tetragon

type AddTracingPolicyRequest struct {
	Yaml string `protobuf:"bytes,1,opt,name=yaml,proto3" json:"yaml,omitempty"`
	// contains filtered or unexported fields
}

type AddTracingPolicyResponse struct {
	// contains filtered or unexported fields
}

type AggregationInfo struct {

	// Total count of events in this aggregation time window.
	Count uint64 `protobuf:"varint,1,opt,name=count,proto3" json:"count,omitempty"`
	// contains filtered or unexported fields
}

type AggregationOptions struct {

	// Aggregation window size. Defaults to 15 seconds if this field is not set.
	WindowSize *durationpb.Duration `protobuf:"bytes,1,opt,name=window_size,json=windowSize,proto3" json:"window_size,omitempty"`
	// Size of the buffer for the aggregator to receive incoming events. If the
	// buffer becomes full, the aggregator will log a warning and start dropping
	// incoming events.
	ChannelBufferSize uint64 `protobuf:"varint,2,opt,name=channel_buffer_size,json=channelBufferSize,proto3" json:"channel_buffer_size,omitempty"`
	// contains filtered or unexported fields
}

type BinaryProperties struct {

	// If set then this is the set user ID used for execution
	Setuid *wrapperspb.UInt32Value `protobuf:"bytes,1,opt,name=setuid,proto3" json:"setuid,omitempty"`
	// If set then this is the set group ID used for execution
	Setgid *wrapperspb.UInt32Value `protobuf:"bytes,2,opt,name=setgid,proto3" json:"setgid,omitempty"`
	// The reasons why this binary execution changed privileges. Usually this happens when the process executes
	// a binary with the set-user-ID to root or file capability sets.
	// The final granted privileges can be listed inside the `process_credentials` or capabilities fields part of of the `process` object.
	PrivilegesChanged []ProcessPrivilegesChanged `` /* 159-byte string literal not displayed */
	// File properties in case the executed binary is:
	// 1. An anonymous shared memory file https://man7.org/linux/man-pages/man7/shm_overview.7.html.
	// 2. An anonymous file obtained with memfd API https://man7.org/linux/man-pages/man2/memfd_create.2.html.
	// 3. Or it was deleted from the file system.
	File *FileProperties `protobuf:"bytes,4,opt,name=file,proto3" json:"file,omitempty"`
	// contains filtered or unexported fields
}

type CapFilter struct {

	// Filter over the set of permitted capabilities.
	Permitted *CapFilterSet `protobuf:"bytes,1,opt,name=permitted,proto3" json:"permitted,omitempty"`
	// Filter over the set of effective capabilities.
	Effective *CapFilterSet `protobuf:"bytes,2,opt,name=effective,proto3" json:"effective,omitempty"`
	// Filter over the set of inheritable capabilities.
	Inheritable *CapFilterSet `protobuf:"bytes,3,opt,name=inheritable,proto3" json:"inheritable,omitempty"`
	// contains filtered or unexported fields
}

type CapFilterSet struct {

	// Match if the capability set contains any of the capabilities defined in this filter.
	Any []CapabilitiesType `protobuf:"varint,1,rep,packed,name=any,proto3,enum=tetragon.CapabilitiesType" json:"any,omitempty"`
	// Match if the capability set contains all of the capabilities defined in this filter.
	All []CapabilitiesType `protobuf:"varint,2,rep,packed,name=all,proto3,enum=tetragon.CapabilitiesType" json:"all,omitempty"`
	// Match if the capability set exactly matches all of the capabilities defined in this filter.
	Exactly []CapabilitiesType `protobuf:"varint,3,rep,packed,name=exactly,proto3,enum=tetragon.CapabilitiesType" json:"exactly,omitempty"`
	// Match if the capability set contains none of the capabilities defined in this filter.
	None []CapabilitiesType `protobuf:"varint,4,rep,packed,name=none,proto3,enum=tetragon.CapabilitiesType" json:"none,omitempty"`
	// contains filtered or unexported fields
}

type Capabilities struct {

	// Permitted set indicates what capabilities the process can use. This is a
	// limiting superset for the effective capabilities that the thread may
	// assume. It is also a limiting superset for the capabilities that may be
	// added to the inheritable set by a thread without the CAP_SETPCAP in its
	// effective set.
	Permitted []CapabilitiesType `protobuf:"varint,1,rep,packed,name=permitted,proto3,enum=tetragon.CapabilitiesType" json:"permitted,omitempty"`
	// Effective set indicates what capabilities are active in a process. This
	// is the set used by the kernel to perform permission checks for the
	// thread.
	Effective []CapabilitiesType `protobuf:"varint,2,rep,packed,name=effective,proto3,enum=tetragon.CapabilitiesType" json:"effective,omitempty"`
	// Inheritable set indicates which capabilities will be inherited by the
	// current process when running as a root user.
	Inheritable []CapabilitiesType `protobuf:"varint,3,rep,packed,name=inheritable,proto3,enum=tetragon.CapabilitiesType" json:"inheritable,omitempty"`
	// contains filtered or unexported fields
}

type CapabilitiesType int32

type Container struct {

	// Identifier of the container.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Name of the container.
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// Image of the container.
	Image *Image `protobuf:"bytes,3,opt,name=image,proto3" json:"image,omitempty"`
	// Start time of the container.
	StartTime *timestamppb.Timestamp `protobuf:"bytes,4,opt,name=start_time,json=startTime,proto3" json:"start_time,omitempty"`
	// Process identifier in the container namespace.
	Pid *wrapperspb.UInt32Value `protobuf:"bytes,5,opt,name=pid,proto3" json:"pid,omitempty"`
	// If this is set true, it means that the process might have been originated from
	// a Kubernetes exec probe. For this field to be true, the following must be true:
	//  1. The binary field matches the first element of the exec command list for either
	//     liveness or readiness probe excluding the basename. For example, "/bin/ls"
	//     and "ls" are considered a match.
	//  2. The arguments field exactly matches the rest of the exec command list.
	MaybeExecProbe bool `protobuf:"varint,13,opt,name=maybe_exec_probe,json=maybeExecProbe,proto3" json:"maybe_exec_probe,omitempty"`
	// contains filtered or unexported fields
}

type CreateContainer struct {

	// cgroupsPath is the cgroups path for the container. The path is expected to be relative to the
	// cgroups mountpoint. See: https://github.com/opencontainers/runtime-spec/blob/58ec43f9fc39e0db229b653ae98295bfde74aeab/specs-go/config.go#L174
	CgroupsPath string `protobuf:"bytes,1,opt,name=cgroupsPath,proto3" json:"cgroupsPath,omitempty"`
	// rootDir is the absolute path of the root directory of the container.
	// See: https://github.com/opencontainers/runtime-spec/blob/main/specs-go/config.go#L174
	RootDir string `protobuf:"bytes,2,opt,name=rootDir,proto3" json:"rootDir,omitempty"`
	// annotations are the run-time annotations for the container
	// see https://github.com/opencontainers/runtime-spec/blob/main/config.md#annotations
	Annotations map[string]string `` /* 163-byte string literal not displayed */
	// containerName is the name of the container
	ContainerName string `protobuf:"bytes,4,opt,name=containerName,proto3" json:"containerName,omitempty"`
	// contains filtered or unexported fields
}

type DeleteTracingPolicyRequest struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type DeleteTracingPolicyResponse struct {
	// contains filtered or unexported fields
}

type DisableSensorRequest struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type DisableSensorResponse struct {
	// contains filtered or unexported fields
}

type DisableTracingPolicyRequest struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type DisableTracingPolicyResponse struct {
	// contains filtered or unexported fields
}

type EnableSensorRequest struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type EnableSensorResponse struct {
	// contains filtered or unexported fields
}

type EnableTracingPolicyRequest struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type EnableTracingPolicyResponse struct {
	// contains filtered or unexported fields
}

type Event interface {
	Encapsulate() IsGetEventsResponse_Event
}

type EventType int32

type FieldFilter struct {

	// Event types to filter or undefined to filter over all event types.
	EventSet []EventType `protobuf:"varint,1,rep,packed,name=event_set,json=eventSet,proto3,enum=tetragon.EventType" json:"event_set,omitempty"`
	// Fields to include or exclude.
	Fields *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=fields,proto3" json:"fields,omitempty"`
	// Whether to include or exclude fields.
	Action FieldFilterAction `protobuf:"varint,3,opt,name=action,proto3,enum=tetragon.FieldFilterAction" json:"action,omitempty"`
	// Whether or not the event set filter should be inverted.
	InvertEventSet *wrapperspb.BoolValue `protobuf:"bytes,4,opt,name=invert_event_set,json=invertEventSet,proto3" json:"invert_event_set,omitempty"`
	// contains filtered or unexported fields
}

type FieldFilterAction int32

type FileProperties struct {

	// Inode of the file
	Inode *InodeProperties `protobuf:"bytes,1,opt,name=inode,proto3" json:"inode,omitempty"`
	// Path of the file
	Path string `protobuf:"bytes,2,opt,name=path,proto3" json:"path,omitempty"`
	// contains filtered or unexported fields
}

type Filter struct {
	BinaryRegex []string              `protobuf:"bytes,1,rep,name=binary_regex,json=binaryRegex,proto3" json:"binary_regex,omitempty"`
	Namespace   []string              `protobuf:"bytes,2,rep,name=namespace,proto3" json:"namespace,omitempty"`
	HealthCheck *wrapperspb.BoolValue `protobuf:"bytes,3,opt,name=health_check,json=healthCheck,proto3" json:"health_check,omitempty"`
	Pid         []uint32              `protobuf:"varint,4,rep,packed,name=pid,proto3" json:"pid,omitempty"`
	// Filter by the PID of a process and any of its descendants. Note that this filter is
	// intended for testing and development purposes only and should not be used in
	// production. In particular, PID cycling in the OS over longer periods of time may
	// cause unexpected events to pass this filter.
	PidSet   []uint32    `protobuf:"varint,5,rep,packed,name=pid_set,json=pidSet,proto3" json:"pid_set,omitempty"`
	EventSet []EventType `protobuf:"varint,6,rep,packed,name=event_set,json=eventSet,proto3,enum=tetragon.EventType" json:"event_set,omitempty"`
	// Filter by process.pod.name field using RE2 regular expression syntax:
	// https://github.com/google/re2/wiki/Syntax
	PodRegex []string `protobuf:"bytes,7,rep,name=pod_regex,json=podRegex,proto3" json:"pod_regex,omitempty"`
	// Filter by process.arguments field using RE2 regular expression syntax:
	// https://github.com/google/re2/wiki/Syntax
	ArgumentsRegex []string `protobuf:"bytes,8,rep,name=arguments_regex,json=argumentsRegex,proto3" json:"arguments_regex,omitempty"`
	// Filter events by pod labels using Kubernetes label selector syntax:
	// https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/#label-selectors
	// Note that this filter never matches events without the pod field (i.e.
	// host process events).
	Labels []string `protobuf:"bytes,9,rep,name=labels,proto3" json:"labels,omitempty"`
	// Filter events by tracing policy names
	PolicyNames []string `protobuf:"bytes,10,rep,name=policy_names,json=policyNames,proto3" json:"policy_names,omitempty"`
	// Filter events by Linux process capability
	Capabilities *CapFilter `protobuf:"bytes,11,opt,name=capabilities,proto3" json:"capabilities,omitempty"`
	// contains filtered or unexported fields
}

type FineGuidanceSensorsClient interface {
	GetEvents(ctx context.Context, in *GetEventsRequest, opts ...grpc.CallOption) (FineGuidanceSensors_GetEventsClient, error)
	GetHealth(ctx context.Context, in *GetHealthStatusRequest, opts ...grpc.CallOption) (*GetHealthStatusResponse, error)
	AddTracingPolicy(ctx context.Context, in *AddTracingPolicyRequest, opts ...grpc.CallOption) (*AddTracingPolicyResponse, error)
	DeleteTracingPolicy(ctx context.Context, in *DeleteTracingPolicyRequest, opts ...grpc.CallOption) (*DeleteTracingPolicyResponse, error)
	RemoveSensor(ctx context.Context, in *RemoveSensorRequest, opts ...grpc.CallOption) (*RemoveSensorResponse, error)
	ListTracingPolicies(ctx context.Context, in *ListTracingPoliciesRequest, opts ...grpc.CallOption) (*ListTracingPoliciesResponse, error)
	EnableTracingPolicy(ctx context.Context, in *EnableTracingPolicyRequest, opts ...grpc.CallOption) (*EnableTracingPolicyResponse, error)
	DisableTracingPolicy(ctx context.Context, in *DisableTracingPolicyRequest, opts ...grpc.CallOption) (*DisableTracingPolicyResponse, error)
	ListSensors(ctx context.Context, in *ListSensorsRequest, opts ...grpc.CallOption) (*ListSensorsResponse, error)
	EnableSensor(ctx context.Context, in *EnableSensorRequest, opts ...grpc.CallOption) (*EnableSensorResponse, error)
	DisableSensor(ctx context.Context, in *DisableSensorRequest, opts ...grpc.CallOption) (*DisableSensorResponse, error)
	GetStackTraceTree(ctx context.Context, in *GetStackTraceTreeRequest, opts ...grpc.CallOption) (*GetStackTraceTreeResponse, error)
	GetVersion(ctx context.Context, in *GetVersionRequest, opts ...grpc.CallOption) (*GetVersionResponse, error)
	RuntimeHook(ctx context.Context, in *RuntimeHookRequest, opts ...grpc.CallOption) (*RuntimeHookResponse, error)
}

type FineGuidanceSensorsServer interface {
	GetEvents(*GetEventsRequest, FineGuidanceSensors_GetEventsServer) error
	GetHealth(context.Context, *GetHealthStatusRequest) (*GetHealthStatusResponse, error)
	AddTracingPolicy(context.Context, *AddTracingPolicyRequest) (*AddTracingPolicyResponse, error)
	DeleteTracingPolicy(context.Context, *DeleteTracingPolicyRequest) (*DeleteTracingPolicyResponse, error)
	RemoveSensor(context.Context, *RemoveSensorRequest) (*RemoveSensorResponse, error)
	ListTracingPolicies(context.Context, *ListTracingPoliciesRequest) (*ListTracingPoliciesResponse, error)
	EnableTracingPolicy(context.Context, *EnableTracingPolicyRequest) (*EnableTracingPolicyResponse, error)
	DisableTracingPolicy(context.Context, *DisableTracingPolicyRequest) (*DisableTracingPolicyResponse, error)
	ListSensors(context.Context, *ListSensorsRequest) (*ListSensorsResponse, error)
	EnableSensor(context.Context, *EnableSensorRequest) (*EnableSensorResponse, error)
	DisableSensor(context.Context, *DisableSensorRequest) (*DisableSensorResponse, error)
	GetStackTraceTree(context.Context, *GetStackTraceTreeRequest) (*GetStackTraceTreeResponse, error)
	GetVersion(context.Context, *GetVersionRequest) (*GetVersionResponse, error)
	RuntimeHook(context.Context, *RuntimeHookRequest) (*RuntimeHookResponse, error)
}

type FineGuidanceSensors_GetEventsClient interface {
	Recv() (*GetEventsResponse, error)
	grpc.ClientStream
}

type FineGuidanceSensors_GetEventsServer interface {
	Send(*GetEventsResponse) error
	grpc.ServerStream
}

type GetEventsRequest struct {

	// allow_list specifies a list of filters to apply to only return certain
	// events. If multiple filters are specified, at least one of them has to
	// match for an event to be included in the results.
	AllowList []*Filter `protobuf:"bytes,1,rep,name=allow_list,json=allowList,proto3" json:"allow_list,omitempty"`
	// deny_list specifies a list of filters to apply to exclude certain events
	// from the results. If multiple filters are specified, at least one of
	// them has to match for an event to be excluded.
	// If both allow_list and deny_list are specified, the results contain the
	// set difference allow_list - deny_list.
	DenyList []*Filter `protobuf:"bytes,2,rep,name=deny_list,json=denyList,proto3" json:"deny_list,omitempty"`
	// aggregation_options configures aggregation options for this request.
	// If this field is not set, responses will not be aggregated.
	// Note that currently only process_accept and process_connect events are
	// aggregated. Other events remain unaggregated.
	AggregationOptions *AggregationOptions `protobuf:"bytes,3,opt,name=aggregation_options,json=aggregationOptions,proto3" json:"aggregation_options,omitempty"`
	// Fields to include or exclude for events in the GetEventsResponse. Omitting this
	// field implies that all fields will be included. Exclusion always takes precedence
	// over inclusion in the case of conflicts.
	FieldFilters []*FieldFilter `protobuf:"bytes,4,rep,name=field_filters,json=fieldFilters,proto3" json:"field_filters,omitempty"`
	// contains filtered or unexported fields
}

type GetEventsResponse struct {

	// The type-specific fields of an event.
	//
	// NOTE: Numbers must stay in sync with enum EventType.
	//
	// Types that are assignable to Event:
	//
	//	*GetEventsResponse_ProcessExec
	//	*GetEventsResponse_ProcessExit
	//	*GetEventsResponse_ProcessKprobe
	//	*GetEventsResponse_ProcessTracepoint
	//	*GetEventsResponse_ProcessLoader
	//	*GetEventsResponse_ProcessUprobe
	//	*GetEventsResponse_ProcessThrottle
	//	*GetEventsResponse_Test
	//	*GetEventsResponse_RateLimitInfo
	Event isGetEventsResponse_Event `protobuf_oneof:"event"`
	// Name of the node where this event was observed.
	NodeName string `protobuf:"bytes,1000,opt,name=node_name,json=nodeName,proto3" json:"node_name,omitempty"`
	// Timestamp at which this event was observed.
	// For an aggregated response, this field to set to the timestamp at which
	// the event was observed for the first time in a given aggregation time window.
	Time *timestamppb.Timestamp `protobuf:"bytes,1001,opt,name=time,proto3" json:"time,omitempty"`
	// aggregation_info contains information about aggregation results. This field
	// is set only for aggregated responses.
	AggregationInfo *AggregationInfo `protobuf:"bytes,1002,opt,name=aggregation_info,json=aggregationInfo,proto3" json:"aggregation_info,omitempty"`
	// contains filtered or unexported fields
}

type GetEventsResponse_ProcessExec struct {
	// ProcessExec event includes information about the execution of
	// binaries and other related process metadata.
	ProcessExec *ProcessExec `protobuf:"bytes,1,opt,name=process_exec,json=processExec,proto3,oneof"`
}

type GetEventsResponse_ProcessExit struct {
	// ProcessExit event indicates how and when a process terminates.
	ProcessExit *ProcessExit `protobuf:"bytes,5,opt,name=process_exit,json=processExit,proto3,oneof"`
}

type GetEventsResponse_ProcessKprobe struct {
	// ProcessKprobe event contains information about the pre-defined
	// functions and the process that invoked them.
	ProcessKprobe *ProcessKprobe `protobuf:"bytes,9,opt,name=process_kprobe,json=processKprobe,proto3,oneof"`
}

type GetEventsResponse_ProcessLoader struct {
	ProcessLoader *ProcessLoader `protobuf:"bytes,11,opt,name=process_loader,json=processLoader,proto3,oneof"`
}

type GetEventsResponse_ProcessThrottle struct {
	ProcessThrottle *ProcessThrottle `protobuf:"bytes,27,opt,name=process_throttle,json=processThrottle,proto3,oneof"`
}

type GetEventsResponse_ProcessTracepoint struct {
	// ProcessTracepoint contains information about the pre-defined
	// tracepoint and the process that invoked them.
	ProcessTracepoint *ProcessTracepoint `protobuf:"bytes,10,opt,name=process_tracepoint,json=processTracepoint,proto3,oneof"`
}

type GetEventsResponse_ProcessUprobe struct {
	ProcessUprobe *ProcessUprobe `protobuf:"bytes,12,opt,name=process_uprobe,json=processUprobe,proto3,oneof"`
}

type GetEventsResponse_RateLimitInfo struct {
	RateLimitInfo *RateLimitInfo `protobuf:"bytes,40001,opt,name=rate_limit_info,json=rateLimitInfo,proto3,oneof"`
}

type GetEventsResponse_Test struct {
	Test *Test `protobuf:"bytes,40000,opt,name=test,proto3,oneof"`
}

type GetHealthStatusRequest struct {
	EventSet []HealthStatusType `protobuf:"varint,1,rep,packed,name=event_set,json=eventSet,proto3,enum=tetragon.HealthStatusType" json:"event_set,omitempty"`
	// contains filtered or unexported fields
}

type GetHealthStatusResponse struct {
	HealthStatus []*HealthStatus `protobuf:"bytes,1,rep,name=health_status,json=healthStatus,proto3" json:"health_status,omitempty"`
	// contains filtered or unexported fields
}

type GetStackTraceTreeRequest struct {
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GetStackTraceTreeResponse struct {
	Root *StackTraceNode `protobuf:"bytes,1,opt,name=root,proto3" json:"root,omitempty"`
	// contains filtered or unexported fields
}

type GetVersionRequest struct {
	// contains filtered or unexported fields
}

type GetVersionResponse struct {
	Version string `protobuf:"bytes,1,opt,name=version,proto3" json:"version,omitempty"`
	// contains filtered or unexported fields
}

type HealthStatus struct {
	Event   HealthStatusType   `protobuf:"varint,1,opt,name=event,proto3,enum=tetragon.HealthStatusType" json:"event,omitempty"`
	Status  HealthStatusResult `protobuf:"varint,2,opt,name=status,proto3,enum=tetragon.HealthStatusResult" json:"status,omitempty"`
	Details string             `protobuf:"bytes,3,opt,name=details,proto3" json:"details,omitempty"`
	// contains filtered or unexported fields
}

type HealthStatusResult int32

type HealthStatusType int32

type Image struct {

	// Identifier of the container image composed of the registry path and the
	// sha256.
	Id string `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	// Name of the container image composed of the registry path and the tag.
	Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type InodeProperties struct {

	// The inode number
	Number uint64 `protobuf:"varint,1,opt,name=number,proto3" json:"number,omitempty"`
	// The inode links on the file system. If zero means the file is only in memory
	Links *wrapperspb.UInt32Value `protobuf:"bytes,2,opt,name=links,proto3" json:"links,omitempty"`
	// contains filtered or unexported fields
}

type IsGetEventsResponse_Event = isGetEventsResponse_Event

type KernelModule struct {

	// Kernel module name
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// If true the module signature was verified successfully. Depends on kernels compiled with
	// CONFIG_MODULE_SIG option, for details please read: https://www.kernel.org/doc/Documentation/admin-guide/module-signing.rst
	SignatureOk *wrapperspb.BoolValue `protobuf:"bytes,2,opt,name=signature_ok,json=signatureOk,proto3" json:"signature_ok,omitempty"`
	// The module tainted flags that will be applied on the kernel. For further details please read: https://docs.kernel.org/admin-guide/tainted-kernels.html
	Tainted []TaintedBitsType `protobuf:"varint,3,rep,packed,name=tainted,proto3,enum=tetragon.TaintedBitsType" json:"tainted,omitempty"`
	// contains filtered or unexported fields
}