Documentation
¶
Overview ¶
Package proc provides tools for inspecting proc.
Index ¶
- Constants
- Variables
- func GetAppArmorProfile(pid int) string
- func GetCapabilities(pid int) (map[string][]string, error)
- func GetCmdline(pid int) []string
- func GetContainerID(tgid, pid int) string
- func GetCwd(pid int) string
- func GetEnviron(pid int) []string
- func GetNoNewPrivileges(pid int) bool
- func GetUIDGID(tgid, pid int) (uint32, uint32, error)
- func HasNamespace(ns string) (bool, error)
- func IsValidContainerRuntime(s string) bool
- type ContainerRuntime
- type SeccompMode
- type UserMapping
Constants ¶
const ( // RuntimeDocker is the string for the docker runtime. RuntimeDocker ContainerRuntime = "docker" // RuntimeRkt is the string for the rkt runtime. RuntimeRkt ContainerRuntime = "rkt" // RuntimeNspawn is the string for the systemd-nspawn runtime. RuntimeNspawn ContainerRuntime = "systemd-nspawn" // RuntimeLXC is the string for the lxc runtime. RuntimeLXC ContainerRuntime = "lxc" // RuntimeLXCLibvirt is the string for the lxc-libvirt runtime. RuntimeLXCLibvirt ContainerRuntime = "lxc-libvirt" // RuntimeOpenVZ is the string for the openvz runtime. RuntimeOpenVZ ContainerRuntime = "openvz" // RuntimeKubernetes is the string for the kubernetes runtime. RuntimeKubernetes ContainerRuntime = "kube" // RuntimeGarden is the string for the garden runtime. RuntimeGarden ContainerRuntime = "garden" // RuntimePodman is the string for the podman runtime. RuntimePodman ContainerRuntime = "podman" // RuntimeGVisor is the string for the gVisor (runsc) runtime. RuntimeGVisor ContainerRuntime = "gvisor" // RuntimeFirejail is the string for the firejail runtime. RuntimeFirejail ContainerRuntime = "firejail" // RuntimeWSL is the string for the Windows Subsystem for Linux runtime. RuntimeWSL ContainerRuntime = "wsl" // RuntimeNotFound is the string for when no container runtime is found. RuntimeNotFound ContainerRuntime = "not-found" // SeccompModeDisabled is equivalent to "0" in the /proc/{pid}/status file. SeccompModeDisabled SeccompMode = "disabled" // SeccompModeStrict is equivalent to "1" in the /proc/{pid}/status file. SeccompModeStrict SeccompMode = "strict" // SeccompModeFiltering is equivalent to "2" in the /proc/{pid}/status file. SeccompModeFiltering SeccompMode = "filtering" )
Variables ¶
var ( // ContainerRuntimes contains all the container runtimes. ContainerRuntimes = []ContainerRuntime{ RuntimeDocker, RuntimeRkt, RuntimeNspawn, RuntimeLXC, RuntimeLXCLibvirt, RuntimeOpenVZ, RuntimeKubernetes, RuntimeGarden, RuntimePodman, RuntimeGVisor, RuntimeFirejail, RuntimeWSL, } )
Functions ¶
func GetAppArmorProfile ¶
GetAppArmorProfile determines the AppArmor profile for a process. If pid is less than one, it returns the AppArmor profile for "self".
func GetCapabilities ¶
GetCapabilities returns the allowed capabilities for the process. If pid is less than one, it returns the capabilities for "self".
func GetCmdline ¶
GetCmdline returns the cmdline for a process. If pid is less than one, it returns the cmdline for "self".
func GetContainerID ¶
GetContainerID returns the container ID for a process if it's running in a container. If pid is less than one, it returns the container ID for "self".
func GetCwd ¶
GetCwd returns the current working directory for the process. If pid is less than one, it returns the current working directory for "self".
func GetEnviron ¶
GetEnviron returns the environ for a process. If pid is less than one, it returns the environ for "self".
func GetNoNewPrivileges ¶
GetNoNewPrivileges returns if no_new_privileges is set for a process. If pid is less than one, it returns if set for "self".
func GetUIDGID ¶
GetUIDGID returns the uid and gid for a process. If pid is less than one, it returns the seccomp enforcing mode for "self".
func HasNamespace ¶
HasNamespace determines if a container is using a particular namespace or the host namespace. The device number of an unnamespaced /proc/1/ns/{ns} is 4 and anything else is higher. Only works from inside a container.
func IsValidContainerRuntime ¶
IsValidContainerRuntime checks if a string is a valid container runtime.
Types ¶
type ContainerRuntime ¶
type ContainerRuntime string
ContainerRuntime is the type for the various container runtime strings.
func GetContainerRuntime ¶
func GetContainerRuntime(tgid, pid int) ContainerRuntime
GetContainerRuntime returns the container runtime the process is running in. If pid is less than one, it returns the runtime for "self".
type SeccompMode ¶
type SeccompMode string
SeccompMode is the type for the various seccomp mode strings.
func GetSeccompEnforcingMode ¶
func GetSeccompEnforcingMode(pid int) SeccompMode
GetSeccompEnforcingMode returns the seccomp enforcing level (disabled, filtering, strict) for a process. If pid is less than one, it returns the seccomp enforcing mode for "self".
type UserMapping ¶
UserMapping holds the values for a {uid,gid}_map.
func GetUserNamespaceInfo ¶
func GetUserNamespaceInfo(pid int) (bool, []UserMapping)
GetUserNamespaceInfo determines if the process is running in a UserNamespace and returns the mappings if true. If pid is less than one, it returns the user namespace info for "self".
Source Files