tetragon

1
// SPDX-License-Identifier: Apache-2.0
2
// Copyright Authors of Tetragon
3

4
package exec
5

6
import (
7
	"syscall"
8

9
	"github.com/cilium/tetragon/pkg/api"
10
	"golang.org/x/sys/unix"
11
)
12

13
// TODO: Harmonize these with the API docs (Flags field in tetragon.Process)
14
var FlagStrings = map[uint32]string{
15
	api.EventExecve: "execve",
16
	// nolint We still want to support this even though it's deprecated
17
	api.EventExecveAt:              "execveat",
18
	api.EventProcFS:                "procFS",
19
	api.EventTruncFilename:         "truncFilename",
20
	api.EventTruncArgs:             "truncArgs",
21
	api.EventTaskWalk:              "taskWalk",
22
	api.EventMiss:                  "miss",
23
	api.EventNeedsAUID:             "auid",
24
	api.EventErrorFilename:         "errorFilename",
25
	api.EventErrorArgs:             "errorArgs",
26
	api.EventNoCWDSupport:          "nocwd",
27
	api.EventRootCWD:               "rootcwd",
28
	api.EventErrorCWD:              "errorCWD",
29
	api.EventClone:                 "clone",
30
	api.EventErrorCgroupName:       "errorCgroupName",
31
	api.EventErrorCgroupId:         "errorCgroupID",
32
	api.EventErrorCgroupKn:         "errorCgroupKn",
33
	api.EventErrorCgroupSubsysCgrp: "errorCgroupSubsysCgrp",
34
	api.EventErrorCgroupSubsys:     "errorCgroupSubsys",
35
	api.EventErrorCgroups:          "errorCgroups",
36
	api.EventErrorPathComponents:   "errorPathResolutionCwd",
37
}
38

39
var flagsOrdered = []uint32{
40
	api.EventExecve,
41
	// nolint We still want to support this even though it's deprecated
42
	api.EventExecveAt,
43
	api.EventProcFS,
44
	api.EventTruncFilename,
45
	api.EventTruncArgs,
46
	api.EventTaskWalk,
47
	api.EventMiss,
48
	api.EventNeedsAUID,
49
	api.EventErrorFilename,
50
	api.EventErrorArgs,
51
	api.EventNoCWDSupport,
52
	api.EventRootCWD,
53
	api.EventErrorCWD,
54
	api.EventClone,
55
	api.EventErrorCgroupName,
56
	api.EventErrorCgroupId,
57
	api.EventErrorCgroupKn,
58
	api.EventErrorCgroupSubsysCgrp,
59
	api.EventErrorCgroupSubsys,
60
	api.EventErrorCgroups,
61
	api.EventErrorPathComponents,
62
}
63

64
func DecodeCommonFlags(flags uint32) []string {
65
	var s []string
66
	for _, f := range flagsOrdered {
67
		v := FlagStrings[f]
68
		if (flags & f) != 0 {
69
			s = append(s, v)
70
		}
71
	}
72
	return s
73
}
74

75
func Signal(s uint32) string {
76
	if s == 0 {
77
		return ""
78
	}
79
	return unix.SignalName(syscall.Signal(s))
80
}
81