Struct Recording 

pub struct Recording {
    pub program: PathBuf,
    pub directory: PathBuf,
    pub seccomp: bool,
    /* private fields */
}

An external syscall recorder wrapping each command, with separate trace files.

Fields

program: PathBuf

The recorder’s program: strace, or qk itself, whose helper loads the eBPF recorder.

directory: PathBuf

seccomp: bool

Whether strace filters the traced calls in the kernel, with seccomp, so untraced calls run at full speed. strace 5.3 and later can.

Implementations

impl Recording

pub fn probe(directory: &Path) -> Result<Probed>

The recorder QK_RECORDER picks: by default eBPF, where its helper can load it, else strace on PATH, checked to record child processes, with seccomp filtering where it supports it. Its trial traces go in directory. Err: QK_RECORDER misnamed, or the recorder it names cannot record.

pub fn required(directory: &Path) -> Result<Self>

The recorder Self::probe picks, for what cannot go on without one: the sandbox’s audit, input analysis.

pub fn backend(&self) -> &'static str

The recorder’s name, as reports give it: ebpf or strace.

pub fn in_directory(&self, directory: PathBuf) -> Self

The same settings, with traces in directory.

pub fn resolving(self) -> Self

The same, recording an opened file’s path with what its links lead to, as a report of what a task read shows it. strace always does.

pub fn keying(self) -> Self

The same, keying the task’s result: see Self::keys.

pub fn keys(&self) -> bool

Whether it may key the task’s result for qk:ultracache, as --record gives it. A recording made only to audit the task does not.

pub fn settle(&self) -> Result<()>

Ends the recordings of the commands that have run, once they have finished, so that their traces are whole. strace’s are as soon as it exits; the eBPF recorder’s once its helper has sent every event.

pub fn accesses( &self, cwd: &Path, limits: &Limits<'_>, ) -> Result<(Vec<Access>, Vec<String>)>

What the commands that have run did, settled, within limits, with what kept it from being complete; their paths relative to cwd, where they started.

pub fn whole_accesses( &self, cwd: &Path, limits: &Limits<'_>, ) -> Result<Vec<Access>, String>

The same, whole: what kept it from being complete, the first issue, is the error.

pub fn command(&self, index: usize, text: &str, cwd: &Path) -> Command

The same invocation is used by preflight and actual task commands, which start in cwd.

Trait Implementations

impl Clone for Recording

fn clone(&self) -> Self

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Recording

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.