tetragon: Add killer sensor

api/v1/README.md

@@ -826,6 +826,7 @@ loader sensor event triggered for loaded binary/library
 | event | [string](#string) |  | Event of the subsystem. |
 | args | [KprobeArgument](#tetragon-KprobeArgument) | repeated | Arguments definition of the observed tracepoint. TODO: once we implement all we want, rename KprobeArgument to GenericArgument |
 | policy_name | [string](#string) |  | Name of the policy that created that tracepoint. |
+| action | [KprobeAction](#tetragon-KprobeAction) |  | Action performed when the tracepoint matched. |
 
 
 
@@ -975,6 +976,9 @@ RuntimeHookRequest synchronously propagates information to the agent about run-t
 | KPROBE_ACTION_DNSLOOKUP | 8 | GetURL action issue a DNS lookup against an URL from userspace. |
 | KPROBE_ACTION_NOPOST | 9 | NoPost action suppresses the transmission of the event to userspace. |
 | KPROBE_ACTION_SIGNAL | 10 | Signal action sends specified signal to the process. |
+| KPROBE_ACTION_TRACKSOCK | 11 | TrackSock action tracks socket. |
+| KPROBE_ACTION_UNTRACKSOCK | 12 | UntrackSock action un-tracks socket. |
+| KPROBE_ACTION_NOTIFYKILLER | 13 | NotifyKiller action notifies killer sensor. |
 
 
 

api/v1/tetragon/tetragon.proto

@@ -404,6 +404,12 @@ enum KprobeAction {
 	KPROBE_ACTION_NOPOST     = 9;
     // Signal action sends specified signal to the process.
 	KPROBE_ACTION_SIGNAL     = 10;
+    // TrackSock action tracks socket.
+	KPROBE_ACTION_TRACKSOCK   = 11;
+    // UntrackSock action un-tracks socket.
+	KPROBE_ACTION_UNTRACKSOCK = 12;
+    // NotifyKiller action notifies killer sensor.
+	KPROBE_ACTION_NOTIFYKILLER = 13;
 }
 
 message ProcessKprobe {
@@ -439,6 +445,8 @@ message ProcessTracepoint {
     repeated KprobeArgument args = 6;
     // Name of the policy that created that tracepoint.
     string policy_name = 7;
+    // Action performed when the tracepoint matched.
+    KprobeAction action = 8;
 }
 
 message ProcessUprobe {

bpf/Makefile

@@ -34,7 +34,8 @@ PROCESS = bpf_execve_event.o bpf_execve_event_v53.o bpf_fork.o bpf_exit.o bpf_ge
 	  bpf_generic_tracepoint_v61.o \
 	  bpf_multi_kprobe_v61.o bpf_multi_retkprobe_v61.o \
 	  bpf_generic_uprobe_v61.o \
-	  bpf_loader.o
+	  bpf_loader.o \
+	  bpf_killer.o bpf_multi_killer.o
 
 CGROUP = bpf_cgroup_mkdir.o bpf_cgroup_rmdir.o bpf_cgroup_release.o
 BPFTEST = bpf_lseek.o bpf_globals.o
@@ -120,6 +121,12 @@ objs/%_v53.ll:
 $(DEPSDIR)%.d: $(PROCESSDIR)%.c
 	$(CLANG) $(CLANG_FLAGS) -MM -MP -MT $(patsubst $(DEPSDIR)%.d, $(OBJSDIR)%.ll, $@)   $< > $@
 
+objs/bpf_multi_killer.ll: process/bpf_killer.c
+	$(CLANG) $(CLANG_FLAGS) -D__LARGE_BPF_PROG -D__MULTI_KPROBE -c $< -o $@
+
+$(DEPSDIR)/bpf_multi_killer.d: process/bpf_killer.c
+	$(CLANG) $(CLANG_FLAGS) -D__LARGE_BPF_PROG -D__MULTI_KPROBE -MM -MP -MT $(patsubst $(DEPSDIR)%.d, $(OBJSDIR)%.ll, $@) $< > $@
+
 $(DEPSDIR)%_v53.d:
 	$(CLANG) $(CLANG_FLAGS) -D__LARGE_BPF_PROG -MM -MP -MT $(patsubst $(DEPSDIR)%.d, $(OBJSDIR)%.ll, $@)   $< > $@
 

bpf/process/bpf_generic_tracepoint.c

@@ -6,6 +6,9 @@
 
 #include "bpf_event.h"
 #include "bpf_task.h"
+
+#define GENERIC_TRACEPOINT
+
 #include "retprobe_map.h"
 #include "types/operations.h"
 #include "types/basic.h"