Skip to content

Addl docker container info #655

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 4 commits into from
Sep 12, 2016
Merged

Addl docker container info #655

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a78e1da
Whitespace changes.
mstemm Sep 3, 2016
3f726f9
Change glob matching to allow path separators.
mstemm Sep 8, 2016
209888d
Add ability to detect/show privileged status.
mstemm Sep 8, 2016
593dd0b
Add ability to display container mount info.
mstemm Sep 8, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Add ability to detect/show privileged status. 
In sinsp_container_manager::parse_docker(), parse the Privileged field
out of the json output and use it to set the instance variable
m_privileged.

Modify container_to_json/parse_container_json_evt to dump/read the
privileged status from .scap files.

New filtercheck container.privileged returns the privileged status
as a boolean.

Although other container types support the notion of privileged, I only
support this filtercheck for docker containers. For non-docker
containers, container.privileged returns NULL.

Write privileged to/from scap files.
  • Loading branch information
@mstemm
mstemm committed Sep 9, 2016
commit 209888d7f37c4357b164ca12248a38bac9de2e4b
7 changes: 7 additions & 0 deletions userspace/libsinsp/container.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -407,6 +407,8 @@ string sinsp_container_manager::container_to_json(const sinsp_container_info& co
container["type"] = container_info.m_type;
container["name"] = container_info.m_name;
container["image"] = container_info.m_image;
container["privileged"] = container_info.m_privileged;


char addrbuff[100];
uint32_t iph = ntohl(container_info.m_container_ip);
Expand Down Expand Up @@ -609,6 +611,11 @@ bool sinsp_container_manager::parse_docker(sinsp_container_info* container)
{
container->m_cpu_period = cpu_period;
}
const Json::Value &privileged = host_config_obj["Privileged"];
if(!privileged.isNull() && privileged.isBool())
{
container->m_privileged = privileged.asBool();
}
return true;
}

Expand Down
1 change: 1 addition & 0 deletions userspace/libsinsp/container.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ class sinsp_container_info
string m_name;
string m_image;
uint32_t m_container_ip;
bool m_privileged;
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are there cases where this member remains uninitialized and the user can read a spurious value?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

For non-docker containers, the filtercheck always returns NULL. For docker containers, m_privileged should be set while parsing the results of the GET /containers/XXX/json response.I think the result always has a Privileged field.

Regardless, I should initialize it to false just to make sure. I've got that fix in #658.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I was more thinking of a case where you read an old trace file that contains a Docker json blob without the privileged flag and the customer maybe runs sysdig or falco and gets spurious privileged values on that trace, just wanted to make sure that was covered.

vector<container_port_mapping> m_port_mappings;
map<string, string> m_labels;
string m_mesos_task_id;
Expand Down
30 changes: 29 additions & 1 deletion userspace/libsinsp/filterchecks.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5323,7 +5323,8 @@ const filtercheck_field_info sinsp_filter_check_container_fields[] =
{PT_CHARBUF, EPF_NONE, PF_NA, "container.id", "the container id."},
{PT_CHARBUF, EPF_NONE, PF_NA, "container.name", "the container name."},
{PT_CHARBUF, EPF_NONE, PF_NA, "container.image", "the container image."},
{PT_CHARBUF, EPF_NONE, PF_NA, "container.type", "the container type, eg: docker or rkt"}
{PT_CHARBUF, EPF_NONE, PF_NA, "container.type", "the container type, eg: docker or rkt"},
{PT_BOOL, EPF_NONE, PF_NA, "container.privileged", "true for containers running as privileged, false otherwise"}
};

sinsp_filter_check_container::sinsp_filter_check_container()
Expand Down Expand Up @@ -5446,6 +5447,33 @@ uint8_t* sinsp_filter_check_container::extract(sinsp_evt *evt, OUT uint32_t* len
}
*len = m_tstr.size();
return (uint8_t*)m_tstr.c_str();
case TYPE_CONTAINER_PRIVILEGED:
if(tinfo->m_container_id.empty())
{
return NULL;
}
else
{
sinsp_container_info container_info;
bool found = m_inspector->m_container_manager.get_container(tinfo->m_container_id, &container_info);
if(!found)
{
return NULL;
}

// Only return a true/false value for
// container types where we really know the
// privileged status.
if (container_info.m_type != sinsp_container_type::CT_DOCKER)
{
return NULL;
}

m_u32val = (container_info.m_privileged ? 1 : 0);
}

return (uint8_t*)&m_u32val;
break;
default:
ASSERT(false);
break;
Expand Down
4 changes: 3 additions & 1 deletion userspace/libsinsp/filterchecks.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -767,7 +767,8 @@ class sinsp_filter_check_container : public sinsp_filter_check
TYPE_CONTAINER_ID = 0,
TYPE_CONTAINER_NAME,
TYPE_CONTAINER_IMAGE,
TYPE_CONTAINER_TYPE
TYPE_CONTAINER_TYPE,
TYPE_CONTAINER_PRIVILEGED
};

sinsp_filter_check_container();
Expand All @@ -776,6 +777,7 @@ class sinsp_filter_check_container : public sinsp_filter_check

private:
string m_tstr;
uint32_t m_u32val;
};

//
Expand Down
5 changes: 5 additions & 0 deletions userspace/libsinsp/parsers.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3948,6 +3948,11 @@ void sinsp_parser::parse_container_json_evt(sinsp_evt *evt)
{
container_info.m_image = image.asString();
}
const Json::Value& privileged = container["privileged"];
if(!privileged.isNull() && privileged.isConvertibleTo(Json::booleanValue))
{
container_info.m_privileged = privileged.asBool();
}
const Json::Value& contip = container["ip"];
if(!contip.isNull() && contip.isConvertibleTo(Json::stringValue))
{
Expand Down