Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[auditbeat] fim: implement kprobes backend #37796

Merged
merged 43 commits into from
Feb 14, 2024
Merged

[auditbeat] fim: implement kprobes backend #37796

merged 43 commits into from
Feb 14, 2024

Commits on Jan 25, 2024

  1. feat: add helper funcs to get symbol info from /proc/kallsyms

    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    cb01f59 View commit details
    Browse the repository at this point in the history

  2. feat: introduce fixed executor that always runs funcs from the same o… 

    …s thread
    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    9417243 View commit details
    Browse the repository at this point in the history

  3. feat: add probe manager to handle building tracing kprobes from tk-bt… 

    …f ones
    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    bbca9e7 View commit details
    Browse the repository at this point in the history

  4. feat: define probe events with corresponding alloc and release funcs

    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    292b7b7 View commit details
    Browse the repository at this point in the history

  5. feat: embed stripped btf files and add helper funcs to read them

    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    d585da1 View commit details
    Browse the repository at this point in the history

  6. feat: add fsnotify, fsnotify_nameremove, fsnotify_parent and vfs_geat… 

    …tr tk-btf probe builders in probe manager
    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    e4616c1 View commit details
    Browse the repository at this point in the history

  7. feat: implement path traverser to produce monitor events by walking a… 

    … path
    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    625da6b View commit details
    Browse the repository at this point in the history

  8. feat: implement directory entries cache

    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    6f35ab1 View commit details
    Browse the repository at this point in the history

  9. feat: implement event processor to process probe events and based on … 

    …directory entry cache emit the respective event
    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    31ec585 View commit details
    Browse the repository at this point in the history

  10. feat: implement event verifier that validates that the expected seque… 

    …nce of generated fs events are properly emitted
    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    ea61593 View commit details
    Browse the repository at this point in the history

  11. feat: add perfChannel to reduce tracing.PerfChannel boilerplate code … 

    …and satisfy testing needs
    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    f58e369 View commit details
    Browse the repository at this point in the history

  12. feat: implement monitor that ties together path traverser, perf chann… 

    …el and event emitting
    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    0c785ca View commit details
    Browse the repository at this point in the history

  13. feat: implement probe verification at runtime and the creation of a n… 

    …ew monitor based on these
    @pkoutsovasilis
    pkoutsovasilis committed Jan 25, 2024
    Configuration menu
    Copy the full SHA
    d8bf292 View commit details
    Browse the repository at this point in the history

Commits on Jan 31, 2024

  1. feat: implement event reader for kprobe-based file integrity module

    @pkoutsovasilis
    pkoutsovasilis committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    097aa25 View commit details
    Browse the repository at this point in the history

  2. doc: update NOTICE.txt to include tk-btf license

    @pkoutsovasilis
    pkoutsovasilis committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    c4a9d9b View commit details
    Browse the repository at this point in the history

  3. feat: add tests for non-recursive kprobe fim (#3)

    @Tacklebox @pkoutsovasilis
    Tacklebox authored and pkoutsovasilis committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    6ca359f View commit details
    Browse the repository at this point in the history

  4. fix: remove existing file from cache when a move operation is overwri… 

    …ting it
    @pkoutsovasilis
    pkoutsovasilis committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    07b927b View commit details
    Browse the repository at this point in the history

  5. feat: introduce force_backend in for file integrity auditbeat module

    @pkoutsovasilis
    pkoutsovasilis committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    045bf40 View commit details
    Browse the repository at this point in the history

  6. ci: add necessary volume mounts for kprobes backend in auditbeat dock… 

    …er-compose.yml
    @pkoutsovasilis
    pkoutsovasilis committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    bd6bcfb View commit details
    Browse the repository at this point in the history

  7. feat: add the instantiation of file integrity module with kprobes bac… 

    …kend
    @pkoutsovasilis
    pkoutsovasilis committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    651b2f7 View commit details
    Browse the repository at this point in the history

  8. doc: update CHANGELOG.next.asciidoc

    @pkoutsovasilis
    pkoutsovasilis committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    d39b22f View commit details
    Browse the repository at this point in the history

  9. fix: address compilation issues for non-linux oses

    @pkoutsovasilis
    pkoutsovasilis committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    1509a1a View commit details
    Browse the repository at this point in the history

  10. fix: correct folder permission for path traverser unit-test

    @pkoutsovasilis
    pkoutsovasilis committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    0469332 View commit details
    Browse the repository at this point in the history

  11. fix: build kprobe package and unit-tests only for linux

    @pkoutsovasilis
    pkoutsovasilis committed Jan 31, 2024
    Configuration menu
    Copy the full SHA
    6308e8b View commit details
    Browse the repository at this point in the history

Commits on Feb 1, 2024

  1. ci: extend test_file_integrity.py to test kprobes backend of file int… 

    …egrity module
    @pkoutsovasilis
    pkoutsovasilis committed Feb 1, 2024
    Configuration menu
    Copy the full SHA
    c52743b View commit details
    Browse the repository at this point in the history

  2. ci: extend TestNew in monitor to include actual file changes

    @pkoutsovasilis
    pkoutsovasilis committed Feb 1, 2024
    Configuration menu
    Copy the full SHA
    6ccd479 View commit details
    Browse the repository at this point in the history

  3. ci: mark with nolint prealloc slices that can't be pre-allocated

    @pkoutsovasilis
    pkoutsovasilis committed Feb 1, 2024
    Configuration menu
    Copy the full SHA
    82a07be View commit details
    Browse the repository at this point in the history

  4. Merge remote-tracking branch 'beats/main' into pkoutsovasilis/kprobe_fim

    @pkoutsovasilis
    pkoutsovasilis committed Feb 1, 2024
    Configuration menu
    Copy the full SHA
    cb2b330 View commit details
    Browse the repository at this point in the history

  5. Merge remote-tracking branch 'beats/main' into pkoutsovasilis/kprobe_fim

    @pkoutsovasilis
    pkoutsovasilis committed Feb 1, 2024
    Configuration menu
    Copy the full SHA
    5c00c37 View commit details
    Browse the repository at this point in the history

Commits on Feb 3, 2024

  1. Merge remote-tracking branch 'beats/main' into pkoutsovasilis/kprobe_fim

    @pkoutsovasilis
    pkoutsovasilis committed Feb 3, 2024
    Configuration menu
    Copy the full SHA
    3ad318b View commit details
    Browse the repository at this point in the history

Commits on Feb 9, 2024

  1. chore: inline defer funcs

    @pkoutsovasilis
    pkoutsovasilis committed Feb 9, 2024
    Configuration menu
    Copy the full SHA
    4650e5f View commit details
    Browse the repository at this point in the history

  2. fix: return the scanner error if any

    @pkoutsovasilis
    pkoutsovasilis committed Feb 9, 2024
    Configuration menu
    Copy the full SHA
    62ea807 View commit details
    Browse the repository at this point in the history

  3. fix: remove redundant runtime os checks for linux

    @pkoutsovasilis
    pkoutsovasilis committed Feb 9, 2024
    Configuration menu
    Copy the full SHA
    f1cff58 View commit details
    Browse the repository at this point in the history

  4. doc: comment that dEntryCache is not thread-safe

    @pkoutsovasilis
    pkoutsovasilis committed Feb 9, 2024
    Configuration menu
    Copy the full SHA
    5350596 View commit details
    Browse the repository at this point in the history

  5. fix: set the appropriate verbosity of errors of watcher

    @pkoutsovasilis
    pkoutsovasilis committed Feb 9, 2024
    Configuration menu
    Copy the full SHA
    fe6453a View commit details
    Browse the repository at this point in the history

  6. fix: check for scanner.Err and return err from parsing mountinfo lines

    @pkoutsovasilis
    pkoutsovasilis committed Feb 9, 2024
    Configuration menu
    Copy the full SHA
    da84277 View commit details
    Browse the repository at this point in the history

Commits on Feb 13, 2024

  1. fix: remove redundant fim_backends list from test_file_integrity.py

    @pkoutsovasilis
    pkoutsovasilis committed Feb 13, 2024
    Configuration menu
    Copy the full SHA
    c4d2edb View commit details
    Browse the repository at this point in the history

  2. Merge remote-tracking branch 'beats/main' into pkoutsovasilis/kprobe_fim 

    # Conflicts:
#	auditbeat/auditbeat.reference.yml
#	auditbeat/docs/modules/file_integrity.asciidoc
#	auditbeat/module/file_integrity/_meta/config.yml.tmpl
#	auditbeat/module/file_integrity/_meta/docs.asciidoc
#	auditbeat/module/file_integrity/config.go
#	auditbeat/module/file_integrity/event.go
#	auditbeat/module/file_integrity/eventreader_fsnotify.go
#	auditbeat/module/file_integrity/eventreader_linux.go
#	auditbeat/module/file_integrity/eventreader_other.go
#	auditbeat/module/file_integrity/schema.fbs
#	auditbeat/module/file_integrity/schema/Source.go
#	auditbeat/tests/system/test_file_integrity.py
#	go.mod
#	x-pack/auditbeat/auditbeat.reference.yml
    @pkoutsovasilis
    pkoutsovasilis committed Feb 13, 2024
    Configuration menu
    Copy the full SHA
    6cd08cb View commit details
    Browse the repository at this point in the history

  3. fix: gofumpt kprobes package

    @pkoutsovasilis
    pkoutsovasilis committed Feb 13, 2024
    Configuration menu
    Copy the full SHA
    e745e23 View commit details
    Browse the repository at this point in the history

  4. fix: highlight unused context in event processor

    @pkoutsovasilis
    pkoutsovasilis committed Feb 13, 2024
    Configuration menu
    Copy the full SHA
    4a12aa9 View commit details
    Browse the repository at this point in the history

  5. fix: increase interval period of wait_output as kprobes require more … 

    …time to verify the probes and print output
    @pkoutsovasilis
    pkoutsovasilis committed Feb 13, 2024
    Configuration menu
    Copy the full SHA
    d80fbf5 View commit details
    Browse the repository at this point in the history

  6. fix: proper formatting for auditbeat.reference.yml

    @pkoutsovasilis
    pkoutsovasilis committed Feb 13, 2024
    Configuration menu
    Copy the full SHA
    bd8d23a View commit details
    Browse the repository at this point in the history

  7. fix: proper formatting for x-pack/auditbeat/auditbeat.reference.yml

    @pkoutsovasilis
    pkoutsovasilis committed Feb 13, 2024
    Configuration menu
    Copy the full SHA
    f1e51f4 View commit details
    Browse the repository at this point in the history