vivarium 0.1.1 → 0.2.0

data/sig/vivarium.rbs

@@ -5,11 +5,13 @@ module Vivarium
   end
 
   class Event < ::Struct
+    attr_accessor ktime_ns: Integer?
     attr_accessor pid: Integer?
     attr_accessor event_name: String?
     attr_accessor payload: String?
 
     def empty?: bool
+    def severity: () -> String
     def self.from_binary: (String raw) -> Event
   end
 
@@ -39,11 +41,37 @@ module Vivarium
 
   EVENT_NAME_SIZE: Integer
   EVENT_PAYLOAD_SIZE: Integer
+  EVENT_TS_SIZE: Integer
+  PROC_EXEC_SLOT_SIZE: Integer
+  PROC_EXEC_SLOT_COUNT: Integer
   EVENT_STRUCT_SIZE: Integer
+  EVENT_TS_OFFSET: Integer
+  EVENT_PID_OFFSET: Integer
+  EVENT_NAME_OFFSET: Integer
+  EVENT_PAYLOAD_OFFSET: Integer
   EVENT_CAPACITY: Integer
 
   def self.bpf_pin_dir: () -> String
   def self.bpf_pin_dir=: (String dir) -> String
+  def self.event_severity: (String event_name) -> String
+  def self.decode_dns_qname: (String raw_payload) -> String
+  def self.decode_sock_connect_payload: (String raw_payload) -> String
+  def self.decode_odd_socket_payload: (String raw_payload) -> String
+  def self.decode_bad_socket_payload: (String raw_payload) -> String
+  def self.decode_proc_exec_payload: (String raw_payload) -> String
+  def self.decode_ptrace_check_payload: (String raw_payload) -> String
+  def self.decode_sb_mount_payload: (String raw_payload) -> String
+  def self.decode_kernel_read_file_payload: (String raw_payload) -> String
+  def self.decode_task_kill_payload: (String raw_payload) -> String
+  def self.decode_setid_change_payload: (String raw_payload) -> String
+  def self.decode_capable_check_payload: (String raw_payload) -> String
+  def self.decode_bprm_creds_payload: (String raw_payload) -> String
+  def self.decode_file_symlink_payload: (String raw_payload) -> String
+  def self.decode_file_hardlink_payload: (String raw_payload) -> String
+  def self.decode_file_rename_payload: (String raw_payload) -> String
+  def self.decode_file_chmod_payload: (String raw_payload) -> String
+  def self.decode_file_getdents_payload: (String raw_payload) -> String
+  def self.render_event_payload: (Event event) -> String
   def self.observe: (?pin_dir: String pin_dir, ?logger: untyped logger, ?dest: untyped dest, ?format: Symbol format) { () -> untyped } -> untyped
   def self.top_observe: (?pin_dir: String pin_dir, ?logger: untyped logger, ?dest: untyped dest, ?format: Symbol format) -> ObservationSession
   def self.filter_internal_frames?: () -> bool

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: vivarium
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 0.2.0
 platform: ruby
 authors:
 - Uchio Kondo
@@ -15,14 +15,28 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.11.3
+        version: 0.11.4
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: 0.11.3
+        version: 0.11.4
+- !ruby/object:Gem::Dependency
+  name: ostruct
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
 description: Vivarium visualizes low-level events such as file open paths and relates
   them to Ruby method boundaries by combining RbBCC (eBPF LSM) and TracePoint.
 email:
@@ -34,6 +48,11 @@ extra_rdoc_files: []
 files:
 - README.md
 - Rakefile
+- examples/execve_demo.rb
+- examples/file_operation_demo.rb
+- examples/network_client_demo.rb
+- examples/privilege_event_demo.rb
+- examples/signal_kill_demo.rb
 - exe/vivariumd
 - lib/vivarium.rb
 - lib/vivarium/logger.rb