diff --git a/falco_event/src/types/primitive/newtypes.rs b/falco_event/src/types/primitive/newtypes.rs index a66d43dd..f54fceac 100644 --- a/falco_event/src/types/primitive/newtypes.rs +++ b/falco_event/src/types/primitive/newtypes.rs @@ -205,6 +205,21 @@ impl Debug for Fd { } } +newtype!( + /// File descriptor (32-bit) + Fd32(i32) +); + +impl Debug for Fd32 { + fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result { + if self.0 == -100 { + f.write_str("AT_FDCWD") + } else { + Debug::fmt(&self.0, f) + } + } +} + #[cfg(test)] mod fd_tests { use crate::types::Fd; @@ -222,6 +237,12 @@ newtype!( ); default_debug!(Pid); +newtype!( + /// Process or thread id (32-bit) + Pid32(i32) +); +default_debug!(Pid32); + newtype!( /// User id Uid(u32) @@ -304,6 +325,23 @@ newtype!( ); default_debug!(Port); +impl LowerHex for Port { + fn fmt(&self, f: &mut Formatter<'_>) -> std::fmt::Result { + Debug::fmt(&self, f) + } +} + +#[cfg(test)] +mod port_tests { + use crate::types::Port; + + #[test] + fn test_port() { + assert_eq!(format!("{:?}", Port(12345)), "12345"); + assert_eq!(format!("{:x}", Port(12345)), "12345"); + } +} + newtype!( /// Layer 4 protocol (tcp/udp) /// diff --git a/falco_event_schema/api/SCHEMA_VERSION b/falco_event_schema/api/SCHEMA_VERSION index 1454f6ed..a84947d6 100644 --- a/falco_event_schema/api/SCHEMA_VERSION +++ b/falco_event_schema/api/SCHEMA_VERSION @@ -1 +1 @@ -4.0.1 +4.5.0 diff --git a/falco_event_schema/api/dynamic_params_table.c b/falco_event_schema/api/dynamic_params_table.c index c55e7d0f..2912f8a5 100644 --- a/falco_event_schema/api/dynamic_params_table.c +++ b/falco_event_schema/api/dynamic_params_table.c @@ -27,3 +27,8 @@ const struct ppm_param_info bpf_dynamic_param[PPM_BPF_IDX_MAX] = { [PPM_BPF_IDX_FD] = {{0}, PT_FD, PF_DEC, 0, 0}, [PPM_BPF_IDX_RES] = {{0}, PT_ERRNO, PF_DEC, 0, 0}, }; + +const struct ppm_param_info keyctl_dynamic_param[PPM_KEYCTL_IDX_MAX] = { + [PPM_KEYCTL_IDX_INT64] = {{0}, PT_INT64, PF_DEC, 0, 0}, + [PPM_KEYCTL_IDX_CHARBUF] = {{0}, PT_CHARBUF, PF_NA, 0, 0}, +}; diff --git a/falco_event_schema/api/event_table.c b/falco_event_schema/api/event_table.c index 71220b5d..d7e3cf83 100644 --- a/falco_event_schema/api/event_table.c +++ b/falco_event_schema/api/event_table.c @@ -18,6 +18,7 @@ or GPL2.txt for full copies of the license. * - `EC_TRACEPOINT * - `EC_PLUGIN` * - `EC_METAEVENT` + * - `EC_ITER` * * 2. The lowest bits represent the syscall category to which the specific event belongs. * @@ -177,11 +178,12 @@ const struct ppm_event_info g_event_info[] = { [PPME_SOCKET_SOCKET_X] = {"socket", EC_NET | EC_SYSCALL, EF_CREATES_FD | EF_MODIFIES_STATE | EF_CONVERTER_MANAGED, - 4, + 5, {{"fd", PT_FD, PF_DEC}, {"domain", PT_ENUMFLAGS32, PF_DEC, socket_families}, {"type", PT_UINT32, PF_DEC}, - {"proto", PT_UINT32, PF_DEC}}}, + {"proto", PT_UINT32, PF_DEC}, + {"flags", PT_FLAGS32, PF_HEX, file_flags}}}, [PPME_SOCKET_BIND_E] = {"bind", EC_NET | EC_SYSCALL, EF_OLD_VERSION | EF_USES_FD | EF_MODIFIES_STATE | @@ -966,10 +968,11 @@ const struct ppm_event_info g_event_info[] = { [PPME_SYSCALL_FCNTL_X] = {"fcntl", EC_IO_OTHER | EC_SYSCALL, EF_USES_FD | EF_MODIFIES_STATE | EF_CONVERTER_MANAGED, - 3, + 4, {{"res", PT_FD, PF_DEC}, {"fd", PT_FD, PF_DEC}, - {"cmd", PT_ENUMFLAGS8, PF_DEC, fcntl_commands}}}, + {"cmd", PT_ENUMFLAGS8, PF_DEC, fcntl_commands}, + {"arg", PT_UINT64, PF_HEX}}}, [PPME_SCHEDSWITCH_6_E] = {"switch", EC_SCHEDULER | EC_TRACEPOINT, @@ -1351,6 +1354,15 @@ const struct ppm_event_info g_event_info[] = { {{"event_type", PT_UINT32, PF_DEC}, {"event_data", PT_UINT64, PF_DEC}}}, [PPME_SCAPEVENT_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_SYSCALL_CLOSE_RANGE_E] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_SYSCALL_CLOSE_RANGE_X] = {"close_range", + EC_IO_OTHER | EC_SYSCALL, + EF_MODIFIES_STATE, + 4, + {{"res", PT_ERRNO, PF_DEC}, + {"first", PT_UINT32, PF_DEC}, + {"last", PT_UINT32, PF_DEC}, + {"flags", PT_FLAGS32, PF_HEX, close_range_flags}}}, [PPME_SYSCALL_SETUID_E] = {"setuid", EC_USER | EC_SYSCALL, EF_OLD_VERSION | EF_MODIFIES_STATE | EF_CONVERTER_MANAGED, @@ -1981,7 +1993,7 @@ const struct ppm_event_info g_event_info[] = { [PPME_SYSCALL_EXECVE_19_X] = {"execve", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE | EF_CONVERTER_MANAGED, - 30, + 31, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, @@ -2011,7 +2023,8 @@ const struct ppm_event_info g_event_info[] = { {"uid", PT_UID, PF_DEC}, {"trusted_exepath", PT_FSPATH, PF_NA}, {"pgid", PT_PID, PF_NA}, - {"gid", PT_GID, PF_DEC}}}, + {"gid", PT_GID, PF_DEC}, + {"filename", PT_FSPATH, PF_NA}}}, [PPME_SYSCALL_SETPGID_E] = {"setpgid", EC_PROCESS | EC_SYSCALL, EF_OLD_VERSION | EF_CONVERTER_MANAGED, @@ -2796,6 +2809,149 @@ const struct ppm_event_info g_event_info[] = { {{"res", PT_ERRNO, PF_DEC}, {"rgid", PT_UID, PF_DEC}, {"egid", PT_UID, PF_DEC}}}, + [PPME_ITER_TASK_E] = {"task", + EC_ITER | EC_PROCESS, + EF_MODIFIES_STATE, + 32, + {{"ppid", PT_PID32, PF_DEC}, + {"pgid", PT_PID32, PF_DEC}, + {"vpgid", PT_PID32, PF_DEC}, + {"sid", PT_PID32, PF_DEC}, + {"comm", PT_CHARBUF, PF_NA}, + {"argv", PT_CHARBUFARRAY, PF_NA}, + {"exepath", PT_FSPATH, PF_NA}, + {"flags", PT_FLAGS32, PF_HEX, execve_flags}, + {"env", PT_CHARBUFARRAY, PF_NA}, + {"cwd", PT_CHARBUF, PF_NA}, + {"fdlimit", PT_UINT64, PF_DEC}, + {"euid", PT_UID, PF_DEC}, + {"egid", PT_GID, PF_DEC}, + {"cap_permitted", PT_UINT64, PF_HEX}, + {"cap_effective", PT_UINT64, PF_HEX}, + {"cap_inheritable", PT_UINT64, PF_HEX}, + {"exe_ino_num", PT_UINT64, PF_DEC}, + {"exe_ino_ctime", PT_ABSTIME, PF_DEC}, + {"exe_ino_mtime", PT_ABSTIME, PF_DEC}, + {"vm_size", PT_UINT32, PF_DEC}, + {"vm_rss", PT_UINT32, PF_DEC}, + {"vm_swap", PT_UINT32, PF_DEC}, + {"pgft_maj", PT_UINT64, PF_DEC}, + {"pgft_min", PT_UINT64, PF_DEC}, + {"vtgid", PT_PID32, PF_DEC}, + {"vpid", PT_PID32, PF_DEC}, + {"pidns_init_start_ts", PT_UINT64, PF_DEC}, + {"cgroups", PT_CHARBUFARRAY, PF_NA}, + {"root", PT_FSPATH, PF_NA}, + {"start_time", PT_ABSTIME, PF_DEC}, + {"tty", PT_UINT32, PF_DEC}, + {"loginuid", PT_UID, PF_DEC}}}, + [PPME_ITER_TASK_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_PIPE_E] = {"task_file_pipe", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 3, + {{"fd", PT_FD32, PF_DEC}, + {"path", PT_FSPATH, PF_NA}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_PIPE_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_MEMFD_E] = {"task_file_memfd", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 3, + {{"fd", PT_FD32, PF_DEC}, + {"path", PT_FSPATH, PF_NA}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_MEMFD_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_REGULAR_E] = {"task_file_regular", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 5, + {{"fd", PT_FD32, PF_DEC}, + {"path", PT_FSPATH, PF_NA}, + {"flags", PT_FLAGS32, PF_HEX, file_flags}, + {"mnt_id", PT_UINT32, PF_DEC}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_REGULAR_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_DIRECTORY_E] = {"task_file_directory", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 3, + {{"fd", PT_FD32, PF_DEC}, + {"path", PT_FSPATH, PF_NA}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_DIRECTORY_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + + [PPME_ITER_TASK_FILE_SOCKET_INET_E] = {"task_file_socket_inet", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 8, + {{"fd", PT_FD32, PF_DEC}, + {"sk_type", PT_UINT16, PF_DEC}, + {"sk_proto", PT_UINT16, PF_DEC}, + {"local_ip", PT_IPV4ADDR, PF_HEX}, + {"local_port", PT_PORT, PF_HEX}, + {"remote_ip", PT_IPV4ADDR, PF_HEX}, + {"remote_port", PT_PORT, PF_HEX}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_SOCKET_INET_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + + [PPME_ITER_TASK_FILE_SOCKET_INET6_E] = {"task_file_socket_inet6", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 8, + {{"fd", PT_FD32, PF_DEC}, + {"sk_type", PT_UINT16, PF_DEC}, + {"sk_proto", PT_UINT16, PF_DEC}, + {"local_ip", PT_IPV6ADDR, PF_HEX}, + {"local_port", PT_PORT, PF_HEX}, + {"remote_ip", PT_IPV6ADDR, PF_HEX}, + {"remote_port", PT_PORT, PF_HEX}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_SOCKET_INET6_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_SOCKET_UNIX_E] = {"task_file_socket_unix", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 6, + {{"fd", PT_FD32, PF_DEC}, + {"sk_type", PT_UINT16, PF_DEC}, + {"sk_proto", PT_UINT16, PF_DEC}, + {"sk_pointer", PT_UINT64, PF_NA}, + {"sun_path", PT_FSPATH, PF_NA}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_SOCKET_UNIX_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_SOCKET_NETLINK_E] = {"task_file_socket_netlink", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 4, + {{"fd", PT_FD32, PF_DEC}, + {"sk_type", PT_UINT16, PF_DEC}, + {"sk_proto", PT_UINT16, PF_DEC}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_SOCKET_NETLINK_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_ANON_INODE_E] = + {"task_file_anon_inode", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 4, + {{"fd", PT_FD32, PF_DEC}, + {"fd_type", PT_FLAGS8, PF_DEC, anon_inode_fd_types}, + {"path", + PT_FSPATH, + PF_NA}, // filled only if `fd_type == ANON_INODE_FD_TYPE_UNKNOWN` + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_ANON_INODE_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_SYSCALL_KEYCTL_E] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_SYSCALL_KEYCTL_X] = + {"keyctl", + EC_OTHER | EC_SYSCALL, + EF_NONE, + 6, + {{"res", PT_ERRNO, PF_DEC}, + {"operation", PT_ENUMFLAGS32, PF_DEC, keyctl_operations}, + {"arg2", PT_DYN, PF_DEC, keyctl_dynamic_param, PPM_KEYCTL_IDX_MAX}, + {"arg3", PT_DYN, PF_DEC, keyctl_dynamic_param, PPM_KEYCTL_IDX_MAX}, + {"arg4", PT_DYN, PF_DEC, keyctl_dynamic_param, PPM_KEYCTL_IDX_MAX}, + {"arg5", PT_DYN, PF_DEC, keyctl_dynamic_param, PPM_KEYCTL_IDX_MAX}}}, }; #pragma GCC diagnostic pop diff --git a/falco_event_schema/api/flag_types b/falco_event_schema/api/flag_types index 75e8ef3f..e9a7ab44 100644 --- a/falco_event_schema/api/flag_types +++ b/falco_event_schema/api/flag_types @@ -49,4 +49,7 @@ type fsconfig_cmds: PT_ENUMFLAGS32; type prctl_options: PT_ENUMFLAGS32; type pidfd_open_flags: PT_FLAGS32; type finit_module_flags: PT_FLAGS32; -type creat_flags: PT_FLAGS16; \ No newline at end of file +type creat_flags: PT_FLAGS16; +type anon_inode_fd_types: PT_FLAGS8; +type close_range_flags: PT_FLAGS32; +type keyctl_operations: PT_ENUMFLAGS32; diff --git a/falco_event_schema/api/flags_table.c b/falco_event_schema/api/flags_table.c index 3b1bede1..ff7e73e4 100644 --- a/falco_event_schema/api/flags_table.c +++ b/falco_event_schema/api/flags_table.c @@ -119,6 +119,7 @@ const struct ppm_name_value clone_flags[] = { {"CLONE_STOPPED", PPM_CL_CLONE_STOPPED}, {"CLONE_VFORK", PPM_CL_CLONE_VFORK}, {"CLONE_NEWCGROUP", PPM_CL_CLONE_NEWCGROUP}, + {"CLONE_CHILD_IN_PIDNS", PPM_CL_CHILD_IN_PIDNS}, {0, 0}, }; @@ -692,6 +693,43 @@ const struct ppm_name_value prctl_options[] = { {0, 0}, }; +const struct ppm_name_value keyctl_operations[] = { + {"KEYCTL_GET_KEYRING_ID", PPM_KEYCTL_GET_KEYRING_ID}, + {"KEYCTL_JOIN_SESSION_KEYRING", PPM_KEYCTL_JOIN_SESSION_KEYRING}, + {"KEYCTL_UPDATE", PPM_KEYCTL_UPDATE}, + {"KEYCTL_REVOKE", PPM_KEYCTL_REVOKE}, + {"KEYCTL_CHOWN", PPM_KEYCTL_CHOWN}, + {"KEYCTL_SETPERM", PPM_KEYCTL_SETPERM}, + {"KEYCTL_DESCRIBE", PPM_KEYCTL_DESCRIBE}, + {"KEYCTL_CLEAR", PPM_KEYCTL_CLEAR}, + {"KEYCTL_LINK", PPM_KEYCTL_LINK}, + {"KEYCTL_UNLINK", PPM_KEYCTL_UNLINK}, + {"KEYCTL_SEARCH", PPM_KEYCTL_SEARCH}, + {"KEYCTL_READ", PPM_KEYCTL_READ}, + {"KEYCTL_INSTANTIATE", PPM_KEYCTL_INSTANTIATE}, + {"KEYCTL_NEGATE", PPM_KEYCTL_NEGATE}, + {"KEYCTL_SET_REQKEY_KEYRING", PPM_KEYCTL_SET_REQKEY_KEYRING}, + {"KEYCTL_SET_TIMEOUT", PPM_KEYCTL_SET_TIMEOUT}, + {"KEYCTL_ASSUME_AUTHORITY", PPM_KEYCTL_ASSUME_AUTHORITY}, + {"KEYCTL_GET_SECURITY", PPM_KEYCTL_GET_SECURITY}, + {"KEYCTL_SESSION_TO_PARENT", PPM_KEYCTL_SESSION_TO_PARENT}, + {"KEYCTL_REJECT", PPM_KEYCTL_REJECT}, + {"KEYCTL_INSTANTIATE_IOV", PPM_KEYCTL_INSTANTIATE_IOV}, + {"KEYCTL_INVALIDATE", PPM_KEYCTL_INVALIDATE}, + {"KEYCTL_GET_PERSISTENT", PPM_KEYCTL_GET_PERSISTENT}, + {"KEYCTL_DH_COMPUTE", PPM_KEYCTL_DH_COMPUTE}, + {"KEYCTL_PKEY_QUERY", PPM_KEYCTL_PKEY_QUERY}, + {"KEYCTL_PKEY_ENCRYPT", PPM_KEYCTL_PKEY_ENCRYPT}, + {"KEYCTL_PKEY_DECRYPT", PPM_KEYCTL_PKEY_DECRYPT}, + {"KEYCTL_PKEY_SIGN", PPM_KEYCTL_PKEY_SIGN}, + {"KEYCTL_PKEY_VERIFY", PPM_KEYCTL_PKEY_VERIFY}, + {"KEYCTL_RESTRICT_KEYRING", PPM_KEYCTL_RESTRICT_KEYRING}, + {"KEYCTL_MOVE", PPM_KEYCTL_MOVE}, + {"KEYCTL_CAPABILITIES", PPM_KEYCTL_CAPABILITIES}, + {"KEYCTL_WATCH_KEY", PPM_KEYCTL_WATCH_KEY}, + {0, 0}, +}; + const struct ppm_name_value memfd_create_flags[] = { {"MFD_CLOEXEC", PPM_MFD_CLOEXEC}, {"MFD_ALLOW_SEALING", PPM_MFD_ALLOW_SEALING}, @@ -772,9 +810,33 @@ const struct ppm_name_value delete_module_flags[] = { {0, 0}, }; +const struct ppm_name_value close_range_flags[] = { + {"CLOSE_RANGE_UNSHARE", PPM_CLOSE_RANGE_UNSHARE}, + {"CLOSE_RANGE_CLOEXEC", PPM_CLOSE_RANGE_CLOEXEC}, + {0, 0}, +}; + const struct ppm_name_value finit_module_flags[] = { {"MODULE_INIT_IGNORE_MODVERSIONS", PPM_MODULE_INIT_IGNORE_MODVERSIONS}, {"MODULE_INIT_IGNORE_VERMAGIC", PPM_MODULE_INIT_IGNORE_VERMAGIC}, {"MODULE_INIT_COMPRESSED_FILE", PPM_MODULE_INIT_COMPRESSED_FILE}, {0, 0}, }; + +const struct ppm_name_value anon_inode_fd_types[] = { + {"ANON_INODE_FD_TYPE_UNKNOWN", ANON_INODE_FD_TYPE_UNKNOWN}, + {"ANON_INODE_FD_TYPE_EVENTFD", ANON_INODE_FD_TYPE_EVENTFD}, + {"ANON_INODE_FD_TYPE_EVENTPOLL", ANON_INODE_FD_TYPE_EVENTPOLL}, + {"ANON_INODE_FD_TYPE_INOTIFY", ANON_INODE_FD_TYPE_INOTIFY}, + {"ANON_INODE_FD_TYPE_SIGNALFD", ANON_INODE_FD_TYPE_SIGNALFD}, + {"ANON_INODE_FD_TYPE_TIMERFD", ANON_INODE_FD_TYPE_TIMERFD}, + {"ANON_INODE_FD_TYPE_IO_URING", ANON_INODE_FD_TYPE_IO_URING}, + {"ANON_INODE_FD_TYPE_USERFAULTFD", ANON_INODE_FD_TYPE_USERFAULTFD}, + {"ANON_INODE_FD_TYPE_PIDFD", ANON_INODE_FD_TYPE_PIDFD}, + {"ANON_INODE_FD_TYPE_BPF_MAP", ANON_INODE_FD_TYPE_BPF_MAP}, + {"ANON_INODE_FD_TYPE_BPF_PROG", ANON_INODE_FD_TYPE_BPF_PROG}, + {"ANON_INODE_FD_TYPE_BPF_LINK", ANON_INODE_FD_TYPE_BPF_LINK}, + {"ANON_INODE_FD_TYPE_BPF_ITER", ANON_INODE_FD_TYPE_BPF_ITER}, + {"ANON_INODE_FD_TYPE_PERF_EVENT", ANON_INODE_FD_TYPE_PERF_EVENT}, + {0, 0}, +}; diff --git a/falco_event_schema/api/ppm_events_public.h b/falco_event_schema/api/ppm_events_public.h index 07c110b5..3b10eb8f 100644 --- a/falco_event_schema/api/ppm_events_public.h +++ b/falco_event_schema/api/ppm_events_public.h @@ -512,6 +512,10 @@ or GPL2.txt for full copies of the license. #define PPM_BPF_IDX_MAX 2 +#define PPM_KEYCTL_IDX_INT64 0 +#define PPM_KEYCTL_IDX_CHARBUF 1 +#define PPM_KEYCTL_IDX_MAX 2 + /* * memory protection flags */ @@ -841,6 +845,12 @@ or GPL2.txt for full copies of the license. #define PPM_DELETE_MODULE_O_TRUNC (1 << 0) #define PPM_DELETE_MODULE_O_NONBLOCK (1 << 1) +/* + * close_range flags + */ +#define PPM_CLOSE_RANGE_UNSHARE (1 << 1) +#define PPM_CLOSE_RANGE_CLOEXEC (1 << 2) + /* * bpf_commands */ @@ -986,6 +996,43 @@ or GPL2.txt for full copies of the license. #define PPM_PR_SET_VMA 0x53564d41 +/* + * keyctl() operations - taken from + */ +#define PPM_KEYCTL_GET_KEYRING_ID 0 +#define PPM_KEYCTL_JOIN_SESSION_KEYRING 1 +#define PPM_KEYCTL_UPDATE 2 +#define PPM_KEYCTL_REVOKE 3 +#define PPM_KEYCTL_CHOWN 4 +#define PPM_KEYCTL_SETPERM 5 +#define PPM_KEYCTL_DESCRIBE 6 +#define PPM_KEYCTL_CLEAR 7 +#define PPM_KEYCTL_LINK 8 +#define PPM_KEYCTL_UNLINK 9 +#define PPM_KEYCTL_SEARCH 10 +#define PPM_KEYCTL_READ 11 +#define PPM_KEYCTL_INSTANTIATE 12 +#define PPM_KEYCTL_NEGATE 13 +#define PPM_KEYCTL_SET_REQKEY_KEYRING 14 +#define PPM_KEYCTL_SET_TIMEOUT 15 +#define PPM_KEYCTL_ASSUME_AUTHORITY 16 +#define PPM_KEYCTL_GET_SECURITY 17 +#define PPM_KEYCTL_SESSION_TO_PARENT 18 +#define PPM_KEYCTL_REJECT 19 +#define PPM_KEYCTL_INSTANTIATE_IOV 20 +#define PPM_KEYCTL_INVALIDATE 21 +#define PPM_KEYCTL_GET_PERSISTENT 22 +#define PPM_KEYCTL_DH_COMPUTE 23 +#define PPM_KEYCTL_PKEY_QUERY 24 +#define PPM_KEYCTL_PKEY_ENCRYPT 25 +#define PPM_KEYCTL_PKEY_DECRYPT 26 +#define PPM_KEYCTL_PKEY_SIGN 27 +#define PPM_KEYCTL_PKEY_VERIFY 28 +#define PPM_KEYCTL_RESTRICT_KEYRING 29 +#define PPM_KEYCTL_MOVE 30 +#define PPM_KEYCTL_CAPABILITIES 31 +#define PPM_KEYCTL_WATCH_KEY 32 + /* * SuS says limits have to be unsigned. * Which makes a ton more sense anyway. @@ -1513,7 +1560,31 @@ typedef enum { PPME_SYSCALL_SETREUID_X = 427, PPME_SYSCALL_SETREGID_E = 428, PPME_SYSCALL_SETREGID_X = 429, - PPM_EVENT_MAX = 430 + PPME_ITER_TASK_E = 430, + PPME_ITER_TASK_X = 431, + PPME_ITER_TASK_FILE_PIPE_E = 432, + PPME_ITER_TASK_FILE_PIPE_X = 433, + PPME_ITER_TASK_FILE_MEMFD_E = 434, + PPME_ITER_TASK_FILE_MEMFD_X = 435, + PPME_ITER_TASK_FILE_REGULAR_E = 436, + PPME_ITER_TASK_FILE_REGULAR_X = 437, + PPME_ITER_TASK_FILE_DIRECTORY_E = 438, + PPME_ITER_TASK_FILE_DIRECTORY_X = 439, + PPME_ITER_TASK_FILE_SOCKET_INET_E = 440, + PPME_ITER_TASK_FILE_SOCKET_INET_X = 441, + PPME_ITER_TASK_FILE_SOCKET_INET6_E = 442, + PPME_ITER_TASK_FILE_SOCKET_INET6_X = 443, + PPME_ITER_TASK_FILE_SOCKET_UNIX_E = 444, + PPME_ITER_TASK_FILE_SOCKET_UNIX_X = 445, + PPME_ITER_TASK_FILE_SOCKET_NETLINK_E = 446, + PPME_ITER_TASK_FILE_SOCKET_NETLINK_X = 447, + PPME_ITER_TASK_FILE_ANON_INODE_E = 448, + PPME_ITER_TASK_FILE_ANON_INODE_X = 449, + PPME_SYSCALL_CLOSE_RANGE_E = 450, + PPME_SYSCALL_CLOSE_RANGE_X = 451, + PPME_SYSCALL_KEYCTL_E = 452, + PPME_SYSCALL_KEYCTL_X = 453, + PPM_EVENT_MAX = 454 } ppm_event_code; /*@}*/ @@ -1996,7 +2067,10 @@ enum sys_exit_extra_code { PPM_SC_X(SETXATTRAT, 447) \ PPM_SC_X(OPEN_TREE_ATTR, 448) \ PPM_SC_X(FILE_GETATTR, 449) \ - PPM_SC_X(FILE_SETATTR, 450) + PPM_SC_X(FILE_SETATTR, 450) \ + PPM_SC_X(LISTNS, 451) \ + PPM_SC_X(UPROBE, 452) \ + PPM_SC_X(RSEQ_SLICE_YIELD, 453) typedef enum { #define PPM_SC_X(name, value) PPM_SC_##name = (value), @@ -2034,6 +2108,7 @@ enum ppm_event_category { EC_PLUGIN = (1 << 11), /* Event generated by a plugin */ EC_METAEVENT = (1 << 12), /* Meta-event not generated by a source but used for notifications or enrichment */ + EC_ITER = (1 << 13), /* Event generated by a kernel iterator */ }; enum ppm_event_flags { @@ -2105,7 +2180,7 @@ enum ppm_param_type { PT_DOUBLE = 33, /* this is a double precision floating point number. */ PT_SIGSET = 34, /* sigset_t. I only store the lower UINT32 of it */ PT_CHARBUFARRAY = 35, /* Pointer to an array of strings, exported by the user events decoder. - 64bit. For internal use only. */ + 64bit. */ PT_CHARBUF_PAIR_ARRAY = 36, /* Pointer to an array of string pairs, exported by the user events decoder. 64bit. For internal use only. */ PT_IPV4NET = 37, /* An IPv4 network. */ @@ -2121,7 +2196,9 @@ enum ppm_param_type { contiguous values flag. */ PT_ENUMFLAGS32 = 46, /* this is an UINT32, but will be interpreted as an enum flag, ie: contiguous values flag. */ - PT_MAX = 47 /* array size */ + PT_FD32 = 47, /* A file descriptor, encoded using 32 bits. */ + PT_PID32 = 48, /* A process identifier, encoded using 32 bits. */ + PT_MAX = 49 /* array size */ }; enum ppm_print_format { @@ -2279,14 +2356,18 @@ extern const struct ppm_name_value fsconfig_cmds[]; extern const struct ppm_name_value epoll_create1_flags[]; extern const struct ppm_name_value fchownat_flags[]; extern const struct ppm_name_value prctl_options[]; +extern const struct ppm_name_value keyctl_operations[]; extern const struct ppm_name_value memfd_create_flags[]; extern const struct ppm_name_value pidfd_open_flags[]; extern const struct ppm_name_value bpf_commands[]; extern const struct ppm_param_info sockopt_dynamic_param[]; extern const struct ppm_param_info ptrace_dynamic_param[]; extern const struct ppm_param_info bpf_dynamic_param[]; +extern const struct ppm_param_info keyctl_dynamic_param[]; extern const struct ppm_name_value delete_module_flags[]; +extern const struct ppm_name_value close_range_flags[]; extern const struct ppm_name_value finit_module_flags[]; +extern const struct ppm_name_value anon_inode_fd_types[]; /*! \brief Process information as returned by the PPM_IOCTL_GET_PROCLIST IOCTL. */ @@ -2296,11 +2377,18 @@ struct ppm_proc_info { uint64_t stime; }; +#ifdef _MSC_VER +#pragma warning(push) +#pragma warning(disable : 4200) +#endif struct ppm_proclist_info { int64_t n_entries; int64_t max_entries; - struct ppm_proc_info entries[0]; + struct ppm_proc_info entries[]; }; +#ifdef _MSC_VER +#pragma warning(pop) +#endif enum syscall_flags { UF_NONE = 0, @@ -2330,11 +2418,10 @@ struct syscall_evt_pair { /* * Max size of a parameter in the kernel module is uint16_t, so no point - * in going beyond 0xffff. However, in BPF the limit is more stringent - * because the entire perf event must fit in uint16_t, so make this - * a more conservative 65k so we have some room for the other - * parameters in the event. It shouldn't cause issues since typically - * snaplen is much lower than this. + * in going beyond 0xffff. Notice: this is less than 2^16 - 1 for historical reasons, linked to the + * fact that this value was also used in the legacy BPF probe: the limit there was more stringent, + * because the entire perf event had to fit in uint16_t. Keep it as is for the moment, as this + * shouldn't cause any issues since typically snaplen is much lower than this. */ #define PPM_MAX_ARG_SIZE 65000 @@ -2383,4 +2470,25 @@ struct ppm_event_entry { #define PPM_FAILURE_FRAME_SCRATCH_MAP_FULL \ -5 /* this is used only inside bpf, kernel module does not have a frame scratch map*/ +enum anon_inode_fd_type { + ANON_INODE_FD_TYPE_UNKNOWN = 0, + ANON_INODE_FD_TYPE_EVENTFD = 1, + ANON_INODE_FD_TYPE_EVENTPOLL = 2, + ANON_INODE_FD_TYPE_INOTIFY = 3, + ANON_INODE_FD_TYPE_SIGNALFD = 4, + ANON_INODE_FD_TYPE_TIMERFD = 5, + ANON_INODE_FD_TYPE_IO_URING = 6, + ANON_INODE_FD_TYPE_USERFAULTFD = 7, + ANON_INODE_FD_TYPE_PIDFD = 8, + ANON_INODE_FD_TYPE_BPF_MAP = 9, + ANON_INODE_FD_TYPE_BPF_PROG = 10, + ANON_INODE_FD_TYPE_BPF_LINK = 11, + ANON_INODE_FD_TYPE_BPF_ITER = 12, + ANON_INODE_FD_TYPE_PERF_EVENT = 13, +}; + +// Maximum size of an event generated by an iterator. This currently must match `MAX_EVENT_SIZE` in +// the modern eBPF probe. +#define MAX_ITER_EVENT_SIZE 64 * 1024 + #endif /* EVENTS_PUBLIC_H_ */ diff --git a/falco_event_schema/api/ppm_fillers.h b/falco_event_schema/api/ppm_fillers.h index 6c0a1e32..1c1cfef6 100644 --- a/falco_event_schema/api/ppm_fillers.h +++ b/falco_event_schema/api/ppm_fillers.h @@ -173,10 +173,12 @@ or GPL2.txt for full copies of the license. FN(sys_process_vm_readv_x) \ FN(sys_process_vm_writev_x) \ FN(sys_delete_module_x) \ + FN(sys_close_range_x) \ FN(sys_pread64_x) \ FN(sys_pwrite64_x) \ FN(sys_setuid_x) \ FN(sys_setresuid_x) \ + FN(sys_keyctl_x) \ FN(terminate_filler) #define FILLER_ENUM_FN(x) PPM_FILLER_##x, diff --git a/falco_event_schema/src/events.rs b/falco_event_schema/src/events.rs index 8139de43..971361bd 100644 --- a/falco_event_schema/src/events.rs +++ b/falco_event_schema/src/events.rs @@ -129,11 +129,12 @@ event_info! { [PPME_SOCKET_SOCKET_X] = {"socket", EC_NET | EC_SYSCALL, EF_CREATES_FD | EF_MODIFIES_STATE | EF_CONVERTER_MANAGED, - 4, + 5, {{"fd", PT_FD, PF_DEC}, {"domain", PT_ENUMFLAGS32, PF_DEC, socket_families}, {"type", PT_UINT32, PF_DEC}, - {"proto", PT_UINT32, PF_DEC}}}, + {"proto", PT_UINT32, PF_DEC}, + {"flags", PT_FLAGS32, PF_HEX, file_flags}}}, [PPME_SOCKET_BIND_E] = {"bind", EC_NET | EC_SYSCALL, EF_OLD_VERSION | EF_USES_FD | EF_MODIFIES_STATE | @@ -918,10 +919,11 @@ event_info! { [PPME_SYSCALL_FCNTL_X] = {"fcntl", EC_IO_OTHER | EC_SYSCALL, EF_USES_FD | EF_MODIFIES_STATE | EF_CONVERTER_MANAGED, - 3, + 4, {{"res", PT_FD, PF_DEC}, {"fd", PT_FD, PF_DEC}, - {"cmd", PT_ENUMFLAGS8, PF_DEC, fcntl_commands}}}, + {"cmd", PT_ENUMFLAGS8, PF_DEC, fcntl_commands}, + {"arg", PT_UINT64, PF_HEX}}}, [PPME_SCHEDSWITCH_6_E] = {"switch", EC_SCHEDULER | EC_TRACEPOINT, @@ -1303,6 +1305,15 @@ event_info! { {{"event_type", PT_UINT32, PF_DEC}, {"event_data", PT_UINT64, PF_DEC}}}, [PPME_SCAPEVENT_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_SYSCALL_CLOSE_RANGE_E] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_SYSCALL_CLOSE_RANGE_X] = {"close_range", + EC_IO_OTHER | EC_SYSCALL, + EF_MODIFIES_STATE, + 4, + {{"res", PT_ERRNO, PF_DEC}, + {"first", PT_UINT32, PF_DEC}, + {"last", PT_UINT32, PF_DEC}, + {"flags", PT_FLAGS32, PF_HEX, close_range_flags}}}, [PPME_SYSCALL_SETUID_E] = {"setuid", EC_USER | EC_SYSCALL, EF_OLD_VERSION | EF_MODIFIES_STATE | EF_CONVERTER_MANAGED, @@ -1933,7 +1944,7 @@ event_info! { [PPME_SYSCALL_EXECVE_19_X] = {"execve", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE | EF_CONVERTER_MANAGED, - 30, + 31, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, @@ -1963,7 +1974,8 @@ event_info! { {"uid", PT_UID, PF_DEC}, {"trusted_exepath", PT_FSPATH, PF_NA}, {"pgid", PT_PID, PF_NA}, - {"gid", PT_GID, PF_DEC}}}, + {"gid", PT_GID, PF_DEC}, + {"filename", PT_FSPATH, PF_NA}}}, [PPME_SYSCALL_SETPGID_E] = {"setpgid", EC_PROCESS | EC_SYSCALL, EF_OLD_VERSION | EF_CONVERTER_MANAGED, @@ -2748,4 +2760,147 @@ event_info! { {{"res", PT_ERRNO, PF_DEC}, {"rgid", PT_UID, PF_DEC}, {"egid", PT_UID, PF_DEC}}}, + [PPME_ITER_TASK_E] = {"task", + EC_ITER | EC_PROCESS, + EF_MODIFIES_STATE, + 32, + {{"ppid", PT_PID32, PF_DEC}, + {"pgid", PT_PID32, PF_DEC}, + {"vpgid", PT_PID32, PF_DEC}, + {"sid", PT_PID32, PF_DEC}, + {"comm", PT_CHARBUF, PF_NA}, + {"argv", PT_CHARBUFARRAY, PF_NA}, + {"exepath", PT_FSPATH, PF_NA}, + {"flags", PT_FLAGS32, PF_HEX, execve_flags}, + {"env", PT_CHARBUFARRAY, PF_NA}, + {"cwd", PT_CHARBUF, PF_NA}, + {"fdlimit", PT_UINT64, PF_DEC}, + {"euid", PT_UID, PF_DEC}, + {"egid", PT_GID, PF_DEC}, + {"cap_permitted", PT_UINT64, PF_HEX}, + {"cap_effective", PT_UINT64, PF_HEX}, + {"cap_inheritable", PT_UINT64, PF_HEX}, + {"exe_ino_num", PT_UINT64, PF_DEC}, + {"exe_ino_ctime", PT_ABSTIME, PF_DEC}, + {"exe_ino_mtime", PT_ABSTIME, PF_DEC}, + {"vm_size", PT_UINT32, PF_DEC}, + {"vm_rss", PT_UINT32, PF_DEC}, + {"vm_swap", PT_UINT32, PF_DEC}, + {"pgft_maj", PT_UINT64, PF_DEC}, + {"pgft_min", PT_UINT64, PF_DEC}, + {"vtgid", PT_PID32, PF_DEC}, + {"vpid", PT_PID32, PF_DEC}, + {"pidns_init_start_ts", PT_UINT64, PF_DEC}, + {"cgroups", PT_CHARBUFARRAY, PF_NA}, + {"root", PT_FSPATH, PF_NA}, + {"start_time", PT_ABSTIME, PF_DEC}, + {"tty", PT_UINT32, PF_DEC}, + {"loginuid", PT_UID, PF_DEC}}}, + [PPME_ITER_TASK_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_PIPE_E] = {"task_file_pipe", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 3, + {{"fd", PT_FD32, PF_DEC}, + {"path", PT_FSPATH, PF_NA}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_PIPE_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_MEMFD_E] = {"task_file_memfd", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 3, + {{"fd", PT_FD32, PF_DEC}, + {"path", PT_FSPATH, PF_NA}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_MEMFD_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_REGULAR_E] = {"task_file_regular", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 5, + {{"fd", PT_FD32, PF_DEC}, + {"path", PT_FSPATH, PF_NA}, + {"flags", PT_FLAGS32, PF_HEX, file_flags}, + {"mnt_id", PT_UINT32, PF_DEC}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_REGULAR_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_DIRECTORY_E] = {"task_file_directory", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 3, + {{"fd", PT_FD32, PF_DEC}, + {"path", PT_FSPATH, PF_NA}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_DIRECTORY_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + + [PPME_ITER_TASK_FILE_SOCKET_INET_E] = {"task_file_socket_inet", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 8, + {{"fd", PT_FD32, PF_DEC}, + {"sk_type", PT_UINT16, PF_DEC}, + {"sk_proto", PT_UINT16, PF_DEC}, + {"local_ip", PT_IPV4ADDR, PF_HEX}, + {"local_port", PT_PORT, PF_HEX}, + {"remote_ip", PT_IPV4ADDR, PF_HEX}, + {"remote_port", PT_PORT, PF_HEX}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_SOCKET_INET_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + + [PPME_ITER_TASK_FILE_SOCKET_INET6_E] = {"task_file_socket_inet6", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 8, + {{"fd", PT_FD32, PF_DEC}, + {"sk_type", PT_UINT16, PF_DEC}, + {"sk_proto", PT_UINT16, PF_DEC}, + {"local_ip", PT_IPV6ADDR, PF_HEX}, + {"local_port", PT_PORT, PF_HEX}, + {"remote_ip", PT_IPV6ADDR, PF_HEX}, + {"remote_port", PT_PORT, PF_HEX}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_SOCKET_INET6_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_SOCKET_UNIX_E] = {"task_file_socket_unix", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 6, + {{"fd", PT_FD32, PF_DEC}, + {"sk_type", PT_UINT16, PF_DEC}, + {"sk_proto", PT_UINT16, PF_DEC}, + {"sk_pointer", PT_UINT64, PF_NA}, + {"sun_path", PT_FSPATH, PF_NA}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_SOCKET_UNIX_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_SOCKET_NETLINK_E] = {"task_file_socket_netlink", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 4, + {{"fd", PT_FD32, PF_DEC}, + {"sk_type", PT_UINT16, PF_DEC}, + {"sk_proto", PT_UINT16, PF_DEC}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_SOCKET_NETLINK_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_ITER_TASK_FILE_ANON_INODE_E] = + {"task_file_anon_inode", + EC_ITER | EC_FILE, + EF_MODIFIES_STATE, + 4, + {{"fd", PT_FD32, PF_DEC}, + {"fd_type", PT_FLAGS8, PF_DEC, anon_inode_fd_types}, + {"path", + PT_FSPATH, + PF_NA}, + {"ino_num", PT_UINT64, PF_DEC}}}, + [PPME_ITER_TASK_FILE_ANON_INODE_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_SYSCALL_KEYCTL_E] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, + [PPME_SYSCALL_KEYCTL_X] = + {"keyctl", + EC_OTHER | EC_SYSCALL, + EF_NONE, + 6, + {{"res", PT_ERRNO, PF_DEC}, + {"operation", PT_ENUMFLAGS32, PF_DEC, keyctl_operations}, + {"arg2", PT_DYN, PF_DEC, keyctl_dynamic_param, PPM_KEYCTL_IDX_MAX}, + {"arg3", PT_DYN, PF_DEC, keyctl_dynamic_param, PPM_KEYCTL_IDX_MAX}, + {"arg4", PT_DYN, PF_DEC, keyctl_dynamic_param, PPM_KEYCTL_IDX_MAX}, + {"arg5", PT_DYN, PF_DEC, keyctl_dynamic_param, PPM_KEYCTL_IDX_MAX}}}, } diff --git a/falco_event_schema/src/ffi.rs b/falco_event_schema/src/ffi.rs index 56a189ff..e79ef761 100644 --- a/falco_event_schema/src/ffi.rs +++ b/falco_event_schema/src/ffi.rs @@ -1,4 +1,4 @@ -/* automatically generated by rust-bindgen 0.71.1 */ +/* automatically generated by rust-bindgen 0.72.1 */ #[repr(C)] #[derive(Default)] @@ -467,6 +467,9 @@ pub const PPM_PTRACE_IDX_MAX: u32 = 2; pub const PPM_BPF_IDX_FD: u32 = 0; pub const PPM_BPF_IDX_RES: u32 = 1; pub const PPM_BPF_IDX_MAX: u32 = 2; +pub const PPM_KEYCTL_IDX_INT64: u32 = 0; +pub const PPM_KEYCTL_IDX_CHARBUF: u32 = 1; +pub const PPM_KEYCTL_IDX_MAX: u32 = 2; pub const PPM_PROT_NONE: u32 = 0; pub const PPM_PROT_READ: u32 = 1; pub const PPM_PROT_WRITE: u32 = 2; @@ -655,6 +658,8 @@ pub const PPM_MODULE_INIT_IGNORE_VERMAGIC: u32 = 2; pub const PPM_MODULE_INIT_COMPRESSED_FILE: u32 = 4; pub const PPM_DELETE_MODULE_O_TRUNC: u32 = 1; pub const PPM_DELETE_MODULE_O_NONBLOCK: u32 = 2; +pub const PPM_CLOSE_RANGE_UNSHARE: u32 = 2; +pub const PPM_CLOSE_RANGE_CLOEXEC: u32 = 4; pub const PPM_BPF_MAP_CREATE: u32 = 0; pub const PPM_BPF_MAP_LOOKUP_ELEM: u32 = 1; pub const PPM_BPF_MAP_UPDATE_ELEM: u32 = 2; @@ -728,6 +733,39 @@ pub const PPM_PR_SCHED_CORE: u32 = 62; pub const PPM_PR_SME_SET_VL: u32 = 63; pub const PPM_PR_SME_GET_VL: u32 = 64; pub const PPM_PR_SET_VMA: u32 = 1398164801; +pub const PPM_KEYCTL_GET_KEYRING_ID: u32 = 0; +pub const PPM_KEYCTL_JOIN_SESSION_KEYRING: u32 = 1; +pub const PPM_KEYCTL_UPDATE: u32 = 2; +pub const PPM_KEYCTL_REVOKE: u32 = 3; +pub const PPM_KEYCTL_CHOWN: u32 = 4; +pub const PPM_KEYCTL_SETPERM: u32 = 5; +pub const PPM_KEYCTL_DESCRIBE: u32 = 6; +pub const PPM_KEYCTL_CLEAR: u32 = 7; +pub const PPM_KEYCTL_LINK: u32 = 8; +pub const PPM_KEYCTL_UNLINK: u32 = 9; +pub const PPM_KEYCTL_SEARCH: u32 = 10; +pub const PPM_KEYCTL_READ: u32 = 11; +pub const PPM_KEYCTL_INSTANTIATE: u32 = 12; +pub const PPM_KEYCTL_NEGATE: u32 = 13; +pub const PPM_KEYCTL_SET_REQKEY_KEYRING: u32 = 14; +pub const PPM_KEYCTL_SET_TIMEOUT: u32 = 15; +pub const PPM_KEYCTL_ASSUME_AUTHORITY: u32 = 16; +pub const PPM_KEYCTL_GET_SECURITY: u32 = 17; +pub const PPM_KEYCTL_SESSION_TO_PARENT: u32 = 18; +pub const PPM_KEYCTL_REJECT: u32 = 19; +pub const PPM_KEYCTL_INSTANTIATE_IOV: u32 = 20; +pub const PPM_KEYCTL_INVALIDATE: u32 = 21; +pub const PPM_KEYCTL_GET_PERSISTENT: u32 = 22; +pub const PPM_KEYCTL_DH_COMPUTE: u32 = 23; +pub const PPM_KEYCTL_PKEY_QUERY: u32 = 24; +pub const PPM_KEYCTL_PKEY_ENCRYPT: u32 = 25; +pub const PPM_KEYCTL_PKEY_DECRYPT: u32 = 26; +pub const PPM_KEYCTL_PKEY_SIGN: u32 = 27; +pub const PPM_KEYCTL_PKEY_VERIFY: u32 = 28; +pub const PPM_KEYCTL_RESTRICT_KEYRING: u32 = 29; +pub const PPM_KEYCTL_MOVE: u32 = 30; +pub const PPM_KEYCTL_CAPABILITIES: u32 = 31; +pub const PPM_KEYCTL_WATCH_KEY: u32 = 32; pub const RLIM_INFINITY: i32 = -1; pub const PPM_CAP_CHOWN: u32 = 1; pub const PPM_CAP_DAC_OVERRIDE: u32 = 2; @@ -788,6 +826,7 @@ pub const PPM_FAILURE_INVALID_USER_MEMORY: i32 = -2; pub const PPM_FAILURE_BUG: i32 = -3; pub const PPM_SKIP_EVENT: i32 = -4; pub const PPM_FAILURE_FRAME_SCRATCH_MAP_FULL: i32 = -5; +pub const MAX_ITER_EVENT_SIZE: u32 = 65536; pub type __u_char = ::std::os::raw::c_uchar; pub type __u_short = ::std::os::raw::c_ushort; pub type __u_int = ::std::os::raw::c_uint; @@ -1321,7 +1360,31 @@ pub const ppm_event_code_PPME_SYSCALL_SETREUID_E: ppm_event_code = 426; pub const ppm_event_code_PPME_SYSCALL_SETREUID_X: ppm_event_code = 427; pub const ppm_event_code_PPME_SYSCALL_SETREGID_E: ppm_event_code = 428; pub const ppm_event_code_PPME_SYSCALL_SETREGID_X: ppm_event_code = 429; -pub const ppm_event_code_PPM_EVENT_MAX: ppm_event_code = 430; +pub const ppm_event_code_PPME_ITER_TASK_E: ppm_event_code = 430; +pub const ppm_event_code_PPME_ITER_TASK_X: ppm_event_code = 431; +pub const ppm_event_code_PPME_ITER_TASK_FILE_PIPE_E: ppm_event_code = 432; +pub const ppm_event_code_PPME_ITER_TASK_FILE_PIPE_X: ppm_event_code = 433; +pub const ppm_event_code_PPME_ITER_TASK_FILE_MEMFD_E: ppm_event_code = 434; +pub const ppm_event_code_PPME_ITER_TASK_FILE_MEMFD_X: ppm_event_code = 435; +pub const ppm_event_code_PPME_ITER_TASK_FILE_REGULAR_E: ppm_event_code = 436; +pub const ppm_event_code_PPME_ITER_TASK_FILE_REGULAR_X: ppm_event_code = 437; +pub const ppm_event_code_PPME_ITER_TASK_FILE_DIRECTORY_E: ppm_event_code = 438; +pub const ppm_event_code_PPME_ITER_TASK_FILE_DIRECTORY_X: ppm_event_code = 439; +pub const ppm_event_code_PPME_ITER_TASK_FILE_SOCKET_INET_E: ppm_event_code = 440; +pub const ppm_event_code_PPME_ITER_TASK_FILE_SOCKET_INET_X: ppm_event_code = 441; +pub const ppm_event_code_PPME_ITER_TASK_FILE_SOCKET_INET6_E: ppm_event_code = 442; +pub const ppm_event_code_PPME_ITER_TASK_FILE_SOCKET_INET6_X: ppm_event_code = 443; +pub const ppm_event_code_PPME_ITER_TASK_FILE_SOCKET_UNIX_E: ppm_event_code = 444; +pub const ppm_event_code_PPME_ITER_TASK_FILE_SOCKET_UNIX_X: ppm_event_code = 445; +pub const ppm_event_code_PPME_ITER_TASK_FILE_SOCKET_NETLINK_E: ppm_event_code = 446; +pub const ppm_event_code_PPME_ITER_TASK_FILE_SOCKET_NETLINK_X: ppm_event_code = 447; +pub const ppm_event_code_PPME_ITER_TASK_FILE_ANON_INODE_E: ppm_event_code = 448; +pub const ppm_event_code_PPME_ITER_TASK_FILE_ANON_INODE_X: ppm_event_code = 449; +pub const ppm_event_code_PPME_SYSCALL_CLOSE_RANGE_E: ppm_event_code = 450; +pub const ppm_event_code_PPME_SYSCALL_CLOSE_RANGE_X: ppm_event_code = 451; +pub const ppm_event_code_PPME_SYSCALL_KEYCTL_E: ppm_event_code = 452; +pub const ppm_event_code_PPME_SYSCALL_KEYCTL_X: ppm_event_code = 453; +pub const ppm_event_code_PPM_EVENT_MAX: ppm_event_code = 454; #[doc = " @defgroup etypes Event Types\n @{"] pub type ppm_event_code = ::std::os::raw::c_uint; pub const sys_exit_extra_code_T1_EXECVE_X: sys_exit_extra_code = 0; @@ -1789,7 +1852,10 @@ pub const ppm_sc_code_PPM_SC_SETXATTRAT: ppm_sc_code = 447; pub const ppm_sc_code_PPM_SC_OPEN_TREE_ATTR: ppm_sc_code = 448; pub const ppm_sc_code_PPM_SC_FILE_GETATTR: ppm_sc_code = 449; pub const ppm_sc_code_PPM_SC_FILE_SETATTR: ppm_sc_code = 450; -pub const ppm_sc_code_PPM_SC_MAX: ppm_sc_code = 451; +pub const ppm_sc_code_PPM_SC_LISTNS: ppm_sc_code = 451; +pub const ppm_sc_code_PPM_SC_UPROBE: ppm_sc_code = 452; +pub const ppm_sc_code_PPM_SC_RSEQ_SLICE_YIELD: ppm_sc_code = 453; +pub const ppm_sc_code_PPM_SC_MAX: ppm_sc_code = 454; pub type ppm_sc_code = ::std::os::raw::c_uint; pub const ppm_event_category_EC_UNKNOWN: ppm_event_category = 0; pub const ppm_event_category_EC_OTHER: ppm_event_category = 1; @@ -1815,6 +1881,7 @@ pub const ppm_event_category_EC_SYSCALL: ppm_event_category = 512; pub const ppm_event_category_EC_TRACEPOINT: ppm_event_category = 1024; pub const ppm_event_category_EC_PLUGIN: ppm_event_category = 2048; pub const ppm_event_category_EC_METAEVENT: ppm_event_category = 4096; +pub const ppm_event_category_EC_ITER: ppm_event_category = 8192; pub type ppm_event_category = ::std::os::raw::c_uint; pub const ppm_event_flags_EF_NONE: ppm_event_flags = 0; pub const ppm_event_flags_EF_CREATES_FD: ppm_event_flags = 1; @@ -1877,7 +1944,9 @@ pub const ppm_param_type_PT_FSRELPATH: ppm_param_type = 43; pub const ppm_param_type_PT_ENUMFLAGS8: ppm_param_type = 44; pub const ppm_param_type_PT_ENUMFLAGS16: ppm_param_type = 45; pub const ppm_param_type_PT_ENUMFLAGS32: ppm_param_type = 46; -pub const ppm_param_type_PT_MAX: ppm_param_type = 47; +pub const ppm_param_type_PT_FD32: ppm_param_type = 47; +pub const ppm_param_type_PT_PID32: ppm_param_type = 48; +pub const ppm_param_type_PT_MAX: ppm_param_type = 49; pub type ppm_param_type = ::std::os::raw::c_uint; pub const ppm_print_format_PF_NA: ppm_print_format = 0; pub const ppm_print_format_PF_DEC: ppm_print_format = 1; @@ -2123,6 +2192,9 @@ unsafe extern "C" { unsafe extern "C" { pub static prctl_options: [ppm_name_value; 0usize]; } +unsafe extern "C" { + pub static keyctl_operations: [ppm_name_value; 0usize]; +} unsafe extern "C" { pub static memfd_create_flags: [ppm_name_value; 0usize]; } @@ -2141,12 +2213,21 @@ unsafe extern "C" { unsafe extern "C" { pub static bpf_dynamic_param: [ppm_param_info; 0usize]; } +unsafe extern "C" { + pub static keyctl_dynamic_param: [ppm_param_info; 0usize]; +} unsafe extern "C" { pub static delete_module_flags: [ppm_name_value; 0usize]; } +unsafe extern "C" { + pub static close_range_flags: [ppm_name_value; 0usize]; +} unsafe extern "C" { pub static finit_module_flags: [ppm_name_value; 0usize]; } +unsafe extern "C" { + pub static anon_inode_fd_types: [ppm_name_value; 0usize]; +} #[doc = "\\brief Process information as returned by the PPM_IOCTL_GET_PROCLIST IOCTL."] #[repr(C)] #[derive(Debug, Copy, Clone)] @@ -2377,12 +2458,14 @@ pub const ppm_filler_id_PPM_FILLER_sys_newfstatat_x: ppm_filler_id = 157; pub const ppm_filler_id_PPM_FILLER_sys_process_vm_readv_x: ppm_filler_id = 158; pub const ppm_filler_id_PPM_FILLER_sys_process_vm_writev_x: ppm_filler_id = 159; pub const ppm_filler_id_PPM_FILLER_sys_delete_module_x: ppm_filler_id = 160; -pub const ppm_filler_id_PPM_FILLER_sys_pread64_x: ppm_filler_id = 161; -pub const ppm_filler_id_PPM_FILLER_sys_pwrite64_x: ppm_filler_id = 162; -pub const ppm_filler_id_PPM_FILLER_sys_setuid_x: ppm_filler_id = 163; -pub const ppm_filler_id_PPM_FILLER_sys_setresuid_x: ppm_filler_id = 164; -pub const ppm_filler_id_PPM_FILLER_terminate_filler: ppm_filler_id = 165; -pub const ppm_filler_id_PPM_FILLER_MAX: ppm_filler_id = 166; +pub const ppm_filler_id_PPM_FILLER_sys_close_range_x: ppm_filler_id = 161; +pub const ppm_filler_id_PPM_FILLER_sys_pread64_x: ppm_filler_id = 162; +pub const ppm_filler_id_PPM_FILLER_sys_pwrite64_x: ppm_filler_id = 163; +pub const ppm_filler_id_PPM_FILLER_sys_setuid_x: ppm_filler_id = 164; +pub const ppm_filler_id_PPM_FILLER_sys_setresuid_x: ppm_filler_id = 165; +pub const ppm_filler_id_PPM_FILLER_sys_keyctl_x: ppm_filler_id = 166; +pub const ppm_filler_id_PPM_FILLER_terminate_filler: ppm_filler_id = 167; +pub const ppm_filler_id_PPM_FILLER_MAX: ppm_filler_id = 168; pub type ppm_filler_id = ::std::os::raw::c_uint; unsafe extern "C" { pub fn f_sys_autofill(args: *mut event_filler_arguments) -> ::std::os::raw::c_int; @@ -2869,6 +2952,9 @@ unsafe extern "C" { unsafe extern "C" { pub fn f_sys_delete_module_x(args: *mut event_filler_arguments) -> ::std::os::raw::c_int; } +unsafe extern "C" { + pub fn f_sys_close_range_x(args: *mut event_filler_arguments) -> ::std::os::raw::c_int; +} unsafe extern "C" { pub fn f_sys_pread64_x(args: *mut event_filler_arguments) -> ::std::os::raw::c_int; } @@ -2881,6 +2967,9 @@ unsafe extern "C" { unsafe extern "C" { pub fn f_sys_setresuid_x(args: *mut event_filler_arguments) -> ::std::os::raw::c_int; } +unsafe extern "C" { + pub fn f_sys_keyctl_x(args: *mut event_filler_arguments) -> ::std::os::raw::c_int; +} unsafe extern "C" { pub fn f_terminate_filler(args: *mut event_filler_arguments) -> ::std::os::raw::c_int; } @@ -2929,3 +3018,18 @@ const _: () = { ["Offset of field: ppm_event_entry::autofill_args"] [::std::mem::offset_of!(ppm_event_entry, autofill_args) - 18usize]; }; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_UNKNOWN: anon_inode_fd_type = 0; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_EVENTFD: anon_inode_fd_type = 1; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_EVENTPOLL: anon_inode_fd_type = 2; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_INOTIFY: anon_inode_fd_type = 3; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_SIGNALFD: anon_inode_fd_type = 4; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_TIMERFD: anon_inode_fd_type = 5; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_IO_URING: anon_inode_fd_type = 6; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_USERFAULTFD: anon_inode_fd_type = 7; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_PIDFD: anon_inode_fd_type = 8; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_BPF_MAP: anon_inode_fd_type = 9; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_BPF_PROG: anon_inode_fd_type = 10; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_BPF_LINK: anon_inode_fd_type = 11; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_BPF_ITER: anon_inode_fd_type = 12; +pub const anon_inode_fd_type_ANON_INODE_FD_TYPE_PERF_EVENT: anon_inode_fd_type = 13; +pub type anon_inode_fd_type = ::std::os::raw::c_uint; diff --git a/falco_event_schema/src/fields/dynamic_params.rs b/falco_event_schema/src/fields/dynamic_params.rs index 0fe966ed..017a47e9 100644 --- a/falco_event_schema/src/fields/dynamic_params.rs +++ b/falco_event_schema/src/fields/dynamic_params.rs @@ -18,4 +18,9 @@ const struct ppm_param_info bpf_dynamic_param[PPM_BPF_IDX_MAX] = { [PPM_BPF_IDX_FD] = {{0}, PT_FD, PF_DEC, 0, 0}, [PPM_BPF_IDX_RES] = {{0}, PT_ERRNO, PF_DEC, 0, 0}, }; + +const struct ppm_param_info keyctl_dynamic_param[PPM_KEYCTL_IDX_MAX] = { + [PPM_KEYCTL_IDX_INT64] = {{0}, PT_INT64, PF_DEC, 0, 0}, + [PPM_KEYCTL_IDX_CHARBUF] = {{0}, PT_CHARBUF, PF_NA, 0, 0}, +}; } diff --git a/falco_event_schema/src/fields/event_flags.rs b/falco_event_schema/src/fields/event_flags.rs index 32432647..b5b9165a 100644 --- a/falco_event_schema/src/fields/event_flags.rs +++ b/falco_event_schema/src/fields/event_flags.rs @@ -53,6 +53,10 @@ type prctl_options: PT_ENUMFLAGS32; type pidfd_open_flags: PT_FLAGS32; type finit_module_flags: PT_FLAGS32; type creat_flags: PT_FLAGS16; +type anon_inode_fd_types: PT_FLAGS8; +type close_range_flags: PT_FLAGS32; +type keyctl_operations: PT_ENUMFLAGS32; + const struct ppm_name_value socket_families[] = { {"AF_NFC", PPM_AF_NFC}, {"AF_ALG", PPM_AF_ALG}, @@ -162,6 +166,7 @@ const struct ppm_name_value clone_flags[] = { {"CLONE_STOPPED", PPM_CL_CLONE_STOPPED}, {"CLONE_VFORK", PPM_CL_CLONE_VFORK}, {"CLONE_NEWCGROUP", PPM_CL_CLONE_NEWCGROUP}, + {"CLONE_CHILD_IN_PIDNS", PPM_CL_CHILD_IN_PIDNS}, {0, 0}, }; @@ -732,6 +737,43 @@ const struct ppm_name_value prctl_options[] = { {0, 0}, }; +const struct ppm_name_value keyctl_operations[] = { + {"KEYCTL_GET_KEYRING_ID", PPM_KEYCTL_GET_KEYRING_ID}, + {"KEYCTL_JOIN_SESSION_KEYRING", PPM_KEYCTL_JOIN_SESSION_KEYRING}, + {"KEYCTL_UPDATE", PPM_KEYCTL_UPDATE}, + {"KEYCTL_REVOKE", PPM_KEYCTL_REVOKE}, + {"KEYCTL_CHOWN", PPM_KEYCTL_CHOWN}, + {"KEYCTL_SETPERM", PPM_KEYCTL_SETPERM}, + {"KEYCTL_DESCRIBE", PPM_KEYCTL_DESCRIBE}, + {"KEYCTL_CLEAR", PPM_KEYCTL_CLEAR}, + {"KEYCTL_LINK", PPM_KEYCTL_LINK}, + {"KEYCTL_UNLINK", PPM_KEYCTL_UNLINK}, + {"KEYCTL_SEARCH", PPM_KEYCTL_SEARCH}, + {"KEYCTL_READ", PPM_KEYCTL_READ}, + {"KEYCTL_INSTANTIATE", PPM_KEYCTL_INSTANTIATE}, + {"KEYCTL_NEGATE", PPM_KEYCTL_NEGATE}, + {"KEYCTL_SET_REQKEY_KEYRING", PPM_KEYCTL_SET_REQKEY_KEYRING}, + {"KEYCTL_SET_TIMEOUT", PPM_KEYCTL_SET_TIMEOUT}, + {"KEYCTL_ASSUME_AUTHORITY", PPM_KEYCTL_ASSUME_AUTHORITY}, + {"KEYCTL_GET_SECURITY", PPM_KEYCTL_GET_SECURITY}, + {"KEYCTL_SESSION_TO_PARENT", PPM_KEYCTL_SESSION_TO_PARENT}, + {"KEYCTL_REJECT", PPM_KEYCTL_REJECT}, + {"KEYCTL_INSTANTIATE_IOV", PPM_KEYCTL_INSTANTIATE_IOV}, + {"KEYCTL_INVALIDATE", PPM_KEYCTL_INVALIDATE}, + {"KEYCTL_GET_PERSISTENT", PPM_KEYCTL_GET_PERSISTENT}, + {"KEYCTL_DH_COMPUTE", PPM_KEYCTL_DH_COMPUTE}, + {"KEYCTL_PKEY_QUERY", PPM_KEYCTL_PKEY_QUERY}, + {"KEYCTL_PKEY_ENCRYPT", PPM_KEYCTL_PKEY_ENCRYPT}, + {"KEYCTL_PKEY_DECRYPT", PPM_KEYCTL_PKEY_DECRYPT}, + {"KEYCTL_PKEY_SIGN", PPM_KEYCTL_PKEY_SIGN}, + {"KEYCTL_PKEY_VERIFY", PPM_KEYCTL_PKEY_VERIFY}, + {"KEYCTL_RESTRICT_KEYRING", PPM_KEYCTL_RESTRICT_KEYRING}, + {"KEYCTL_MOVE", PPM_KEYCTL_MOVE}, + {"KEYCTL_CAPABILITIES", PPM_KEYCTL_CAPABILITIES}, + {"KEYCTL_WATCH_KEY", PPM_KEYCTL_WATCH_KEY}, + {0, 0}, +}; + const struct ppm_name_value memfd_create_flags[] = { {"MFD_CLOEXEC", PPM_MFD_CLOEXEC}, {"MFD_ALLOW_SEALING", PPM_MFD_ALLOW_SEALING}, @@ -812,10 +854,34 @@ const struct ppm_name_value delete_module_flags[] = { {0, 0}, }; +const struct ppm_name_value close_range_flags[] = { + {"CLOSE_RANGE_UNSHARE", PPM_CLOSE_RANGE_UNSHARE}, + {"CLOSE_RANGE_CLOEXEC", PPM_CLOSE_RANGE_CLOEXEC}, + {0, 0}, +}; + const struct ppm_name_value finit_module_flags[] = { {"MODULE_INIT_IGNORE_MODVERSIONS", PPM_MODULE_INIT_IGNORE_MODVERSIONS}, {"MODULE_INIT_IGNORE_VERMAGIC", PPM_MODULE_INIT_IGNORE_VERMAGIC}, {"MODULE_INIT_COMPRESSED_FILE", PPM_MODULE_INIT_COMPRESSED_FILE}, {0, 0}, }; + +const struct ppm_name_value anon_inode_fd_types[] = { + {"ANON_INODE_FD_TYPE_UNKNOWN", anon_inode_fd_type_ANON_INODE_FD_TYPE_UNKNOWN}, + {"ANON_INODE_FD_TYPE_EVENTFD", anon_inode_fd_type_ANON_INODE_FD_TYPE_EVENTFD}, + {"ANON_INODE_FD_TYPE_EVENTPOLL", anon_inode_fd_type_ANON_INODE_FD_TYPE_EVENTPOLL}, + {"ANON_INODE_FD_TYPE_INOTIFY", anon_inode_fd_type_ANON_INODE_FD_TYPE_INOTIFY}, + {"ANON_INODE_FD_TYPE_SIGNALFD", anon_inode_fd_type_ANON_INODE_FD_TYPE_SIGNALFD}, + {"ANON_INODE_FD_TYPE_TIMERFD", anon_inode_fd_type_ANON_INODE_FD_TYPE_TIMERFD}, + {"ANON_INODE_FD_TYPE_IO_URING", anon_inode_fd_type_ANON_INODE_FD_TYPE_IO_URING}, + {"ANON_INODE_FD_TYPE_USERFAULTFD", anon_inode_fd_type_ANON_INODE_FD_TYPE_USERFAULTFD}, + {"ANON_INODE_FD_TYPE_PIDFD", anon_inode_fd_type_ANON_INODE_FD_TYPE_PIDFD}, + {"ANON_INODE_FD_TYPE_BPF_MAP", anon_inode_fd_type_ANON_INODE_FD_TYPE_BPF_MAP}, + {"ANON_INODE_FD_TYPE_BPF_PROG", anon_inode_fd_type_ANON_INODE_FD_TYPE_BPF_PROG}, + {"ANON_INODE_FD_TYPE_BPF_LINK", anon_inode_fd_type_ANON_INODE_FD_TYPE_BPF_LINK}, + {"ANON_INODE_FD_TYPE_BPF_ITER", anon_inode_fd_type_ANON_INODE_FD_TYPE_BPF_ITER}, + {"ANON_INODE_FD_TYPE_PERF_EVENT", anon_inode_fd_type_ANON_INODE_FD_TYPE_PERF_EVENT}, + {0, 0}, +}; } diff --git a/falco_event_schema/src/fields/types.rs b/falco_event_schema/src/fields/types.rs index 06982d50..424652ff 100644 --- a/falco_event_schema/src/fields/types.rs +++ b/falco_event_schema/src/fields/types.rs @@ -7,11 +7,13 @@ pub use crate::types::SockAddr as PT_SOCKADDR; pub use crate::types::SockTuple as PT_SOCKTUPLE; pub use falco_event::types::Bool as PT_BOOL; pub use falco_event::types::Fd as PT_FD; +pub use falco_event::types::Fd32 as PT_FD32; pub use falco_event::types::Gid as PT_GID; pub use falco_event::types::IpNet as PT_IPNET; pub use falco_event::types::Ipv4Net as PT_IPV4NET; pub use falco_event::types::Ipv6Net as PT_IPV6NET; pub use falco_event::types::Pid as PT_PID; +pub use falco_event::types::Pid32 as PT_PID32; pub use falco_event::types::Port as PT_PORT; pub use falco_event::types::RelativePath as PT_FSRELPATH; pub use falco_event::types::SigSet as PT_SIGSET; diff --git a/falco_event_schema/tools/generate_flags_table.sh b/falco_event_schema/tools/generate_flags_table.sh index b7d54b07..74330471 100755 --- a/falco_event_schema/tools/generate_flags_table.sh +++ b/falco_event_schema/tools/generate_flags_table.sh @@ -14,7 +14,7 @@ cat api/flag_types echo -sed -n '/ppm_name_value/,$p' < $EVENT_TABLE | grep -v '^#' | uniq +sed -n '/ppm_name_value/,$p' < $EVENT_TABLE | grep -v '^#' | uniq | sed 's@, ANON_INODE_FD_TYPE@, anon_inode_fd_type_ANON_INODE_FD_TYPE@' echo '}') > src/fields/event_flags.rs diff --git a/falco_event_serde/src/de/repr/newtypes.rs b/falco_event_serde/src/de/repr/newtypes.rs index af28a817..b3ce0744 100644 --- a/falco_event_serde/src/de/repr/newtypes.rs +++ b/falco_event_serde/src/de/repr/newtypes.rs @@ -25,8 +25,10 @@ macro_rules! impl_deserialize_newtype { impl_deserialize_newtype!(types::PT_BOOL); impl_deserialize_newtype!(types::PT_FD); +impl_deserialize_newtype!(types::PT_FD32); impl_deserialize_newtype!(types::PT_GID); impl_deserialize_newtype!(types::PT_PID); +impl_deserialize_newtype!(types::PT_PID32); impl_deserialize_newtype!(types::PT_PORT); impl_deserialize_newtype!(types::PT_SIGSET); impl_deserialize_newtype!(types::PT_SIGTYPE); diff --git a/falco_event_serde/src/ser/field/net.rs b/falco_event_serde/src/ser/field/net.rs index fe72f01b..a67bb54f 100644 --- a/falco_event_serde/src/ser/field/net.rs +++ b/falco_event_serde/src/ser/field/net.rs @@ -2,6 +2,24 @@ use crate::ser::field::{SerializedField, StrOrBytes}; use falco_event_schema::fields::types; use serde::{Serialize, Serializer}; +impl Serialize for SerializedField<&types::PT_IPV6ADDR> { + fn serialize(&self, serializer: S) -> Result + where + S: Serializer, + { + self.0.serialize(serializer) + } +} + +impl Serialize for SerializedField<&types::PT_IPV4ADDR> { + fn serialize(&self, serializer: S) -> Result + where + S: Serializer, + { + self.0.serialize(serializer) + } +} + impl Serialize for SerializedField<&types::PT_SOCKADDR<'_>> { fn serialize(&self, serializer: S) -> Result where diff --git a/falco_event_serde/src/ser/field/newtypes.rs b/falco_event_serde/src/ser/field/newtypes.rs index 4fdf274c..395943de 100644 --- a/falco_event_serde/src/ser/field/newtypes.rs +++ b/falco_event_serde/src/ser/field/newtypes.rs @@ -18,8 +18,10 @@ macro_rules! impl_serialize_newtype { impl_serialize_newtype!(types::PT_BOOL); impl_serialize_newtype!(types::PT_FD); +impl_serialize_newtype!(types::PT_FD32); impl_serialize_newtype!(types::PT_GID); impl_serialize_newtype!(types::PT_PID); +impl_serialize_newtype!(types::PT_PID32); impl_serialize_newtype!(types::PT_PORT); impl_serialize_newtype!(types::PT_SIGSET); impl_serialize_newtype!(types::PT_SIGTYPE); diff --git a/falco_plugin_api/plugin/SCHEMA_VERSION b/falco_plugin_api/plugin/SCHEMA_VERSION index 1454f6ed..a84947d6 100644 --- a/falco_plugin_api/plugin/SCHEMA_VERSION +++ b/falco_plugin_api/plugin/SCHEMA_VERSION @@ -1 +1 @@ -4.0.1 +4.5.0 diff --git a/falco_plugin_api/src/ffi.rs b/falco_plugin_api/src/ffi.rs index 2f115190..89268288 100644 --- a/falco_plugin_api/src/ffi.rs +++ b/falco_plugin_api/src/ffi.rs @@ -1,4 +1,4 @@ -/* automatically generated by rust-bindgen 0.71.1 */ +/* automatically generated by rust-bindgen 0.72.1 */ pub const PLUGIN_API_VERSION_MAJOR: u32 = 3; pub const PLUGIN_API_VERSION_MINOR: u32 = 12; diff --git a/falco_plugin_tests/build.rs b/falco_plugin_tests/build.rs index 4650091d..71993ec9 100644 --- a/falco_plugin_tests/build.rs +++ b/falco_plugin_tests/build.rs @@ -1,7 +1,7 @@ fn main() { println!("cargo:rustc-check-cfg=cfg(have_libsinsp)"); - match pkg_config::probe_library("libsinsp") { + match pkg_config::Config::new().statik(true).probe("libsinsp") { Ok(sinsp) => { cxx_build::bridge("src/ffi.rs") .file("c++/sinsp_test_driver.cpp") diff --git a/falco_schema_derive/src/event_info.rs b/falco_schema_derive/src/event_info.rs index 7d258d5c..be4f92f1 100644 --- a/falco_schema_derive/src/event_info.rs +++ b/falco_schema_derive/src/event_info.rs @@ -20,7 +20,8 @@ pub fn lifetime_type(name: &str) -> LifetimeType { | "PT_FSRELPATH" | "PT_CHARBUFARRAY" | "PT_CHARBUF_PAIR_ARRAY" - | "PT_DYN_sockopt_dynamic_param" => LifetimeType::Generic, + | "PT_DYN_sockopt_dynamic_param" + | "PT_DYN_keyctl_dynamic_param" => LifetimeType::Generic, _ => LifetimeType::None, } } diff --git a/falco_schema_derive/src/format.rs b/falco_schema_derive/src/format.rs index 4ad87fd1..3fd10496 100644 --- a/falco_schema_derive/src/format.rs +++ b/falco_schema_derive/src/format.rs @@ -21,6 +21,8 @@ pub fn formatter_for( ) -> proc_macro2::TokenStream { match (pt_type.to_string().as_str(), pf_type.to_string().as_str()) { ("PT_FSPATH", _) => quote!(::std::fmt::Display::fmt(#val_tt, #formatter_tt)), + ("PT_IPV4ADDR", _) => quote!(::std::fmt::Display::fmt(#val_tt, #formatter_tt)), + ("PT_IPV6ADDR", _) => quote!(::std::fmt::Display::fmt(#val_tt, #formatter_tt)), ("PT_BYTEBUF", "PF_HEX") => quote!(write!(#formatter_tt, "{:x?}", #val_tt)), (_, "PF_HEX") => quote!(::std::fmt::LowerHex::fmt(#val_tt, #formatter_tt)), (_, "PF_OCT") => quote!(::std::fmt::Octal::fmt(#val_tt, #formatter_tt)), diff --git a/justfile b/justfile index 875d126b..11101efb 100644 --- a/justfile +++ b/justfile @@ -7,6 +7,12 @@ pull_api version: wget https://raw.githubusercontent.com/falcosecurity/libs/{{ version }}/userspace/plugin/plugin_api.h -O plugin/plugin_api.h wget https://raw.githubusercontent.com/falcosecurity/libs/{{ version }}/driver/SCHEMA_VERSION -O plugin/SCHEMA_VERSION +[working-directory('falco_plugin_api')] +copy_api path: + cp {{ path }}/userspace/plugin/plugin_types.h plugin/plugin_types.h + cp {{ path }}/userspace/plugin/plugin_api.h plugin/plugin_api.h + cp {{ path }}/driver/SCHEMA_VERSION plugin/SCHEMA_VERSION + [working-directory('falco_plugin_api')] regen_api: bindgen plugin/plugin_api.h \ @@ -38,6 +44,16 @@ pull_events version: wget https://raw.githubusercontent.com/falcosecurity/libs/{{ version }}/driver/SCHEMA_VERSION -O api/SCHEMA_VERSION > api/feature_gates.h +[working-directory('falco_event_schema')] +copy_events path: + cp {{ path }}/driver/ppm_fillers.h api/ppm_fillers.h + cat {{ path }}/driver/ppm_events_public.h | sed 's@\@int64_t@' > api/ppm_events_public.h + cp {{ path }}/driver/event_table.c api/event_table.c + cp {{ path }}/driver/flags_table.c api/flags_table.c + cp {{ path }}/driver/dynamic_params_table.c api/dynamic_params_table.c + cp {{ path }}/driver/SCHEMA_VERSION api/SCHEMA_VERSION + > api/feature_gates.h + [working-directory('falco_event_schema')] regen_events: bindgen api/ppm_events_public.h -- -I. > src/ffi.rs @@ -49,6 +65,8 @@ update_events version: (pull_events version) regen_events pull version: (pull_api version) (pull_events version) +copy path: (copy_api path) (copy_events path) + regen: regen_api regen_events update version: (pull version) regen