add cgroup path to file events (#24)

elastic · Mar 12, 2024 · 0951e19 · 0951e19
1 parent 649c4c8
commit 0951e19
Show file tree

Hide file tree

Showing 5 changed files with 21 additions and 1 deletion.
diff --git a/bpf_arm64_bpfel.o b/bpf_arm64_bpfel.o
diff --git a/bpf_x86_bpfel.o b/bpf_x86_bpfel.o
diff --git a/ebpf b/ebpf
diff --git a/event.go b/event.go
@@ -360,6 +360,7 @@ type FileCreate struct {
 	Comm              string   `json:"comm"`
 	Path              string   `json:"path"`
 	SymlinkTargetPath string   `json:"symlink_target_path"`
+	CgroupPath        string   `json:"cgroup_path"`
 }
 
 func (e *FileCreate) Unmarshal(r *bytes.Reader) error {
@@ -397,6 +398,9 @@ func (e *FileCreate) Unmarshal(r *bytes.Reader) error {
 	if val, ok := vlMap[varlen.SymlinkTargetPath]; ok {
 		e.SymlinkTargetPath = val.(string)
 	}
+	if val, ok := vlMap[varlen.CgroupPath]; ok {
+		e.CgroupPath = val.(string)
+	}
 
 	return nil
 }
@@ -409,6 +413,7 @@ type FileDelete struct {
 	Comm              string   `json:"comm"`
 	Path              string   `json:"path"`
 	SymlinkTargetPath string   `json:"symlink_target_path"`
+	CgroupPath        string   `json:"cgroup_path"`
 }
 
 func (e *FileDelete) Unmarshal(r *bytes.Reader) error {
@@ -446,6 +451,9 @@ func (e *FileDelete) Unmarshal(r *bytes.Reader) error {
 	if val, ok := vlMap[varlen.SymlinkTargetPath]; ok {
 		e.SymlinkTargetPath = val.(string)
 	}
+	if val, ok := vlMap[varlen.CgroupPath]; ok {
+		e.CgroupPath = val.(string)
+	}
 
 	return nil
 }
@@ -459,6 +467,7 @@ type FileRename struct {
 	OldPath           string   `json:"old_path"`
 	NewPath           string   `json:"new_path"`
 	SymlinkTargetPath string   `json:"symlink_target_path"`
+	CgroupPath        string   `json:"cgroup_path"`
 }
 
 func (e *FileRename) Unmarshal(r *bytes.Reader) error {
@@ -499,6 +508,9 @@ func (e *FileRename) Unmarshal(r *bytes.Reader) error {
 	if val, ok := vlMap[varlen.SymlinkTargetPath]; ok {
 		e.SymlinkTargetPath = val.(string)
 	}
+	if val, ok := vlMap[varlen.CgroupPath]; ok {
+		e.CgroupPath = val.(string)
+	}
 
 	return nil
 }
@@ -526,6 +538,7 @@ type FileModify struct {
 	Comm              string         `json:"comm"`
 	Path              string         `json:"path"`
 	SymlinkTargetPath string         `json:"symlink_target_path"`
+	CgroupPath        string         `json:"cgroup_path"`
 }
 
 func (e *FileModify) Unmarshal(r *bytes.Reader) error {
@@ -567,6 +580,9 @@ func (e *FileModify) Unmarshal(r *bytes.Reader) error {
 	if val, ok := vlMap[varlen.SymlinkTargetPath]; ok {
 		e.SymlinkTargetPath = val.(string)
 	}
+	if val, ok := vlMap[varlen.CgroupPath]; ok {
+		e.CgroupPath = val.(string)
+	}
 
 	return nil
 }

diff --git a/event_test.go b/event_test.go
@@ -246,6 +246,7 @@ func writeFileCreate(t *testing.T, w *bufio.Writer, ev ebpfevents.FileCreate) {
 	testutils.WriteVarlenFields(t, w, varlen.Map{
 		varlen.Path:              ev.Path,
 		varlen.SymlinkTargetPath: ev.SymlinkTargetPath,
+		varlen.CgroupPath:        ev.CgroupPath,
 	})
 
 	assert.Nil(t, w.Flush())
@@ -282,6 +283,7 @@ func writeFileRename(t *testing.T, w *bufio.Writer, ev ebpfevents.FileRename) {
 		varlen.OldPath:           ev.OldPath,
 		varlen.NewPath:           ev.NewPath,
 		varlen.SymlinkTargetPath: ev.SymlinkTargetPath,
+		varlen.CgroupPath:        ev.CgroupPath,
 	})
 
 	assert.Nil(t, w.Flush())
@@ -317,6 +319,7 @@ func writeFileDelete(t *testing.T, w *bufio.Writer, ev ebpfevents.FileDelete) {
 	testutils.WriteVarlenFields(t, w, varlen.Map{
 		varlen.Path:              ev.Path,
 		varlen.SymlinkTargetPath: ev.SymlinkTargetPath,
+		varlen.CgroupPath:        ev.CgroupPath,
 	})
 
 	assert.Nil(t, w.Flush())
@@ -353,6 +356,7 @@ func writeFileModify(t *testing.T, w *bufio.Writer, ev ebpfevents.FileModify) {
 	testutils.WriteVarlenFields(t, w, varlen.Map{
 		varlen.Path:              ev.Path,
 		varlen.SymlinkTargetPath: ev.SymlinkTargetPath,
+		varlen.CgroupPath:        ev.CgroupPath,
 	})
 
 	assert.Nil(t, w.Flush())
+4 −4		GPL/Events/EbpfEventProto.h
+20 −0		GPL/Events/File/Probe.bpf.c
+12 −0		non-GPL/Events/EventsTrace/EventsTrace.c