mirror of
https://github.com/hanzoai/visor.git
synced 2026-09-24 17:04:14 +00:00
Xin ZhongandgVisor bot
95e33b9705
This change introduces a new seccheck point, "sentry/mmap", which is triggered when a memory mapping is created. The seccheck event includes information about the mapped file, such as its path, inode, mode, UID, and GID, as well as a timestamp. It also indicates if the mapping corresponds to the initial executable. This allows for monitoring of potential code injection or execution from unexpected sources. PiperOrigin-RevId: 944614086
61 lines
1.1 KiB
JSON
61 lines
1.1 KiB
JSON
{
|
|
"trace_session": {
|
|
"name": "Default",
|
|
"points": [
|
|
{
|
|
"name": "container/start"
|
|
},
|
|
{
|
|
"name": "sentry/clone"
|
|
},
|
|
{
|
|
"name": "sentry/task_exit"
|
|
},
|
|
{
|
|
"name": "syscall/openat/enter"
|
|
},
|
|
{
|
|
"name": "syscall/openat/exit"
|
|
},
|
|
{
|
|
"name": "syscall/read/enter",
|
|
"optional_fields": [
|
|
"fd_path"
|
|
],
|
|
"context_fields": [
|
|
"time",
|
|
"container_id",
|
|
"thread_id"
|
|
]
|
|
},
|
|
{
|
|
"name": "syscall/read/exit"
|
|
},
|
|
{
|
|
"name": "syscall/sysno/1/enter",
|
|
"context_fields": [
|
|
"time",
|
|
"container_id"
|
|
]
|
|
},
|
|
{
|
|
"name": "syscall/sysno/1/exit"
|
|
},
|
|
{
|
|
"name": "sentry/mmap",
|
|
"context_fields": ["time", "container_id", "thread_id"]
|
|
}
|
|
],
|
|
"sinks": [
|
|
{
|
|
"name": "remote",
|
|
"config": {
|
|
"endpoint": "/tmp/gvisor_events.sock",
|
|
"retries": 3
|
|
},
|
|
"ignore_setup_error": true
|
|
}
|
|
]
|
|
}
|
|
}
|