1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
|
{ lib
, buildGoModule
, fetchFromGitHub
, clang
, pkg-config
, zlib
, elfutils
, libbpf
, nixosTests
, testers
, tracee
, makeWrapper
}:
buildGoModule rec {
pname = "tracee";
version = "0.20.0";
src = fetchFromGitHub {
owner = "aquasecurity";
repo = pname;
# project has branches and tags of the same name
rev = "refs/tags/v${version}";
hash = "sha256-OnOayDxisvDd802kDKGctaQc5LyoyFfdfvC+2JpRjHY=";
};
vendorHash = "sha256-26sAKTJQ7Rf5KRlu7j5XiZVr6CkAC6fm60Pam7KH0uA=";
patches = [
./use-our-libbpf.patch
# can not vendor dependencies with old pyroscope
# remove once https://github.com/aquasecurity/tracee/pull/3927
# makes it to a release
./update-pyroscope.patch
];
enableParallelBuilding = true;
# needed to build bpf libs
hardeningDisable = [ "stackprotector" ];
nativeBuildInputs = [ pkg-config clang ];
buildInputs = [ elfutils libbpf zlib ];
makeFlags = [
"VERSION=v${version}"
"GO_DEBUG_FLAG=-s -w"
# don't actually need git but the Makefile checks for it
"CMD_GIT=echo"
];
buildPhase = ''
runHook preBuild
mkdir -p ./dist
make $makeFlags ''${enableParallelBuilding:+-j$NIX_BUILD_CORES} bpf all
runHook postBuild
'';
# tests require a separate go module
# integration tests are ran within a nixos vm
# see passthru.tests.integration
doCheck = false;
outputs = [ "out" "lib" "share" ];
installPhase = ''
runHook preInstall
mkdir -p $out/bin $lib/lib/tracee $share/share/tracee
mv ./dist/{tracee,signatures} $out/bin/
mv ./dist/tracee.bpf.o $lib/lib/tracee/
mv ./cmd/tracee-rules/templates $share/share/tracee/
runHook postInstall
'';
passthru.tests = {
integration = nixosTests.tracee;
integration-test-cli = import ./integration-tests.nix { inherit lib tracee makeWrapper; };
version = testers.testVersion {
package = tracee;
version = "v${version}";
command = "tracee version";
};
};
meta = with lib; {
homepage = "https://aquasecurity.github.io/tracee/latest/";
changelog = "https://github.com/aquasecurity/tracee/releases/tag/v${version}";
description = "Linux Runtime Security and Forensics using eBPF";
mainProgram = "tracee";
longDescription = ''
Tracee is a Runtime Security and forensics tool for Linux. It is using
Linux eBPF technology to trace your system and applications at runtime,
and analyze collected events to detect suspicious behavioral patterns. It
is delivered as a Docker image that monitors the OS and detects suspicious
behavior based on a pre-defined set of behavioral patterns.
'';
license = with licenses; [
# general license
asl20
# pkg/ebpf/c/*
gpl2Plus
];
maintainers = with maintainers; [ jk ];
platforms = [ "x86_64-linux" "aarch64-linux" ];
outputsToInstall = [ "out" "share" ];
};
}
|
