[auditbeat] fim: implement kprobes backend#37796

Merged

pkoutsovasilis merged 43 commits intoelastic:mainfrom pkoutsovasilis:pkoutsovasilis/kprobe_fim

Feb 14, 2024

+7,435-6

Commits on Jan 25, 2024

feat: add helper funcs to get symbol info from /proc/kallsyms
pkoutsovasilis
committed
feat: introduce fixed executor that always runs funcs from the same os thread
pkoutsovasilis
committed
feat: add probe manager to handle building tracing kprobes from tk-btf ones
pkoutsovasilis
committed
feat: define probe events with corresponding alloc and release funcs
pkoutsovasilis
committed
feat: embed stripped btf files and add helper funcs to read them
pkoutsovasilis
committed
feat: add fsnotify, fsnotify_nameremove, fsnotify_parent and vfs_geattr tk-btf probe builders in probe manager
pkoutsovasilis
committed
feat: implement path traverser to produce monitor events by walking a path
pkoutsovasilis
committed
feat: implement directory entries cache
pkoutsovasilis
committed
feat: implement event processor to process probe events and based on directory entry cache emit the respective event
pkoutsovasilis
committed
feat: implement event verifier that validates that the expected sequence of generated fs events are properly emitted
pkoutsovasilis
committed
feat: add perfChannel to reduce tracing.PerfChannel boilerplate code and satisfy testing needs
pkoutsovasilis
committed
feat: implement monitor that ties together path traverser, perf channel and event emitting
pkoutsovasilis
committed
feat: implement probe verification at runtime and the creation of a new monitor based on these
pkoutsovasilis
committed

Commits on Jan 31, 2024

Commits on Feb 3, 2024

Merge remote-tracking branch 'beats/main' into pkoutsovasilis/kprobe_fim
pkoutsovasilis
committed

Commits on Feb 13, 2024