eventmonitor.go

// Unless explicitly stated otherwise all files in this repository are licensed
// under the Apache License Version 2.0.
// This product includes software developed at Datadog (https://www.datadoghq.com/).
// Copyright 2016-present Datadog, Inc.

//go:build linux || windows

package modules

import (
	"context"
	"errors"
	"fmt"

	pkgconfigsetup "github.com/DataDog/datadog-agent/pkg/config/setup"
	"github.com/DataDog/datadog-agent/pkg/eventmonitor"
	emconfig "github.com/DataDog/datadog-agent/pkg/eventmonitor/config"
	gpuconfig "github.com/DataDog/datadog-agent/pkg/gpu/config"
	netconfig "github.com/DataDog/datadog-agent/pkg/network/config"
	"github.com/DataDog/datadog-agent/pkg/network/events"
	"github.com/DataDog/datadog-agent/pkg/network/sender"
	secconfig "github.com/DataDog/datadog-agent/pkg/security/config"
	secmodule "github.com/DataDog/datadog-agent/pkg/security/module"
	"github.com/DataDog/datadog-agent/pkg/system-probe/api/module"
	"github.com/DataDog/datadog-agent/pkg/system-probe/config"
	sysconfigtypes "github.com/DataDog/datadog-agent/pkg/system-probe/config/types"
	"github.com/DataDog/datadog-agent/pkg/util/fargate"
	"github.com/DataDog/datadog-agent/pkg/util/log"
)

func createEventMonitorModule(_ *sysconfigtypes.Config, deps module.FactoryDependencies) (module.Module, error) {
	emconfig := emconfig.NewConfig()

	secconfig, err := secconfig.NewConfig()
	if err != nil {
		log.Errorf("invalid probe configuration: %v", err)
		return nil, module.ErrNotEnabled
	}

	opts := eventmonitor.Opts{}
	opts.StatsdClient = deps.Statsd
	opts.ProbeOpts.EnvsVarResolutionEnabled = emconfig.EnvVarsResolutionEnabled
	opts.ProbeOpts.Tagger = deps.Tagger
	opts.ProbeOpts.WorkloadMeta = deps.WMeta
	opts.ProbeOpts.FilterStore = deps.FilterStore
	secmoduleOpts := secmodule.Opts{}

	secmodule.UpdateEventMonitorOpts(&opts, secconfig)

	hostname, err := deps.Hostname.Get(context.Background())
	if err != nil {
		return nil, fmt.Errorf("failed to get hostname: %w", err)
	}

	// there is no hostname on Fargate instance
	if !fargate.IsSidecar() && hostname == "" {
		return nil, errors.New("hostname from core agent is empty")
	}

	evm, err := eventmonitor.NewEventMonitor(emconfig, secconfig, hostname, opts)
	if err != nil {
		log.Errorf("error initializing event monitoring module: %v", err)
		return nil, module.ErrNotEnabled
	}

	cwsEnabled := secconfig.RuntimeSecurity.IsRuntimeEnabled()
	runtimeUsageEnabled := pkgconfigsetup.Datadog().GetBool("sbom.enrichment.usage.enabled")

	if cwsEnabled || runtimeUsageEnabled {
		stopChan := make(chan struct{})

		cmdServer, err := secmodule.NewCommandServer(secconfig.RuntimeSecurity)
		if err != nil {
			return nil, err
		}

		if cwsEnabled {
			cws, err := secmodule.NewCWSConsumer(cmdServer, evm, secconfig.RuntimeSecurity, deps.WMeta, deps.FilterStore, secmoduleOpts, deps.Compression, deps.Ipc, hostname, deps.Secrets)
			if err != nil {
				return nil, err
			}
			evm.RegisterEventConsumer(cws)
			evm.SetCWSStatusProvider(cws)
			log.Info("event monitoring cws consumer initialized")
		}

		if runtimeUsageEnabled {
			usage, err := secmodule.NewUsageConsumer(cmdServer, evm, secconfig.RuntimeSecurity, stopChan)
			if err != nil {
				return nil, err
			}
			evm.RegisterEventConsumer(usage)
			log.Info("event monitoring usage consumer initialized")
		}
	}

	ncfg := netconfig.New()
	// only add the network consumer if the pkg/network/events
	// module was initialized by the network tracer module
	// (this will happen only if the network consumer is enabled
	// in config and the network tracer module is loaded successfully)
	if module.IsLoaded(config.NetworkTracerModule) {
		if events.Initialized() {
			network, err := events.NewNetworkConsumer(evm)
			if err != nil {
				return nil, err
			}
			evm.RegisterEventConsumer(network)
			log.Info("event monitoring network consumer initialized")

			if ncfg.DirectSend {
				ds, err := sender.NewDirectSenderConsumer(evm, deps.Log, deps.SysprobeConfig)
				if err != nil {
					return nil, err
				}
				if ds != nil {
					evm.RegisterEventConsumer(ds)
					log.Info("event monitoring direct sender consumer initialized")
				}
			}
		} else if ncfg.DirectSend {
			err := sender.NewDirectSenderPoller(deps.Log, deps.SysprobeConfig)
			if err != nil {
				return nil, err
			}
		}
	}

	if ncfg.EnableUSMEventStream {
		if err := createProcessMonitorConsumer(evm, ncfg); err != nil {
			return nil, err
		}
	}

	gpucfg := gpuconfig.New()
	// Only the eBPF probes consume these events, so skip the consumer entirely
	// when they are disabled. Kept in sync with the module gate in
	// pkg/system-probe/config, which does not enable the event monitor for GPU
	// monitoring unless the probes are enabled too.
	if gpucfg.Enabled && gpucfg.EnableEBPFProbes {
		err := createGPUProcessEventConsumer(evm)
		if err != nil {
			return nil, fmt.Errorf("cannot create event consumer for GPU: %w", err)
		}
	}

	return evm, err
}