add traceectl to tracee

cmd/traceectl/Makefile

@@ -0,0 +1,49 @@
+
+BINARY_NAME ?= traceectl
+DIST_DIR ?= dist
+VERSION ?= $(shell git describe --tags --always --dirty)
+LDFLAGS = -ldflags "-X main.version=$(VERSION)"
+
+
+.PHONY: all 
+all: build 
+
+.PHONY: build
+build:
+	mkdir -p $(DIST_DIR)
+
+	go build \
+		$(LDFLAGS) \
+		-o $(DIST_DIR)/$(BINARY_NAME) \
+		main.go 
+
+	@echo "Built $(BINARY_NAME)-$(GOOS)-$(GOARCH) in $(DIST_DIR)"
+
+.PHONY: test
+test:
+	go test \
+	-v \
+	-cover \
+	-race \
+	./...
+
+
+.PHONY: clean
+clean:
+	rm -rf $(DIST_DIR)
+
+.PHONY: help
+help:
+	@echo "Available targets:"
+	@echo ""
+	@echo "  all: Builds the traceectl binary (default)."
+	@echo "  build: Builds the traceectl binary."
+	@echo "  test: Runs unit tests with coverage and race detection."
+	@echo "  clean: Removes the build artifacts and the dist directory."
+	@echo "  help: Displays this help message."
+	@echo ""
+	@echo "Variables:"
+	@echo ""
+	@echo "  BINARY_NAME: Name of the binary (default: traceectl)."
+	@echo "  DIST_DIR: Directory for build artifacts (default: dist)."
+	@echo "  VERSION: Version string (default: git describe --tags --always --dirty)."

cmd/traceectl/cmd/event.go

@@ -0,0 +1,139 @@
+package cmd
+
+import (
+	"os"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
+	"github.com/aquasecurity/tracee/cmd/traceectl/pkg/client"
+	cmdcobra "github.com/aquasecurity/tracee/cmd/traceectl/pkg/cmd/cobra"
+	"github.com/aquasecurity/tracee/cmd/traceectl/pkg/cmd/flags"
+	"github.com/aquasecurity/tracee/cmd/traceectl/pkg/cmd/printer"
+)
+
+var eventCmd = &cobra.Command{
+	Use:   "event [enable | disable | describe]",
+	Short: "Manage tracee events",
+	Long: `Manage events in tracee.
+
+
+	Examples:
+	  tracee event enable security_file_open
+	  tracee event describe magic_write
+	  tracee event list
+	`,
+	Args: cobra.MinimumNArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		cmd.Help()
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(eventCmd)
+	//
+	// describe Event
+	//
+	eventCmd.AddCommand(describeEventCmd)
+
+	describeEventCmd.Flags().String(flags.ServerFlag, client.DefaultSocket, "Specify the server unix socket.")
+	if err := viper.BindPFlag(flags.ServerFlag, describeEventCmd.Flags().Lookup(flags.ServerFlag)); err != nil {
+		panic(err)
+	}
+
+	describeEventCmd.Flags().String(flags.FormatFlag, printer.TableFormat, "Specify the format (json or table).")
+	if err := viper.BindPFlag(flags.FormatFlag, describeEventCmd.Flags().Lookup(flags.FormatFlag)); err != nil {
+		panic(err)
+	}
+	describeEventCmd.Flags().String(flags.OutputFlag, "stdout", "Specify the output destination.")
+	if err := viper.BindPFlag(flags.OutputFlag, describeEventCmd.Flags().Lookup(flags.OutputFlag)); err != nil {
+		panic(err)
+	}
+
+	//
+	// Enable Event
+	//
+	eventCmd.AddCommand(enableEventCmd)
+
+	enableEventCmd.Flags().String(flags.ServerFlag, client.DefaultSocket, "Specify the server unix socket.")
+	if err := viper.BindPFlag(flags.ServerFlag, enableEventCmd.Flags().Lookup(flags.ServerFlag)); err != nil {
+		panic(err)
+	}
+
+	enableEventCmd.Flags().String(flags.OutputFlag, "stdout", "Specify the output destination.")
+	if err := viper.BindPFlag(flags.OutputFlag, enableEventCmd.Flags().Lookup(flags.OutputFlag)); err != nil {
+		panic(err)
+	}
+
+	//
+	// Disable Event
+	//
+	eventCmd.AddCommand(disableEventCmd)
+
+	disableEventCmd.Flags().String(flags.ServerFlag, client.DefaultSocket, "Specify the server unix socket.")
+	if err := viper.BindPFlag(flags.ServerFlag, disableEventCmd.Flags().Lookup(flags.ServerFlag)); err != nil {
+		panic(err)
+	}
+
+	disableEventCmd.Flags().String(flags.OutputFlag, "stdout", "Specify the output destination.")
+	if err := viper.BindPFlag(flags.OutputFlag, disableEventCmd.Flags().Lookup(flags.OutputFlag)); err != nil {
+		panic(err)
+	}
+}
+
+var describeEventCmd = &cobra.Command{
+	Use:   "describe <event name>",
+	Short: "List available events",
+	Long:  `Lists all available event definitions (built-in and plugin-defined), providing a brief summary of each.`,
+	Args:  cobra.MaximumNArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		runner, err := cmdcobra.GetDescribeEvent(cmd)
+		if err != nil {
+			cmd.PrintErrf("error creating runner: %s\n", err)
+			os.Exit(1)
+		}
+
+		if err := runner.Run(args); err != nil {
+			cmd.PrintErrf("error running: %s\n", err)
+			os.Exit(1)
+		}
+	},
+}
+
+var enableEventCmd = &cobra.Command{
+	Use:   "enable <event_name>",
+	Short: "Enable an event",
+	Long:  `Enables capturing of a specific event type.`,
+	Args:  cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		runner, err := cmdcobra.GetEnableEvent(cmd)
+		if err != nil {
+			cmd.PrintErrf("error creating runner: %s\n", err)
+			os.Exit(1)
+		}
+
+		if err := runner.Run(args); err != nil {
+			cmd.PrintErrf("error running: %s\n", err)
+			os.Exit(1)
+		}
+	},
+}
+
+var disableEventCmd = &cobra.Command{
+	Use:   "disable <event_name>",
+	Short: "Disable an event",
+	Long:  `Disables capturing of a specific event type.`,
+	Args:  cobra.ExactArgs(1),
+	Run: func(cmd *cobra.Command, args []string) {
+		runner, err := cmdcobra.GetDisableEvent(cmd)
+		if err != nil {
+			cmd.PrintErrf("error creating runner: %s\n", err)
+			os.Exit(1)
+		}
+
+		if err := runner.Run(args); err != nil {
+			cmd.PrintErrf("error running: %s\n", err)
+			os.Exit(1)
+		}
+	},
+}

cmd/traceectl/cmd/metrics.go

@@ -0,0 +1,39 @@
+package cmd
+
+import (
+	"os"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
+	"github.com/aquasecurity/tracee/cmd/traceectl/pkg/client"
+	cmdcobra "github.com/aquasecurity/tracee/cmd/traceectl/pkg/cmd/cobra"
+	"github.com/aquasecurity/tracee/cmd/traceectl/pkg/cmd/flags"
+)
+
+var metricsCmd = &cobra.Command{
+	Use:   "metrics",
+	Short: "Display Tracee metrics",
+	Long:  "Retrieves metrics about Tracee's performance and resource usage.",
+	Run: func(cmd *cobra.Command, args []string) {
+		runner, err := cmdcobra.GetMetrics(cmd)
+		if err != nil {
+			cmd.PrintErrf("error creating runner: %s\n", err)
+			os.Exit(1)
+		}
+		if err := runner.Run(); err != nil {
+			cmd.PrintErrf("error running: %s\n", err)
+			os.Exit(1)
+		}
+		runner.Server.Close()
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(metricsCmd)
+
+	metricsCmd.Flags().String(flags.ServerFlag, client.DefaultSocket, "Specify the server unix socket.")
+	if err := viper.BindPFlag(flags.ServerFlag, metricsCmd.Flags().Lookup(flags.ServerFlag)); err != nil {
+		panic(err)
+	}
+}

cmd/traceectl/cmd/root.go

@@ -0,0 +1,29 @@
+package cmd
+
+import (
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+var (
+	rootCmd = &cobra.Command{
+		Use:   "traceectl [command]",
+		Short: "traceectl is a CLI tool for tracee",
+		Long: `traceectl is a CLI tool for tracee:
+This tool allows you to manage events, stream events directly from tracee, and get info about tracee.
+`,
+		Run: func(cmd *cobra.Command, args []string) {
+			cmd.Help()
+		},
+	}
+)
+
+func init() {
+}
+
+func Execute() {
+	if err := rootCmd.Execute(); err != nil {
+		os.Exit(1)
+	}
+}

cmd/traceectl/cmd/stream.go

@@ -0,0 +1,54 @@
+package cmd
+
+import (
+	"os"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
+	"github.com/aquasecurity/tracee/cmd/traceectl/pkg/client"
+	cmdcobra "github.com/aquasecurity/tracee/cmd/traceectl/pkg/cmd/cobra"
+	"github.com/aquasecurity/tracee/cmd/traceectl/pkg/cmd/flags"
+	"github.com/aquasecurity/tracee/cmd/traceectl/pkg/cmd/printer"
+)
+
+var streamCmd = &cobra.Command{
+	Use:   "stream",
+	Short: "Stream events from tracee",
+	Long: `Stream Management:
+Stream events directly from tracee to the preferred output format.
+`,
+	Run: func(cmd *cobra.Command, args []string) {
+		runner, err := cmdcobra.GetStream(cmd)
+		if err != nil {
+			cmd.PrintErrf("error creating runner: %s\n", err)
+			os.Exit(1)
+		}
+
+		if err := runner.Run(); err != nil {
+			cmd.PrintErrf("error running: %s\n", err)
+			os.Exit(1)
+		}
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(streamCmd)
+
+	streamCmd.Flags().String(flags.FormatFlag, printer.TableFormat, "Specify the format for streamed events (json or table).")
+	if err := viper.BindPFlag(flags.FormatFlag, streamCmd.Flags().Lookup(flags.FormatFlag)); err != nil {
+		panic(err)
+	}
+	streamCmd.Flags().String(flags.ServerFlag, client.DefaultSocket, "Specify the server unix socket.")
+	if err := viper.BindPFlag(flags.ServerFlag, streamCmd.Flags().Lookup(flags.ServerFlag)); err != nil {
+		panic(err)
+	}
+	streamCmd.Flags().String(flags.OutputFlag, "stdout", "Specify the output destination for streamed events.")
+	if err := viper.BindPFlag(flags.OutputFlag, streamCmd.Flags().Lookup(flags.OutputFlag)); err != nil {
+		panic(err)
+	}
+	streamCmd.Flags().StringSlice(flags.PolicyFlag, []string{""}, "Specify the policies for streamed events.")
+	if err := viper.BindPFlag(flags.PolicyFlag, streamCmd.Flags().Lookup(flags.PolicyFlag)); err != nil {
+		panic(err)
+	}
+}

cmd/traceectl/cmd/version.go

@@ -0,0 +1,38 @@
+package cmd
+
+import (
+	"os"
+
+	"github.com/spf13/cobra"
+	"github.com/spf13/viper"
+
+	"github.com/aquasecurity/tracee/cmd/traceectl/pkg/client"
+	cmdcobra "github.com/aquasecurity/tracee/cmd/traceectl/pkg/cmd/cobra"
+	"github.com/aquasecurity/tracee/cmd/traceectl/pkg/cmd/flags"
+)
+
+var versionCmd = &cobra.Command{
+	Use:   "version",
+	Short: "Display the version of tracee",
+	Long:  "This is the version of the tracee application you connected to",
+	Run: func(cmd *cobra.Command, args []string) {
+		runner, err := cmdcobra.GetVersion(cmd)
+		if err != nil {
+			cmd.PrintErrf("error creating runner: %s\n", err)
+			os.Exit(1)
+		}
+		if err := runner.Run(); err != nil {
+			cmd.PrintErrf("error running: %s\n", err)
+			os.Exit(1)
+		}
+		runner.Server.Close()
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(versionCmd)
+	versionCmd.Flags().String(flags.ServerFlag, client.DefaultSocket, "Specify the server unix socket.")
+	if err := viper.BindPFlag(flags.ServerFlag, versionCmd.Flags().Lookup(flags.ServerFlag)); err != nil {
+		panic(err)
+	}
+}

cmd/traceectl/go.mod

@@ -0,0 +1,43 @@
+module github.com/aquasecurity/tracee/cmd/traceectl
+
+go 1.23.1
+
+require (
+	github.com/aquasecurity/table v1.8.0
+	github.com/aquasecurity/tracee/api v0.0.0-20240918153521-1b3f9e8657e0
+	github.com/spf13/cobra v1.8.1
+	github.com/spf13/viper v1.19.0
+	github.com/stretchr/testify v1.9.0
+	google.golang.org/grpc v1.67.0
+)
+
+require (
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
+	github.com/fsnotify/fsnotify v1.7.0 // indirect
+	github.com/hashicorp/hcl v1.0.0 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/magiconair/properties v1.8.7 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
+	github.com/mitchellh/mapstructure v1.5.0 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.2 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/rivo/uniseg v0.2.0 // indirect
+	github.com/sagikazarmark/locafero v0.4.0 // indirect
+	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
+	github.com/sourcegraph/conc v0.3.0 // indirect
+	github.com/spf13/afero v1.11.0 // indirect
+	github.com/spf13/cast v1.6.0 // indirect
+	github.com/spf13/pflag v1.0.5 // indirect
+	github.com/subosito/gotenv v1.6.0 // indirect
+	go.uber.org/atomic v1.9.0 // indirect
+	go.uber.org/multierr v1.9.0 // indirect
+	golang.org/x/exp v0.0.0-20230905200255-921286631fa9 // indirect
+	golang.org/x/net v0.28.0 // indirect
+	golang.org/x/sys v0.25.0 // indirect
+	golang.org/x/term v0.23.0 // indirect
+	golang.org/x/text v0.17.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142 // indirect
+	google.golang.org/protobuf v1.34.2 // indirect
+	gopkg.in/ini.v1 v1.67.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)