- name: c-osquery
- description: a security monitoring agent. It is a customization/re-packaging of osquery ( https[:]//github[.]com/osquery/osquery ), which is thoroughly documented, and all customizations are documented at the “upstream” link below.
- snapcraft: https://github.com/canonical/c-osquery/blob/build/overlay/snap/snapcraft.yaml
- upstream: https://github.com/canonical/c-osquery
- upstream-relation: codeowner
- supported-category: not documented on the official list (https[:]//snapcraft[.]io/docs/reference/administration/reviewing-classic-confinement-snaps/#supported)
- reasoning: Security agents need to perform kernel-based runtime monitoring (e.g., gather info on process execution, network connections, etc.). The two primary options are the audit interface or eBPF. We have thoroughly tested both options and the audit interface has severe system performance impacts when gathering the telemetry we require. eBPF can gather the telemetry within acceptable performance constraints. Our requirement to load eBPF requires us to be classic/unconfined
I understand that strict confinement is generally preferred over classic.
I’ve tried the existing interfaces to make the snap to work under strict confinement.
Note that snappy-debug can be used to identify possible required interfaces. See https[:]//snapcraft[.]io/docs/debug-snaps for more information.
Note: I’ve intentionally broken several links because the forum limits my post to two links.
