- Wraps all non-main helper functions, structs, and variables in an anonymous
namespace to avoid One Definition Rule (ODR) violations.
- Capitalizes function names to follow CamelCase conventions (e.g., Unpack,
ReadAndUnpack, PollLoop, Handshake).
- Renames struct and macro variables (e.g., struct header -> struct Header,
maxEventSize -> kMaxEventSize).
- Modernizes ParseFromArray calls by replacing them with ParseFromString.
- Adds missing standard library includes (<cerrno>, <cstdint>, <array>,
<functional>).
- Renames the non-templated Unpack front-door function to DispatchMessage to
clarify its routing purpose and avoid naming collisions.
- Resolves a strict aliasing violation in PollLoop by explicitly casting the
file descriptor through intptr_t.
PiperOrigin-RevId: 953469340
The order in dispatchers array does not match the enum in common.proto. This
caused the server to silently process syscall endpoints like Dup, Prlimit,
Pipe, Fcntl, Signalfd, Chroot, and Eventfd using the wrong protobuf types.
This change realigns the dispatcher indices correctly with the protobuf
MessageType enum.
PiperOrigin-RevId: 953118943
This change implements the PointListen trace point to capture details of the
listen syscall, including the file descriptor, backlog, socket family,
socket type, and bound address. It also updates the seccheck metadata for
amd64 and arm64, adds the Listen protobuf message, and includes test coverage.
PiperOrigin-RevId: 952916092
This change introduces a seccheck point for the mmap syscall on both amd64 and
arm64. A new proto message `Mmap` is defined to capture the syscall arguments,
including the file descriptor path when requested. The example seccheck server
is updated to handle the new message type, and a basic test case is added to
the trace tests.
PiperOrigin-RevId: 947914706
This change introduces a new seccheck point, "sentry/mmap", which is triggered
when a memory mapping is created. The seccheck event includes information about
the mapped file, such as its path, inode, mode, UID, and GID, as well as a
timestamp. It also indicates if the mapping corresponds to the initial
executable. This allows for monitoring of potential code injection or execution
from unexpected sources.
PiperOrigin-RevId: 944614086
When writing a trace point fails, the remote checker can retry with
configurable exponential backoff. After the number of retries is
exceeded, the point is dropped. The number of dropped events are
reported in the message header and also in `runsc trace list`
command.
Updates #4805
PiperOrigin-RevId: 456662539
Added a raw syscall points to all syscalls. Added schematized syscall
points to the following syscalls:
- Chdir
- Fchdir
- Setgid
- Setuid
- Setsid
- Setresuid
- Setresgid
PiperOrigin-RevId: 451001973
The use of protobuf.Any is convenient, but adds to proto serialization
time and number of memory allocations required to send a message.
Instead, we now use an enum to indentify the message and use it to
determine how to unmarshall the message on the receiveing end. It
also speeds up event consuption by not requiring a map from string
(proto names) to callbacks.
BenchmarkProtoAny-6 115.9 ns/op 210 B/op 4 allocs/op
BenchmarkProtoEnum-6 58.3 ns/op 2 B/op 1 allocs/op
Updates #4805
PiperOrigin-RevId: 446879057
Added a raw syscall points to all syscalls. Added schematized syscall
points to the following syscalls:
- read
- close
- socket
- connect
- execve
- creat
- openat
- execveat
Updates #4805
PiperOrigin-RevId: 446008358
Added new flag `--pod-init-config` that allows custom configuration
steps to be specified when a pod is being created. For now, the only
step supported is to configure a seccheck session, but more can be
added in the future, e.g. startup hook.
In seccheck, metadata was added for all Points and sinks (aka Checkers)
so that an external configuration files can reference them. In addition,
infrastructure to read and configure sessions from a file has been
added. Only a single session ("Default") is supported for now.
Updates #4805
PiperOrigin-RevId: 444705708
