[CWS] add a container context on custom events

pkg/security/events/custom.go

@@ -10,6 +10,7 @@ import (
 	"time"
 
 	"github.com/DataDog/datadog-agent/pkg/security/secl/compiler/eval"
+	"github.com/DataDog/datadog-agent/pkg/security/secl/containerutils"
 	"github.com/DataDog/datadog-agent/pkg/security/secl/model"
 	"github.com/DataDog/datadog-agent/pkg/security/secl/rules"
 )
@@ -68,16 +69,24 @@ const (
 	InternalCoreDumpRuleDesc = "Internal Core Dump"
 )
 
+// AgentContainerContext is like model.ContainerContext, but without event based resolvers
+type AgentContainerContext struct {
+	ContainerID containerutils.ContainerID `json:"id,omitempty"`
+	CreatedAt   uint64                     `json:"created_at"`
+}
+
 // CustomEventCommonFields represents the fields common to all custom events
 type CustomEventCommonFields struct {
-	Timestamp time.Time `json:"date"`
-	Service   string    `json:"service"`
+	Timestamp             time.Time              `json:"date"`
+	Service               string                 `json:"service"`
+	AgentContainerContext *AgentContainerContext `json:"container"`
 }
 
 // FillCustomEventCommonFields fills the common fields with default values
-func (commonFields *CustomEventCommonFields) FillCustomEventCommonFields() {
+func (commonFields *CustomEventCommonFields) FillCustomEventCommonFields(acc *AgentContainerContext) {
 	commonFields.Service = ServiceName
 	commonFields.Timestamp = time.Now()
+	commonFields.AgentContainerContext = acc
 }
 
 // NewCustomRule returns a new custom rule

pkg/security/module/cws.go

@@ -256,7 +256,7 @@ func (c *CWSConsumer) reportSelfTest(success []eval.RuleID, fails []eval.RuleID,
 	}
 
 	// send the custom event with the list of succeed and failed self tests
-	rule, event := selftests.NewSelfTestEvent(success, fails, testEvents)
+	rule, event := selftests.NewSelfTestEvent(c.probe.GetAgentContainerContext(), success, fails, testEvents)
 	c.SendEvent(rule, event, nil, "")
 }
 

pkg/security/probe/custom_events.go

@@ -35,12 +35,12 @@ func (e EventLostRead) ToJSON() ([]byte, error) {
 }
 
 // NewEventLostReadEvent returns the rule and a populated custom event for a lost_events_read event
-func NewEventLostReadEvent(mapName string, lost float64) (*rules.Rule, *events.CustomEvent) {
+func NewEventLostReadEvent(acc *events.AgentContainerContext, mapName string, lost float64) (*rules.Rule, *events.CustomEvent) {
 	evt := EventLostRead{
 		Name: mapName,
 		Lost: lost,
 	}
-	evt.FillCustomEventCommonFields()
+	evt.FillCustomEventCommonFields(acc)
 
 	return events.NewCustomRule(events.LostEventsRuleID, events.LostEventsRuleDesc), events.NewCustomEvent(model.CustomLostReadEventType, evt)
 }
@@ -59,12 +59,12 @@ func (e EventLostWrite) ToJSON() ([]byte, error) {
 }
 
 // NewEventLostWriteEvent returns the rule and a populated custom event for a lost_events_write event
-func NewEventLostWriteEvent(mapName string, perEventPerCPU map[string]uint64) (*rules.Rule, *events.CustomEvent) {
+func NewEventLostWriteEvent(acc *events.AgentContainerContext, mapName string, perEventPerCPU map[string]uint64) (*rules.Rule, *events.CustomEvent) {
 	evt := EventLostWrite{
 		Name: mapName,
 		Lost: perEventPerCPU,
 	}
-	evt.FillCustomEventCommonFields()
+	evt.FillCustomEventCommonFields(acc)
 
 	return events.NewCustomRule(events.LostEventsRuleID, events.LostEventsRuleDesc), events.NewCustomEvent(model.CustomLostWriteEventType, evt)
 }
@@ -92,13 +92,13 @@ func (a AbnormalEvent) ToJSON() ([]byte, error) {
 }
 
 // NewAbnormalEvent returns the rule and a populated custom event for a abnormal event
-func NewAbnormalEvent(id string, description string, event *model.Event, err error) (*rules.Rule, *events.CustomEvent) {
+func NewAbnormalEvent(acc *events.AgentContainerContext, id string, description string, event *model.Event, err error) (*rules.Rule, *events.CustomEvent) {
 	marshalerCtor := func() events.EventMarshaler {
 		evt := AbnormalEvent{
 			Event: serializers.NewEventSerializer(event, nil),
 			Error: err.Error(),
 		}
-		evt.FillCustomEventCommonFields()
+		evt.FillCustomEventCommonFields(acc)
 		// Overwrite common timestamp with event timestamp
 		evt.Timestamp = event.ResolveEventTime()
 
@@ -119,7 +119,7 @@ type EBPFLessHelloMsgEvent struct {
 		Name           string `json:"name,omitempty"`
 		ImageShortName string `json:"short_name,omitempty"`
 		ImageTag       string `json:"image_tag,omitempty"`
-	} `json:"container,omitempty"`
+	} `json:"workload_container,omitempty"`
 	EntrypointArgs []string `json:"args,omitempty"`
 }
 
@@ -129,7 +129,7 @@ func (e EBPFLessHelloMsgEvent) ToJSON() ([]byte, error) {
 }
 
 // NewEBPFLessHelloMsgEvent returns a eBPFLess hello custom event
-func NewEBPFLessHelloMsgEvent(msg *ebpfless.HelloMsg, scrubber *procutil.DataScrubber) (*rules.Rule, *events.CustomEvent) {
+func NewEBPFLessHelloMsgEvent(acc *events.AgentContainerContext, msg *ebpfless.HelloMsg, scrubber *procutil.DataScrubber) (*rules.Rule, *events.CustomEvent) {
 	args := msg.EntrypointArgs
 	if scrubber != nil {
 		args, _ = scrubber.ScrubCommand(msg.EntrypointArgs)
@@ -144,7 +144,7 @@ func NewEBPFLessHelloMsgEvent(msg *ebpfless.HelloMsg, scrubber *procutil.DataScr
 	evt.Container.ImageTag = msg.ContainerContext.ImageTag
 	evt.EntrypointArgs = args
 
-	evt.FillCustomEventCommonFields()
+	evt.FillCustomEventCommonFields(acc)
 
 	return events.NewCustomRule(events.EBPFLessHelloMessageRuleID, events.EBPFLessHelloMessageRuleDesc), events.NewCustomEvent(model.UnknownEventType, evt)
 }

pkg/security/probe/probe.go

@@ -94,7 +94,8 @@ type actionStatsTags struct {
 // Probe represents the runtime security eBPF probe in charge of
 // setting up the required kProbes and decoding events sent from the kernel
 type Probe struct {
-	PlatformProbe PlatformProbe
+	PlatformProbe         PlatformProbe
+	agentContainerContext *events.AgentContainerContext
 
 	// Constants and configuration
 	Opts         Opts
@@ -441,3 +442,8 @@ func (p *Probe) IsSecurityProfileEnabled() bool {
 func (p *Probe) EnableEnforcement(state bool) {
 	p.PlatformProbe.EnableEnforcement(state)
 }
+
+// GetAgentContainerContext returns the agent container context
+func (p *Probe) GetAgentContainerContext() *events.AgentContainerContext {
+	return p.agentContainerContext
+}

pkg/security/probe/probe_ebpf.go

@@ -583,7 +583,7 @@ func (p *EBPFProbe) unmarshalProcessCacheEntry(ev *model.Event, data []byte) (in
 func (p *EBPFProbe) onEventLost(perfMapName string, perEvent map[string]uint64) {
 	if p.config.RuntimeSecurity.InternalMonitoringEnabled {
 		p.probe.DispatchCustomEvent(
-			NewEventLostWriteEvent(perfMapName, perEvent),
+			NewEventLostWriteEvent(p.GetAgentContainerContext(), perfMapName, perEvent),
 		)
 	}
 
@@ -2379,6 +2379,11 @@ func (p *EBPFProbe) HandleActions(ctx *eval.Context, rule *rules.Rule) {
 	}
 }
 
+// GetAgentContainerContext returns the agent container context
+func (p *EBPFProbe) GetAgentContainerContext() *events.AgentContainerContext {
+	return p.probe.GetAgentContainerContext()
+}
+
 // newPlaceholderProcessCacheEntryPTraceMe returns a new empty process cache entry for PTRACE_TRACEME calls,
 // it's similar to model.NewPlaceholderProcessCacheEntry with pid = tid = 0, and isKworker = false
 var newPlaceholderProcessCacheEntryPTraceMe = sync.OnceValue(func() *model.ProcessCacheEntry {