feat(go): advance validation sidecar toward production

go-agent/internal/ebpfsource/syscall_bpfeb.go

@@ -0,0 +1,157 @@
+// Code generated by bpf2go; DO NOT EDIT.
+//go:build mips || mips64 || ppc64 || s390x
+
+package ebpfsource
+
+import (
+	"bytes"
+	_ "embed"
+	"fmt"
+	"io"
+
+	"github.com/cilium/ebpf"
+)
+
+// Names of all BPF objects in the ELF.
+//
+// Used for safe lookups in a Collection or CollectionSpec.
+const (
+	syscallMapMonitoredHostComms = "monitored_host_comms"
+	syscallMapMonitoredSyscalls  = "monitored_syscalls"
+	syscallMapPendingReturns     = "pending_returns"
+	syscallMapSyscallEvents      = "syscall_events"
+	syscallProgTraceSysEnter     = "trace_sys_enter"
+	syscallProgTraceSysExit      = "trace_sys_exit"
+)
+
+// loadSyscall returns the embedded CollectionSpec for syscall.
+func loadSyscall() (*ebpf.CollectionSpec, error) {
+	reader := bytes.NewReader(_SyscallBytes)
+	spec, err := ebpf.LoadCollectionSpecFromReader(reader)
+	if err != nil {
+		return nil, fmt.Errorf("can't load syscall: %w", err)
+	}
+
+	return spec, err
+}
+
+// loadSyscallObjects loads syscall and converts it into a struct.
+//
+// The following types are suitable as obj argument:
+//
+//	*syscallObjects
+//	*syscallPrograms
+//	*syscallMaps
+//
+// See ebpf.CollectionSpec.LoadAndAssign documentation for details.
+func loadSyscallObjects(obj any, opts *ebpf.CollectionOptions) error {
+	spec, err := loadSyscall()
+	if err != nil {
+		return err
+	}
+
+	return spec.LoadAndAssign(obj, opts)
+}
+
+// syscallSpecs contains maps and programs before they are loaded into the kernel.
+//
+// It can be passed ebpf.CollectionSpec.Assign.
+type syscallSpecs struct {
+	syscallProgramSpecs
+	syscallMapSpecs
+	syscallVariableSpecs
+}
+
+// syscallProgramSpecs contains programs before they are loaded into the kernel.
+//
+// It can be passed ebpf.CollectionSpec.Assign.
+type syscallProgramSpecs struct {
+	TraceSysEnter *ebpf.ProgramSpec `ebpf:"trace_sys_enter"`
+	TraceSysExit  *ebpf.ProgramSpec `ebpf:"trace_sys_exit"`
+}
+
+// syscallMapSpecs contains maps before they are loaded into the kernel.
+//
+// It can be passed ebpf.CollectionSpec.Assign.
+type syscallMapSpecs struct {
+	MonitoredHostComms *ebpf.MapSpec `ebpf:"monitored_host_comms"`
+	MonitoredSyscalls  *ebpf.MapSpec `ebpf:"monitored_syscalls"`
+	PendingReturns     *ebpf.MapSpec `ebpf:"pending_returns"`
+	SyscallEvents      *ebpf.MapSpec `ebpf:"syscall_events"`
+}
+
+// syscallVariableSpecs contains global variables before they are loaded into the kernel.
+//
+// It can be passed ebpf.CollectionSpec.Assign.
+type syscallVariableSpecs struct {
+}
+
+// syscallObjects contains all objects after they have been loaded into the kernel.
+//
+// It can be passed to loadSyscallObjects or ebpf.CollectionSpec.LoadAndAssign.
+type syscallObjects struct {
+	syscallPrograms
+	syscallMaps
+	syscallVariables
+}
+
+func (o *syscallObjects) Close() error {
+	return _SyscallClose(
+		&o.syscallPrograms,
+		&o.syscallMaps,
+	)
+}
+
+// syscallMaps contains all maps after they have been loaded into the kernel.
+//
+// It can be passed to loadSyscallObjects or ebpf.CollectionSpec.LoadAndAssign.
+type syscallMaps struct {
+	MonitoredHostComms *ebpf.Map `ebpf:"monitored_host_comms"`
+	MonitoredSyscalls  *ebpf.Map `ebpf:"monitored_syscalls"`
+	PendingReturns     *ebpf.Map `ebpf:"pending_returns"`
+	SyscallEvents      *ebpf.Map `ebpf:"syscall_events"`
+}
+
+func (m *syscallMaps) Close() error {
+	return _SyscallClose(
+		m.MonitoredHostComms,
+		m.MonitoredSyscalls,
+		m.PendingReturns,
+		m.SyscallEvents,
+	)
+}
+
+// syscallVariables contains all global variables after they have been loaded into the kernel.
+//
+// It can be passed to loadSyscallObjects or ebpf.CollectionSpec.LoadAndAssign.
+type syscallVariables struct {
+}
+
+// syscallPrograms contains all programs after they have been loaded into the kernel.
+//
+// It can be passed to loadSyscallObjects or ebpf.CollectionSpec.LoadAndAssign.
+type syscallPrograms struct {
+	TraceSysEnter *ebpf.Program `ebpf:"trace_sys_enter"`
+	TraceSysExit  *ebpf.Program `ebpf:"trace_sys_exit"`
+}
+
+func (p *syscallPrograms) Close() error {
+	return _SyscallClose(
+		p.TraceSysEnter,
+		p.TraceSysExit,
+	)
+}
+
+func _SyscallClose(closers ...io.Closer) error {
+	for _, closer := range closers {
+		if err := closer.Close(); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// Do not access this directly.
+//
+//go:embed syscall_bpfeb.o
+var _SyscallBytes []byte