157 lines
4.2 KiB
Go
157 lines
4.2 KiB
Go
// Code generated by bpf2go; DO NOT EDIT.
|
|
//go:build 386 || amd64 || arm || arm64 || loong64 || mips64le || mipsle || ppc64le || riscv64 || wasm
|
|
|
|
package ebpfsource
|
|
|
|
import (
|
|
"bytes"
|
|
_ "embed"
|
|
"fmt"
|
|
"io"
|
|
|
|
"github.com/cilium/ebpf"
|
|
)
|
|
|
|
// Names of all BPF objects in the ELF.
|
|
//
|
|
// Used for safe lookups in a Collection or CollectionSpec.
|
|
const (
|
|
syscallMapMonitoredHostComms = "monitored_host_comms"
|
|
syscallMapMonitoredSyscalls = "monitored_syscalls"
|
|
syscallMapPendingReturns = "pending_returns"
|
|
syscallMapSyscallEvents = "syscall_events"
|
|
syscallProgTraceSysEnter = "trace_sys_enter"
|
|
syscallProgTraceSysExit = "trace_sys_exit"
|
|
)
|
|
|
|
// loadSyscall returns the embedded CollectionSpec for syscall.
|
|
func loadSyscall() (*ebpf.CollectionSpec, error) {
|
|
reader := bytes.NewReader(_SyscallBytes)
|
|
spec, err := ebpf.LoadCollectionSpecFromReader(reader)
|
|
if err != nil {
|
|
return nil, fmt.Errorf("can't load syscall: %w", err)
|
|
}
|
|
|
|
return spec, err
|
|
}
|
|
|
|
// loadSyscallObjects loads syscall and converts it into a struct.
|
|
//
|
|
// The following types are suitable as obj argument:
|
|
//
|
|
// *syscallObjects
|
|
// *syscallPrograms
|
|
// *syscallMaps
|
|
//
|
|
// See ebpf.CollectionSpec.LoadAndAssign documentation for details.
|
|
func loadSyscallObjects(obj any, opts *ebpf.CollectionOptions) error {
|
|
spec, err := loadSyscall()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
return spec.LoadAndAssign(obj, opts)
|
|
}
|
|
|
|
// syscallSpecs contains maps and programs before they are loaded into the kernel.
|
|
//
|
|
// It can be passed ebpf.CollectionSpec.Assign.
|
|
type syscallSpecs struct {
|
|
syscallProgramSpecs
|
|
syscallMapSpecs
|
|
syscallVariableSpecs
|
|
}
|
|
|
|
// syscallProgramSpecs contains programs before they are loaded into the kernel.
|
|
//
|
|
// It can be passed ebpf.CollectionSpec.Assign.
|
|
type syscallProgramSpecs struct {
|
|
TraceSysEnter *ebpf.ProgramSpec `ebpf:"trace_sys_enter"`
|
|
TraceSysExit *ebpf.ProgramSpec `ebpf:"trace_sys_exit"`
|
|
}
|
|
|
|
// syscallMapSpecs contains maps before they are loaded into the kernel.
|
|
//
|
|
// It can be passed ebpf.CollectionSpec.Assign.
|
|
type syscallMapSpecs struct {
|
|
MonitoredHostComms *ebpf.MapSpec `ebpf:"monitored_host_comms"`
|
|
MonitoredSyscalls *ebpf.MapSpec `ebpf:"monitored_syscalls"`
|
|
PendingReturns *ebpf.MapSpec `ebpf:"pending_returns"`
|
|
SyscallEvents *ebpf.MapSpec `ebpf:"syscall_events"`
|
|
}
|
|
|
|
// syscallVariableSpecs contains global variables before they are loaded into the kernel.
|
|
//
|
|
// It can be passed ebpf.CollectionSpec.Assign.
|
|
type syscallVariableSpecs struct {
|
|
}
|
|
|
|
// syscallObjects contains all objects after they have been loaded into the kernel.
|
|
//
|
|
// It can be passed to loadSyscallObjects or ebpf.CollectionSpec.LoadAndAssign.
|
|
type syscallObjects struct {
|
|
syscallPrograms
|
|
syscallMaps
|
|
syscallVariables
|
|
}
|
|
|
|
func (o *syscallObjects) Close() error {
|
|
return _SyscallClose(
|
|
&o.syscallPrograms,
|
|
&o.syscallMaps,
|
|
)
|
|
}
|
|
|
|
// syscallMaps contains all maps after they have been loaded into the kernel.
|
|
//
|
|
// It can be passed to loadSyscallObjects or ebpf.CollectionSpec.LoadAndAssign.
|
|
type syscallMaps struct {
|
|
MonitoredHostComms *ebpf.Map `ebpf:"monitored_host_comms"`
|
|
MonitoredSyscalls *ebpf.Map `ebpf:"monitored_syscalls"`
|
|
PendingReturns *ebpf.Map `ebpf:"pending_returns"`
|
|
SyscallEvents *ebpf.Map `ebpf:"syscall_events"`
|
|
}
|
|
|
|
func (m *syscallMaps) Close() error {
|
|
return _SyscallClose(
|
|
m.MonitoredHostComms,
|
|
m.MonitoredSyscalls,
|
|
m.PendingReturns,
|
|
m.SyscallEvents,
|
|
)
|
|
}
|
|
|
|
// syscallVariables contains all global variables after they have been loaded into the kernel.
|
|
//
|
|
// It can be passed to loadSyscallObjects or ebpf.CollectionSpec.LoadAndAssign.
|
|
type syscallVariables struct {
|
|
}
|
|
|
|
// syscallPrograms contains all programs after they have been loaded into the kernel.
|
|
//
|
|
// It can be passed to loadSyscallObjects or ebpf.CollectionSpec.LoadAndAssign.
|
|
type syscallPrograms struct {
|
|
TraceSysEnter *ebpf.Program `ebpf:"trace_sys_enter"`
|
|
TraceSysExit *ebpf.Program `ebpf:"trace_sys_exit"`
|
|
}
|
|
|
|
func (p *syscallPrograms) Close() error {
|
|
return _SyscallClose(
|
|
p.TraceSysEnter,
|
|
p.TraceSysExit,
|
|
)
|
|
}
|
|
|
|
func _SyscallClose(closers ...io.Closer) error {
|
|
for _, closer := range closers {
|
|
if err := closer.Close(); err != nil {
|
|
return err
|
|
}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// Do not access this directly.
|
|
//
|
|
//go:embed syscall_bpfel.o
|
|
var _SyscallBytes []byte
|