Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

update(drivers): add cmd to exit events #1419

Merged
merged 2 commits into from
Nov 24, 2023
Merged

update(drivers): add cmd to exit events #1419

merged 2 commits into from
Nov 24, 2023

Conversation

Rohith-Raju
Copy link
Contributor

@Rohith-Raju Rohith-Raju commented Oct 16, 2023 •
edited
Loading

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area tests

What this PR does / why we need it: This PR adds cmd to bpf exit event

Which issue(s) this PR fixes:
Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

update(drivers): add cmd to bpf exit event

@github-actions
Copy link

github-actions bot commented Oct 16, 2023 •
edited
Loading

Please double check driver/API_VERSION file. See versioning.

/hold

FedeDP
FedeDP reviewed Oct 18, 2023
View reviewed changes
driver/event_table.c Outdated
@@ -303,7 +303,7 @@ const struct ppm_event_info g_event_info[] = {
[PPME_SYSCALL_SEMOP_E] = {"semop", EC_PROCESS | EC_SYSCALL, EF_NONE, 1, {{"semid", PT_INT32, PF_DEC} } },
[PPME_SYSCALL_SEMOP_X] = {"semop", EC_PROCESS | EC_SYSCALL, EF_NONE, 8, {{"res", PT_ERRNO, PF_DEC}, {"nsops", PT_UINT32, PF_DEC}, {"sem_num_0", PT_UINT16, PF_DEC}, {"sem_op_0", PT_INT16, PF_DEC}, {"sem_flg_0", PT_FLAGS16, PF_HEX, semop_flags}, {"sem_num_1", PT_UINT16, PF_DEC}, {"sem_op_1", PT_INT16, PF_DEC}, {"sem_flg_1", PT_FLAGS16, PF_HEX, semop_flags} } },
[PPME_SYSCALL_SEMCTL_E] = {"semctl", EC_PROCESS | EC_SYSCALL, EF_NONE, 4, {{"semid", PT_INT32, PF_DEC}, {"semnum", PT_INT32, PF_DEC}, {"cmd", PT_FLAGS16, PF_HEX, semctl_commands}, {"val", PT_INT32, PF_DEC} } },
[PPME_SYSCALL_SEMCTL_X] = {"semctl", EC_PROCESS | EC_SYSCALL, EF_NONE, 1, {{"res", PT_ERRNO, PF_DEC} } },
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Question: why is PPME_SYSCALL_QUOTACTL_X cmd a PF_DEC while this is a PF_HEX?

@Andreagit97 Andreagit97 added this to the 0.14.0 milestone Oct 23, 2023
Andreagit97
Andreagit97 reviewed Nov 21, 2023
View reviewed changes
Copy link
Member

@Andreagit97 Andreagit97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Uhm probably I'm missing something here but I understood that you would like to solve the first point in this issue #1343

  • add the possibility to check the return value, expose evt.arg.cmd also in the exit event to have all fields of interest in one event

This PR touches quotactl and semctl fillers, but the issue talks about bpf syscall 🤔

@Andreagit97 Andreagit97 modified the milestones: 0.14.0, TBD Nov 21, 2023
@Rohith-Raju
Copy link
Contributor Author

Rohith-Raju commented Nov 21, 2023 •
edited
Loading

@Andreagit97 The fix is to add cmd to exit events. Among all the syscalls supporting the cmd param Only quotactl and semctl have cmd in their entry events but not their exit event, So I added them.

@Andreagit97
Copy link
Member

@Andreagit97 The fix is to add cmd to exit events. Among all the syscalls supporting the cmd param Only quotactl and semctl have cmd in their entry events but not their exit event, So I added them.

Uhm I don't think this is what we need 🤔 Probably we just need the cmd param in the bpf syscall exit event to solve part of this issue #1343

@poiana poiana added size/XS and removed size/M labels Nov 22, 2023
@Rohith-Raju Rohith-Raju reopened this Nov 22, 2023
@poiana poiana added size/L and removed size/XS labels Nov 22, 2023
@Rohith-Raju Rohith-Raju marked this pull request as draft November 22, 2023 11:59
Andreagit97
Andreagit97 reviewed Nov 22, 2023
View reviewed changes
driver/event_table.c Outdated Show resolved Hide resolved
driver/bpf/fillers.h Outdated Show resolved Hide resolved
driver/bpf/fillers.h Outdated Show resolved Hide resolved
test/drivers/test_suites/syscall_exit_suite/bpf_x.cpp Outdated Show resolved Hide resolved
@Rohith-Raju Rohith-Raju marked this pull request as ready for review November 23, 2023 06:24
@poiana poiana requested a review from FedeDP November 23, 2023 06:24
Andreagit97
Andreagit97 approved these changes Nov 24, 2023
View reviewed changes
Copy link
Member

@Andreagit97 Andreagit97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Nov 24, 2023
@poiana
Copy link
Contributor

poiana commented Nov 24, 2023

LGTM label has been added.

Git tree hash: 19aba5ad9c6bc757b4d594c8903ac607dafa2288

@Andreagit97 Andreagit97 modified the milestones: TBD, 0.14.0 Nov 24, 2023
FedeDP
FedeDP approved these changes Nov 24, 2023
View reviewed changes
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Nov 24, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, Rohith-Raju

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@FedeDP
Copy link
Contributor

FedeDP commented Nov 24, 2023

/unhold

@poiana poiana merged commit 76c72a7 into falcosecurity:master Nov 24, 2023
33 checks passed
@Rohith-Raju Rohith-Raju deleted the bpf_exit branch December 11, 2023 09:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Andreagit97 Andreagit97 Andreagit97 approved these changes

@FedeDP FedeDP FedeDP approved these changes

@hbrueckner hbrueckner Awaiting requested review from hbrueckner

Assignees

@FedeDP FedeDP

@Andreagit97 Andreagit97

Labels
approved area/driver-bpf area/driver-kmod area/driver-modern-bpf area/tests dco-signoff: yes kind/feature New feature or request lgtm release-note size/L
Projects
None yet
Milestone
0.14.0
Development

Successfully merging this pull request may close these issues.
4 participants
@Rohith-Raju @Andreagit97 @poiana @FedeDP