bytedance / vArmor

vArmor is a cloud native container sandbox system based on AppArmor/BPF/Seccomp. It also includes multiple built-in protection rules that are ready to use out of the box.
https://varmor.org
Apache License 2.0
298 stars 31 forks source link

[Feature] Integrate the violation auditing features of AppArmor and BPF enforcer #119

Closed Danny-Wei closed 3 weeks ago

Danny-Wei commented 1 month ago

Is your feature request related to a problem? Please describe. It would be better to integrate the violation auditing features of AppArmor and BPF enforcer. So that we can unify the audit log output for a better user experience.

Describe the solution you'd like Integrate AppArmor and BPF enforcer's violation auditing features into the auditor package and associate the container information as much as possible. Unify the audit event format and persist them in the log file.

Additional context Integration with the violation auditing and behavior modeling features should be considered during the design and development phase.