Title
#ebpf
a

alessandrogario

08/17/2022, 10:51 AM
/**
 * Copyright (c) 2014-present, The osquery authors
 *
 * This source code is licensed as defined by the LICENSE file found in the
 * root directory of this source tree.
 *
 * SPDX-License-Identifier: (Apache-2.0 OR GPL-2.0-only)
 */

#include <string_view>
#include <vector>

#include <osquery/logger/logger.h>

#include <sqlite3.h>

namespace osquery {

namespace {

const std::vector<std::string> kPrefixList{
    "libpod-conmon-",
    "libpod-",
    "docker-",
};

const std::string kSeparatorList{"./"};

void cgroupContainerName(sqlite3_context* context,
                         int argc,
                         sqlite3_value** argv) {
  auto buffer_ptr = reinterpret_cast<const char*>(sqlite3_value_text(argv[0]));
  if (buffer_ptr == nullptr) {
    sqlite3_result_null(context);
    return;
  }

  auto buffer_size = std::strlen(buffer_ptr);
  std::string_view cgroup_path(buffer_ptr, buffer_size);

  for (const auto& prefix : kPrefixList) {
    auto start_index = cgroup_path.find(prefix);
    if (start_index == std::string::npos) {
      continue;
    }

    start_index += prefix.size();

    auto end_index = cgroup_path.find_first_of(kSeparatorList, start_index);
    auto substr_size = (end_index != std::string::npos)
                           ? end_index - start_index
                           : std::string::npos;

    auto container_name = cgroup_path.substr(start_index, substr_size);

    sqlite3_result_text(context,
                        container_name.data(),
                        container_name.size(),
                        SQLITE_TRANSIENT);
    return;
  }

  sqlite3_result_null(context);
}

} // namespace

void registerCgroupUtilsExtensions(sqlite3* db) {
  sqlite3_create_function(db,
                          "cgroup_container_name",
                          -1,
                          SQLITE_UTF8 | SQLITE_DETERMINISTIC,
                          nullptr,
                          cgroupContainerName,
                          nullptr,
                          nullptr);
}
} // namespace osquery