logging_types.h

Go to the documentation of this file.

// SPDX-License-Identifier: Apache-2.0
#ifndef LOGGING_TYPES_H_
#define LOGGING_TYPES_H_
// Bindgen throws a lot of include errors with vmlinux.h
// Therefore, type declarations are pulled from here into logging.h
 
#include "constants.h"
 
enum LogLevel {
    LOG_LEVEL_OFF   = 0,
    LOG_LEVEL_ERROR = 1,
    LOG_LEVEL_WARN  = 2,
    LOG_LEVEL_INFO  = 3,
    LOG_LEVEL_DEBUG = 4,
    LOG_LEVEL_TRACE = 5,
};
 
enum LogReason {
    LOG_REASON_UNKNOWN = 0,
    LOG_REASON_ALLOW,
    LOG_REASON_AUDIT,
    LOG_REASON_DENY,
    LOG_REASON_DEBUG,
    LOG_REASON_ERROR,
};
 
enum EventType {
    EVENT_TYPE_UNKNOWN = 0,
    EVENT_TYPE_MSG,
    EVENT_TYPE_UNIX_STREAM_CONNECT,
    EVENT_TYPE_SB_UMOUNT,
    EVENT_TYPE_BPF_MAP,
    EVENT_TYPE_TASK_KILL,
    EVENT_TYPE_KERNEL_MODULE_REQUEST,
    EVENT_TYPE_KERNEL_READ_FILE,
    EVENT_TYPE_KERNEL_LOAD_DATA,
    EVENT_TYPE_PTRACE_ACCESS_CHECK,
    EVENT_TYPE_BPF_WRITE_USER,
    EVENT_TYPE_TASK_ALLOC,
    EVENT_TYPE_FILE_ACCESS,
};
 
enum InodeAction {
    INODE_ACTION_UNKNOWN = 0,
    FILE_OPEN,
    INODE_PERMISSION,
    INODE_UNLINK,
    INODE_RMDIR,
    INODE_RENAME,
    INODE_SETATTR,
    INODE_SETXATTR,
};
 
struct log_hdr {
    unsigned char  level;
    unsigned char  reason;
    unsigned short type;
    unsigned long  pid;
    unsigned long  tid;
    unsigned long  uid;
    unsigned long  pol_id;
    unsigned char  comm[COMM_LEN];
};
 
struct generic_msg_log {
    struct log_hdr header;
    unsigned char  msg[MAX_STR_LEN];
};
 
struct sb_umount_log {
    struct log_hdr header;
    unsigned long  target_dev;
};
 
struct bpf_map_log {
    struct log_hdr header;
    unsigned char  name[MAX_STR_LEN];
    unsigned int   map_id;
};
 
struct task_kill_log {
    struct log_hdr header;
    unsigned char  target_comm[COMM_LEN];
    int            target_pid;
    int            signum;
};
 
struct kernel_module_request_log {
    struct log_hdr header;
    unsigned char  kmod_name[MODULE_NAME_LEN];
};
 
struct kernel_read_file_log {
    struct log_hdr header;
    unsigned int   id;
    unsigned char  filename[MAX_STR_LEN];
};
 
struct kernel_load_data_log {
    struct log_hdr header;
    unsigned int   id;
};
 
struct ptrace_access_check_log {
    struct log_hdr header;
    int            target_pid;
    unsigned int   mode;
    unsigned char  target_comm[COMM_LEN];
};
 
struct inode_access_log {
    struct log_hdr header;
    unsigned int   action;
    unsigned char  name[MAX_STR_LEN];
};
 
#endif // LOGGING_TYPES_H_