17 Commits
Author SHA1 Message Date
Andrei Vagin 5f4abad306 Fix a few typos
It is an idea of running codespell as part of our presubmit checks.
Before enabling it for new changes, let's fix what it has found.

Signed-off-by: Andrei Vagin <avagin@gmail.com>
2023-10-25 12:13:42 -07:00
Adin ScannellandgVisor bot 1ceb814544 Add default_applicable_licenses rules to packages.
PiperOrigin-RevId: 513581243
2023-03-02 10:50:04 -08:00
Shambhavi SrivastavaandgVisor bot dec1aed143 Adding more trace point integration tests for the following syscalls:
- Chdir
- Fchdir
- Setgid
- Setuid
- Setsid
- Setresuid
- Setresgid

Updates #4805

PiperOrigin-RevId: 489076929
2022-11-16 17:06:35 -08:00
Fabricio VoznikaandgVisor bot e6f019594e Add read/write syscalls to trace points
Closes #8092

PiperOrigin-RevId: 488719448
2022-11-15 11:54:23 -08:00
Shambhavi SrivastavaandgVisor bot c8e98d9f5e Add Points to some syscalls
Added a raw syscall points to all syscalls. Added schematized syscall
points to the following syscalls:

  - timerfd_create
  - timerfd_settime
  - timerfd_gettime
  - fork, vfork
  - inotify_init, inotify_init1
  - inotify_add_watch
  - inotify_rm_watch
  - socketpair

Updates #4805

PiperOrigin-RevId: 459596784
2022-07-07 14:10:36 -07:00
Shambhavi SrivastavaandgVisor bot 45b06bbb76 Add Points to some syscalls
Added a raw syscall points to all syscalls. Added schematized syscall
points to the following syscalls:

  - chroot
  - dup, dup2, dup3
  - prlimit64
  - eventfd, eventfd2
  - signalfd, signalfd4
  - bind
  - accept, accept4
  - fcntl
  - pipe, pipe2

Updates #4805

PiperOrigin-RevId: 457139504
2022-06-24 19:37:41 -07:00
Shambhavi SrivastavaandgVisor bot f84e9a85d1 Add Points to some syscalls
Added a raw syscall points to all syscalls. Added schematized syscall
points to the following syscalls:

- Chdir
- Fchdir
- Setgid
- Setuid
- Setsid
- Setresuid
- Setresgid

PiperOrigin-RevId: 451001973
2022-05-25 13:34:03 -07:00
Fabricio VoznikaandgVisor bot d3634c870c Remove unused field from syscall.Read proto
Updates #4805

PiperOrigin-RevId: 450802760
2022-05-24 17:10:26 -07:00
Fabricio VoznikaandgVisor bot e189fb6886 Add version handshake before communication is stablished
Details on how it works is in wire.Handshake.

Updates #4805

PiperOrigin-RevId: 448552448
2022-05-13 12:33:43 -07:00
Fabricio VoznikaandgVisor bot a23e60af39 Fire clone point for thread creation
Thread creation tracking is required by Falco.

Updates #4805

PiperOrigin-RevId: 447003670
2022-05-06 09:28:44 -07:00
Fabricio VoznikaandgVisor bot 2d6e64019b Faster proto serialization
The use of protobuf.Any is convenient, but adds to proto serialization
time and number of memory allocations required to send a message.
Instead, we now use an enum to indentify the message and use it to
determine how to unmarshall the message on the receiveing end. It
also speeds up event consuption by not requiring a map from string
(proto names) to callbacks.

BenchmarkProtoAny-6   115.9 ns/op        210 B/op       4 allocs/op
BenchmarkProtoEnum-6   58.3 ns/op          2 B/op       1 allocs/op

Updates #4805

PiperOrigin-RevId: 446879057
2022-05-05 19:29:49 -07:00
Fabricio VoznikaandgVisor bot f2b6fbb47e Add Points to some syscalls
Added a raw syscall points to all syscalls. Added schematized syscall
points to the following syscalls:

  - read
  - close
  - socket
  - connect
  - execve
  - creat
  - openat
  - execveat

Updates #4805

PiperOrigin-RevId: 446008358
2022-05-02 13:03:04 -07:00
Fabricio VoznikaandgVisor bot 3b269001eb Add container/start context fields
Updates #4805

PiperOrigin-RevId: 445976770
2022-05-02 11:01:08 -07:00
Fabricio VoznikaandgVisor bot 575d76def2 Add support for syscall points
Each syscall provides 4 different points. There is a raw syscall point that
contains the syscall number and all 6 arguments, nothing else. Some syscalls
can provide a schematized version of the syscall by defining a function that
converts the syscall into a proto representing the syscall. Each of these
flavors have a point for enter and another for exit. In both cases, the exit
event adds return value and errno (if any).

Updates #4805

PiperOrigin-RevId: 445510907
2022-04-29 14:49:40 -07:00
Fabricio VoznikaandgVisor bot e1c4bbccf9 Add sentry/task_exit point
Updates #4805

PiperOrigin-RevId: 445222912
2022-04-28 12:45:48 -07:00
Fabricio VoznikaandgVisor bot 93185b4eec Add container/start Point
Updates #4805

PiperOrigin-RevId: 444983390
2022-04-27 15:30:31 -07:00
Fabricio VoznikaandgVisor bot 8a24f200e9 Use proto structs for seccheck points
Given that in most cases points are serialized to another process,
point data is now created diretly into protos.

As part of this change, infrastructure to track optional and context
fields was created to facilitate addition of lots of Points which is
needed for upcomming of changes.

Updates #4805

Currently the SST code is converting seccheck protos into SST protos
in the sentry before sending it to the API. After this change, SST
checker will be changed to send seccheck protos to the API and the
API then converts these into SST on the way to pubsub.

PiperOrigin-RevId: 442688320
2022-04-18 19:03:15 -07:00