. The remote process is -expected to have already created the UDS and be listening to new connections. -This allows for a single process to monitor all sandboxes in the machine and +The remote sink implements a protocol that allows remote processes to monitor +actions being taken inside the sandbox. This document provides information +required to implement a monitoring process that consumes trace points. The +remote sink uses a Unix-domain socket (UDS) for communication. It opens a new +connection and sends a stream of trace points being triggered inside the sandbox +to the monitoring process. The monitoring process is expected to have already +created the UDS and be listening for new connections. This allows for a single +process to monitor all sandboxes in the machine, for better resource usage, and simplifies lifecycle management. When a new sandbox starts, it creates a new connection. And when a sandbox exits, the connection is terminated. diff --git a/website/BUILD b/website/BUILD index 1e90a62ae..d038bad1d 100644 --- a/website/BUILD +++ b/website/BUILD @@ -157,6 +157,7 @@ docs( "//g3doc/user_guide:networking", "//g3doc/user_guide:platforms", "//g3doc/user_guide:production", + "//g3doc/user_guide:runtime_monitoring", "//g3doc/user_guide/containerd:configuration", "//g3doc/user_guide/containerd:containerd_11", "//g3doc/user_guide/containerd:quick_start",