Skip to content

KubeArmor eBPF Go library based on Linux libbpf API

License

Notifications You must be signed in to change notification settings

geyslan/kubearmor-libbpf

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

71 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

libbpf

KubeArmor bpf library

One will only be able to go get and to use this go module (library) setting the CGO_LDFLAGS environment variable, since this is based on the aqua security libbpfgo that is a cgo wrapper of the C libbpf.

So be aware that using this library in your go code turns it into cgo code.


General Dependencies

Ubuntu

linux-tools-generic

libelf-dev

zlib1g-dev

clang


Using this library

One way is to use the shared library libbpf.so if it is already installed.

❯ CGO_LDFLAGS="/usr/lib/libbpf.so" go get github.com/kubearmor/libbpf

However, currently, the most common is to use the libbpf.a (static version). To do so, follow the steps below.

  • Clone this repository.

    ❯ git clone github.com/kubearmor/libbpf

  • Inside the repository folder, run make to download the C libbpf code and compile it.

    ❯ make

    This will generate the static libbpf.a file and the vmlinux.h and bpf/*.h headers inside ./include.

  • Now one is able to make correct use of this library. Be sure to use absolute paths.

    ❯ CGO_LDFLAGS="/path_to_this_repo/include/libbpf.a" CGO_CFLAGS="-I /path_to_this_repo/include" go get github.com/kubearmor/libbpf

The same environment variable need to be set when building the final application that uses this library.

❯ CGO_LDFLAGS="/path_to_this_repo/include/libbpf.a" CGO_CFLAGS="-I /path_to_this_repo/include" go build

Testing it

The use cases inside tests can be tested using make.

❯ make run-tests


KABPFMapElement interface

To satisfy KABPFMapElement interface, it's necessary to implement the following methods for an XXMapElem.

func (pme *XXMapElem) KeyPointer() unsafe.Pointer {
	...
}

func (pme *XXMapElem) ValuePointer() unsafe.Pointer {
	...
}

func (pme *XXMapElem) SetFoundValue(value []byte) {
	...
}

func (pme *XXMapElem) MapName() string {
	return "map_name"
}

Examples can also be found in tests.

About

KubeArmor eBPF Go library based on Linux libbpf API

Topics

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Go 80.7%
  • Makefile 16.4%
  • C 2.9%