Functions — github.com/0xKirisame/SPiCa

hub / github.com/0xKirisame/SPiCa / functions

Functions127 in github.com/0xKirisame/SPiCa

Pure tick-driven evaluation. No I/O, no printing. Reads the registry + current /proc snapshot, mutates per-record suspect/cooldown state, pushes firin

spica-detect/src/lib.rs:189

↓ 12 callersFunctionxor_fields

(info: &mut ProcessInfo, key: u64)

spica-common/src/lib.rs:51

↓ 8 callersFunctionsample_info

()

spica-common/src/lib.rs:67

↓ 6 callersFunctionproc_info

(tgid: u32, start_time: u64, last_seen: u64)

spica-detect/src/lib.rs:642

↓ 6 callersFunctionwrite_executable

(path: &str, content: &str)

spica-install/src/lib.rs:149

↓ 5 callersFunctionderive_integrity_token

Derive the 64-bit integrity canary from BASE_KEY via SipHash-1-3. Properties: - Deterministic: same BASE_KEY always produces the same token. - Not in

spica-key/src/lib.rs:151

↓ 4 callersFunctionon_sched_event

Called when a sched_switch event arrives. Updates `sched_last` on the record and checks for DUPE (start_time_ns mismatch — same TGID, different kernel

spica-detect/src/lib.rs:287

↓ 4 callersFunctionrebuild

(cmd: &str, args: &[&str])

spica-install/src/lib.rs:165

↓ 3 callersFunctiondetect_distro

()

spica-install/src/lib.rs:119

↓ 2 callersFunctionclear_watchdog_pin

Remove the watchdog pin. Called on clean shutdown (SIGTERM/SIGINT) and on startup after detecting a leftover pin from a previous run.

spica/src/bpf.rs:145

↓ 2 callersFunctionfallback

(compile_time_key: u64)

spica-key/src/lib.rs:127

↓ 2 callersFunctionlkm_event

(tgid: u32, allowed: bool)

spica-detect/src/lib.rs:723

↓ 2 callersFunctionon_lkm_event

Called when an LKM load attempt event arrives. Always returns a Detection (either LkmAllow during boot window or LkmDeny after gate locked). There's n

spica-detect/src/lib.rs:344

↓ 2 callersFunctionon_nmi_event

Called when a normal NMI heartbeat event arrives (event_type == 0). Updates `nmi_last` on the record. Always returns None — NMI doesn't drive any even

spica-detect/src/lib.rs:328

↓ 2 callersFunctionrequire_root

()

spica-install/src/lib.rs:134

↓ 2 callersFunctionresolve

Try the TPM first; on any failure fall back visibly to the compile-time key. `compile_time_key` is the per-build fallback generated by `spica/build.r

spica-key/src/lib.rs:115

↓ 2 callersFunctionset_mode

(path: &str, mode: u32)

spica-install/src/lib.rs:158

↓ 1 callersFunctioncheck_bpf_lsm_available

Read `/sys/kernel/security/lsm` and check whether the BPF LSM is loaded.

spica-seccheck/src/lib.rs:92

↓ 1 callersFunctioncheck_ima_active

Check whether `/sys/kernel/security/ima` exists (IMA subsystem active).

spica-seccheck/src/lib.rs:80

↓ 1 callersFunctioncheck_ima_module_policy

Read `/proc/cmdline` and check for IMA appraisal policy.

spica-seccheck/src/lib.rs:85

↓ 1 callersFunctioncheck_module_sig_force

Read `/boot/config-$(uname -r)` and check for SIG_FORCE.

spica-seccheck/src/lib.rs:66

↓ 1 callersFunctioncheck_secure_boot

Read the SecureBoot EFI variable and return its state. Returns false if efivarfs isn't mounted, the variable is missing, or the data is malformed. Th

spica-seccheck/src/lib.rs:51

↓ 1 callersFunctioncomm_str

Format the kernel `comm` field (16-byte null-padded) as a UTF-8 string.

spica-detect/src/lib.rs:361

↓ 1 callersMethodget_random_key

(&mut self)

spica-key/src/lib.rs:53

↓ 1 callersFunctioninstall

Install SPiCa to /usr/local/bin and integrate with the distro's initramfs.

spica-install/src/lib.rs:72

↓ 1 callersFunctioninstall_binary

()

spica-install/src/lib.rs:142

↓ 1 callersMethodlock_lsm_gate

Set sc_gate[0] = 1, blocking all subsequent LKM loads with EPERM. No-op (returns Ok(())) if the LSM program didn't attach.

spica/src/bpf.rs:119

↓ 1 callersFunctionparse_bpf_lsm_available

Check whether the kernel's LSM list (from `/sys/kernel/security/lsm`) includes the BPF LSM.

spica-seccheck/src/lib.rs:40

↓ 1 callersFunctionparse_ima_module_policy

Check whether `/proc/cmdline` requests an IMA appraisal policy.

spica-seccheck/src/lib.rs:32

↓ 1 callersFunctionparse_module_sig_force

Check whether `/boot/config-X` text contains `CONFIG_MODULE_SIG_FORCE=y`.

spica-seccheck/src/lib.rs:27

↓ 1 callersFunctionparse_secure_boot_var

Parse a SecureBoot EFI variable's raw bytes. EFI variable file layout: 4 bytes attributes + variable-length data. For SecureBoot the data is a single

spica-seccheck/src/lib.rs:22

↓ 1 callersFunctionprint_install_summary

(distro: Distro)

spica-install/src/lib.rs:178

↓ 1 callersFunctionprint_uninstall_summary

(distro: Distro)

spica-install/src/lib.rs:196

↓ 1 callersFunctionread_tgids

Read the numeric subdirectories of `/proc` and return them as a set of TGIDs. Any non-numeric entry is silently skipped (`.`, `..`, `self`, `mounts`,

spica/src/proc.rs:21

↓ 1 callersFunctionresolve_comm

(tgid: u32)

spica/src/main.rs:199

↓ 1 callersFunctionrun

Run all four security-stack checks + BPF LSM check and print status. SPiCa is the last-resort layer; this just audits the layers above and warns the

spica-seccheck/src/lib.rs:104

↓ 1 callersFunctionrun_detection

()

spica/src/main.rs:53

↓ 1 callersMethodto_detection_class

Map to the corresponding public DetectionClass variant.

spica-detect/src/lib.rs:66

↓ 1 callersFunctiontry_lsm_modblock

(ctx: LsmContext)

spica-ebpf/src/main.rs:247

↓ 1 callersFunctiontry_nmi

(_ctx: PerfEventContext)

spica-ebpf/src/main.rs:173

↓ 1 callersFunctiontry_sched

(ctx: BtfTracePointContext)

spica-ebpf/src/main.rs:100

↓ 1 callersFunctiontry_watchdog

(_ctx: TracePointContext)

spica-ebpf/src/main.rs:293

↓ 1 callersFunctionuninstall

Remove SPiCa and its initramfs integration. Rebuilds the initramfs so the next boot doesn't reference the removed hooks.

spica-install/src/lib.rs:96

↓ 1 callersFunctionwatchdog_pin_exists

Returns true if a previous SPiCa instance left a watchdog pin behind (meaning it was killed ungracefully — SIGKILL, OOM, crash).

spica/src/bpf.rs:139

Functionclass_state_is_16_bytes

()

spica-detect/src/lib.rs:378

Functioncompile_time_key_returns_its_value

()

spica-key/src/lib.rs:184

Functionderive_integrity_token_different_keys_differ

()

spica-key/src/lib.rs:217

Functionderive_integrity_token_handles_zero_key

()

spica-key/src/lib.rs:224

Functionderive_integrity_token_is_deterministic

()

spica-key/src/lib.rs:198

Functionderive_integrity_token_is_not_invertible_to_key

()

spica-key/src/lib.rs:204

Functiondetect_distro_does_not_panic_on_mac

()

spica-install/src/lib.rs:261

Functiondetection_class_labels_are_uppercase_no_spaces

()

spica-detect/src/lib.rs:396

Functiondkom_clears_when_process_reappears_in_proc

()

spica-detect/src/lib.rs:504

Functiondkom_fires_when_scheduled_but_absent_from_proc

()

spica-detect/src/lib.rs:432

Functiondkom_respects_cooldown

()

spica-detect/src/lib.rs:470

Functiondkom_respects_grace_window

()

spica-detect/src/lib.rs:451

Functionembedded_scripts_are_nonempty

()

spica-install/src/lib.rs:268

Functionembedded_scripts_have_no_network_locked_language

()

spica-install/src/lib.rs:291

Functionembedded_scripts_have_no_subprocess_tpm_refs

()

spica-install/src/lib.rs:277

Functionembedded_scripts_reference_libtss2

()

spica-install/src/lib.rs:300

Functionevaluate_does_not_reallocate_out_when_empty

()

spica-detect/src/lib.rs:626

Functionevaluate_evicts_records_stale_on_both_channels_and_not_in_proc

()

spica-detect/src/lib.rs:592

Functionevaluate_retains_records_that_are_in_proc_even_if_stale

()

spica-detect/src/lib.rs:609

Functionfallback_returns_provided_key

()

spica-key/src/lib.rs:253

Methodfmt

(&self, f: &mut std::fmt::Formatter<'_>)

spica-install/src/lib.rs:49

Methodfrom

(e: std::io::Error)

spica-install/src/lib.rs:66

Functionghost_fires_when_in_proc_never_observed

()

spica-detect/src/lib.rs:529

Functioninstall_error_display_messages_are_useful

()

spica-install/src/lib.rs:251

Methodlabel

Uppercased label for the alert line, e.g. `DKOM`, `LKM-DENY`.

spica-detect/src/lib.rs:35

Methodload

Load eBPF, set globals, attach programs, pin watchdog, take ring buffers. Returns the runtime + whether the LSM gate attached (kernel config dependen

Building this crate has an undeclared dependency on the `bpf-linker` binary. This would be better expressed by [artifact-dependencies][bindeps] but is

spica-ebpf/build.rs:14

spica-key/src/lib.rs:75

Methodnew

Used when a new TGID is first observed via sched/NMI event.

spica-detect/src/lib.rs:122

Methodnmi_rb_mut

(&mut self)

spica/src/bpf.rs:131

Functionon_lkm_event_returns_allow_when_gate_open

()

spica-detect/src/lib.rs:731

Functionon_lkm_event_returns_deny_when_gate_closed

()

spica-detect/src/lib.rs:738

Functionon_nmi_event_ignores_zero_tgid

()

spica-detect/src/lib.rs:714

Functionon_nmi_event_updates_nmi_last

()

spica-detect/src/lib.rs:704

Functionon_sched_event_anchors_start_time_if_unknown

()

spica-detect/src/lib.rs:678

Functionon_sched_event_creates_record_for_new_tgid

()

spica-detect/src/lib.rs:650

Functionon_sched_event_fires_dupe_on_start_time_mismatch

()

spica-detect/src/lib.rs:662

Functionon_sched_event_ignores_zero_tgid

()

spica-detect/src/lib.rs:692

Functionpanic

(_info: &core::panic::PanicInfo)

spica-ebpf/src/main.rs:306

Functionparse_bpf_lsm_available_when_present

()

spica-seccheck/src/lib.rs:208

Functionparse_bpf_lsm_does_not_match_substring_in_other_names

()

spica-seccheck/src/lib.rs:218

Functionparse_bpf_lsm_unavailable_when_absent

()

spica-seccheck/src/lib.rs:213

Functionparse_ima_module_policy_absent

()

spica-seccheck/src/lib.rs:201

Functionparse_ima_module_policy_appraise_tcb

()

spica-seccheck/src/lib.rs:186

Functionparse_ima_module_policy_enforce

()

spica-seccheck/src/lib.rs:191

Functionparse_ima_module_policy_template

()

spica-seccheck/src/lib.rs:196

Functionparse_module_sig_force_absent

()

spica-seccheck/src/lib.rs:168

Functionparse_module_sig_force_does_not_match_unrelated_lines

()

spica-seccheck/src/lib.rs:174

Functionparse_module_sig_force_present

()

spica-seccheck/src/lib.rs:162

Functionparse_secure_boot_var_disabled

()

spica-seccheck/src/lib.rs:148

Functionparse_secure_boot_var_enabled

()

spica-seccheck/src/lib.rs:141

next →1–100 of 127, ranked by callers