glibc-2.42 added __inet_ntop_chk fortification, which started to fail:
*** buffer overflow detected ***: terminated
Program received signal SIGABRT, Aborted.
0x00007ffff629b0dc in __pthread_kill_implementation () from /lib64/libc.so.6
(gdb) bt
#0 0x00007ffff629b0dc in __pthread_kill_implementation () from /lib64/libc.so.6
#1 0x00007ffff6242572 in raise () from /lib64/libc.so.6
#2 0x00007ffff6229f3b in abort () from /lib64/libc.so.6
#3 0x00007ffff622b148 in __libc_message_impl.cold () from /lib64/libc.so.6
#4 0x00007ffff6327337 in __fortify_fail () from /lib64/libc.so.6
#5 0x00007ffff6326c92 in __chk_fail () from /lib64/libc.so.6
#6 0x00007ffff6327a62 in __inet_ntop_chk () from /lib64/libc.so.6
#7 0x000055555569da3d in inet_ntop (__af=10, __src=0x555555ee0800, __dst=0x7fffffff4f90 "\260P\377\377\377\177", __dst_size=100) at /usr/include/bits/inet-fortified.h:36
#8 ipv6tuple_to_string[abi:cxx11](ipv6tuple*, bool) (tuple=0x555555ee0800, resolve=false) at /tmp/portage/dev-debug/sysdig-0.40.1/work/libs-0.20.0/userspace/libsinsp/utils.c
Use INET6_ADDRSTRLEN as destination buffer size.
Fixes: https://github.com/falcosecurity/libs/issues/2573
Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>
Support for empty parameters was added with
https://github.com/falcosecurity/libs/pull/2550.
This update adds empty parameter support for `PPME_SYSCALL_SETPGID_X`.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Support for empty parameters was added with
https://github.com/falcosecurity/libs/pull/2550.
This update adds empty parameter support for `PPME_SYSCALL_SETNS_X`.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Support for empty parameters was added with
https://github.com/falcosecurity/libs/pull/2550.
This update adds empty parameter support for `PPME_SYSCALL_FCHDIR_X`.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Remove unused timestamp saving custom logic in parser for
`PPME_SYSCALL_SELECT_E`, `PPME_SYSCALL_POLL_X`,
`PPME_SYSCALL_PPOLL_X` and `PPME_SYSCALL_EPOLLWAIT_X` events
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
The current implementation uses custom code for fetching
the location of fd-related arguments for specific syscalls.
This update removes the custom code and utilizes the
existing `get_exit_event_fd_location` function instead by
expanding it with the location of the `dirfd' argument.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Some of the events in `g_event_info` structure are not flagged
with `EF_USES_FD` but still use the fd information when parsing.
Add the flag to the following events:
PPME_SYSCALL_SYMLINKAT_X
PPME_SYSCALL_UNLINKAT_2_X
PPME_SYSCALL_MKDIRAT_X
PPME_SYSCALL_FCHMODAT_X
PPME_SYSCALL_FCHOWNAT_X
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Make `PPME_SYSCALL_CLONE3_E` and `PPME_SYSCALL_CLONE3_X` managed by
the scap converter and contextually fix some tests using clone3 and
clone events.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_VFORK_E` and `PPME_SYSCALL_VFORK_X` events
managed by the scap-converter. Specifically, convert them to the
corresponding `PPME_SYSCALL_VFORK_17_{E, X}` event types; this allows
userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_VFORK_17_E` and `PPME_SYSCALL_VFORK_17_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_VFORK_20_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_FORK_E` and `PPME_SYSCALL_FORK_X` events
managed by the scap-converter. Specifically, convert them to the
corresponding `PPME_SYSCALL_FORK_17_{E, X}` event types; this allows
userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_FORK_17_E` and `PPME_SYSCALL_FORK_17_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_FORK_20_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
and PPM_SYSCALL_LINKAT
The new driver does not emit `PPM_SYSCALL_LINK` and
`PPM_SYSCALL_LINKAT` events anymore, and there is no longer need
to handle the old version of the events. This update removes the
state handling and adds conversion rules for the scap files.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Make both `PPME_SYSCALL_CLONE_11_E` and `PPME_SYSCALL_CLONE_11_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_CLONE_11_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_CLONE_16_E` and `PPME_SYSCALL_CLONE_16_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_CLONE_17_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_CLONE_17_E` and `PPME_SYSCALL_CLONE_17_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_CLONE_20_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
and PPM_SYSCALL_UNLINKAT
The new driver does not emit `PPM_SYSCALL_UNLINK` and
`PPM_SYSCALL_UNLINKAT` events anymore, and there is no longer need
to handle the old version of the events. This update removes the
state handling and adds conversion rules for the scap files.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Make both `PPME_SYSCALL_EXECVE_8_E` and `PPME_SYSCALL_EXECVE_8_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_13_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_EXECVE_13_E` and `PPME_SYSCALL_EXECVE_13_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_14_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_EXECVE_14_E` and `PPME_SYSCALL_EXECVE_14_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_15_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_EXECVE_15_E` and `PPME_SYSCALL_EXECVE_15_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_16_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_EXECVE_16_E` and `PPME_SYSCALL_EXECVE_16_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_17_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_EXECVE_17_E` and `PPME_SYSCALL_EXECVE_17_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_18_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_EXECVE_18_E` and `PPME_SYSCALL_EXECVE_18_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_19_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Let the scap converter managing all the possible variation of
`PPME_SYSCALL_EXECVEAT_X` event, adapting the userspace code to
handle possible empty values coming from the conversion.
The `PPME_SYSCALL_EXECVEAT_E` event is stil sent to sinsp, as its
parameters are still used as a fallback if the `trusted_exepath`
parameter is not present in the exit event.
Moreover, fixes some execveat tests.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
In the previous implementation, some specific parameter configurations
(empty or containing '(NULL)', with the type being equal to
`PT_CHARBUF`, `PT_FSPATH` or `PT_FSRELPATH`) were patched at loading
time with the following configuration:
- data: "<NA>"
- len: 5
This made empty parameters indistinguishable from non-empty
parameters.
The new implementation loads the parameters and keeps them untouched:
in this way, it is possible to inspect their original data and
lengths.
Since majority of the userspace space implementation still relies on
the aforementioned particular "null" encoding, a couple of new methods
(i.e. `sinsp_evt_param::used_legacy_null_encoding()` and
`sinsp_evt_param::data_and_len_with_legacy_null_encoding()`),
helping to check or simulate the old behaviour, are provided.
Moreover, parameter conversion methods (e.g.
`sinsp_evt_param::as<T>()`), still return the legacy encoded version.
BREAKING CHANGE: make parameter data and len private
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Introduce two fixes:
- turn "NULL" into "<NA>" upon string conversion for parameters that
couldn't be empty before the introduction of the notion of "empty
parameters" in the scap-converter
- fix implementation of `exists` operator for `evt.rawarg` by
flagging zero-length parameters as non-existing.
Moreover, introduce a bunch of unit tests for `evt.arg.*` and
`evt.rawarg.*`, and move some of the old one to new locations. Tests
are annotated in order to reflect the expectation of a future good
implementation.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Do not use GCC extension to define `SCAP_EMPTY_PARAMS_SET`. In this
way, it can be used in Windows.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
The function extracting `fd` parameter's location from the
exit event is missing information for the dup syscalls.
Add location of the `fd` parameter in the exit event for
all dup syscalls.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Add support for `evt.rawarg.*` raw value evaluation for `PT_PID`,
`PT_UID`, `PT_GID` and `PT_SOCKTUPLE`.
Moreover, add support for numerical comparison for `PT_UID` and
`PT_GID`.
Finally, introduce some helpers letting generating execve and connect
events for testing purposes.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Addresses https://github.com/falcosecurity/libs/issues/2546
Ensures that `comm-based` suppression correctly applies not only to processes matching
the configured comm values, but also to their child processes—even when those processes
were already running at the time the library is initialized.
This is achieved by having scap notify sinsp when a `/proc` scan refresh begins and ends.
While the scan is in progress, sinsp builds a temporary `TID` tree to track parent-child relationships.
Once the scan completes, sinsp performs a post-processing step that traverses the tree and suppresses
all children of any process already marked as suppressed by comm.
Signed-off-by: Francesco Emmi <francesco.as@gmail.com>
Add scap API to create/encode events with empty parameters, as this is
required to easily tests events whose type is managed by the scap
converter.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
The new driver does not emit `PPM_SYSCALL_RMDIR` events anymore, and
there is no longer need to handle the old version of the rmdir event.
This update removes the state handling and adds conversion rules for
the scap files.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
The current implementation does no longer emit PPME_SYSCALL_MKDIR_X
events and these events are also converted to PPME_SYSCALL_MKDIR_2_X
events for older scap files. Remove unused PPME_SYSCALL_MKDIR_X
statements from the codebase.
Added the CIF_FALLBACK_TO_EMPTY flag for parameters copied from
the enter event.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
https://github.com/falcosecurity/libs/pull/2544 implements conversion
of the exceve_x event which increases the number of parameters to 30.
Adjust the number of expected parameters from 27 to 30 for execve_x
events with the gvisor engine.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Let the scap converter managing all the possible variation of
`PPME_SYSCALL_EXECVE_19_X` event, adapting the userspace code to
handle possible empty values coming from the conversion.
The `PPME_SYSCALL_EXECVE_19_E` event is stil sent to sinsp, as its
`filename` parameter value is still used as a fallback if the
`trusted_exepath` parameter is not present in the exit event.
Moreover, fixes some execve and execveat tests and align comments
to the new one-line style in the kernel drivers and tests.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
There is no need to store the prlimit entry event, because all
required parameters are available in the exit event.
Modify the prlimit exit event handler to retrieve information from
the exit event instead of the entry event. Added scap conversion
rules for the exit event with 5 parameters.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Old PPME_SYSCALL_PTRACE_X events have zero parameters and they
need conversion support. Add support for converting events
with zero parameters to events with 3 parameters.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Add `C_INSTR_FROM_EMPTY` converter instruction code. This specify
to generate an empty parameter. In order to keep compatibility with
old scap files, an empty parameter has a parameter length set to 0
but it still have `len` bytes set to 0 as parameter value, where
`len` is determined from the parameter type.
E.g.: a `PT_UINT64` parameter will have the length set to 0 and its
value will occupy 8 bytes, all set to 0.
Contextually, introduce the notion of conversion flags and
particularly, the `CIF_FALLBACK_TO_EMPTY` flag: by default, if a
`C_INSTR_FROM_ENTER` instruction is encountered, and for some reason
the converter is not able to obtain a parameter from the enter event,
it pushes a default parameter; if `CIF_FALLBACK_TO_EMPTY` is
specified, it will fallback to an empty parameter.
This flag is a temporary solution to avoid handling empty parameters
in place of default ones in a single shot.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As buster reached its EOL, the official debian repo URL doesn't
host anymore buster packages info. For this reason, change the URLs
to point to the `20250630T203427Z` snapshot, which still contains
them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Fix the scap converter `PT_UID` parameters default value by setting it
to `UINT32_MAX`. Moreover, fix scap converter tests and sinsp parser
code to correctly account for the default value.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
`sinsp_threadinfo_ctor_params` is declared as struct but
forward-declared as class. Fix forward declaration by declaring it
as struct.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_CONNECT_E` parameters to` PPME_SYSCALL_CONNECT_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update connect-related drivers, scap converter and sinsp parser
tests to account the new layout.
For the moment, do not touch userspace connect "enter event"-related
logic as it requires additional work to be done on driver's tuple
generation logic.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Introduce typeinfo::from convenience function, to create a typeinfo
object from ss_plugin_state_type
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
The current `sched_process_exec_args` raw tracepoint definition is
actually the tracepoint one; similarly, the current tracepoint
defintion is actually the raw tracepoint one. Swap them to give the
correct definition on each context.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This update adds scap event conversion for the fcntl syscall exit
events and it eliminates the need to store the entry event in
libsinsp.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Revise the socketcall test case for accept for modern BPF and
other drivers.
On s390x, there is no direct accept syscall and for modern BPF
accept4 is used instead.
The BPF and kernel drivers handle socketcalls internally and, thus,
can handle accept. There was only special handling for setting up
the event. This commit also adds handling for the argument assertions.
Solving these test case failures:
````
Expected: (m_current_param) <= (m_event_header->nparams), actual: 6 vs 5
>>>>> The param id '6' is too big.
/root/git/libs/test/drivers/event_class/event_class.cpp:1457: Failure
Expected equality of these values:
size
Which is: 0
expected_size
Which is: 4
>>>>> length of the param is not correct. Param id = 6
[ FAILED ] SyscallExit.socketcall_acceptX_INET
[ FAILED ] SyscallExit.socketcall_acceptX_INET6
[ FAILED ] SyscallExit.socketcall_acceptX_UNIX
[ FAILED ] SyscallExit.socketcall_acceptX_failure
````
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Recent compilers complain about missing climits header file:
libs/test/libsinsp_e2e/sys_call_test.cpp: In lambda function:
/root/git/libs/test/libsinsp_e2e/sys_call_test.cpp:266:23: error: ‘INT_MAX’ was not declared in this scope
266 | close(INT_MAX);
| ^~~~~~~
libs/test/libsinsp_e2e/sys_call_test.cpp:266:23: note: ‘INT_MAX’ is defined in header ‘<climits>’; this is probably fixable by adding ‘#include <climits>’
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
The current bpf and kmod's `connect` fillers implementations extract
socket tuple information only if the socket file descriptor is greater
than or equal to zero: this does not ensure that the file descriptor
is valid and that the kernel has the correct amount of information
needed to build the socket tuple.
On the other side, the modern probe implementation correctly checks
the system call return value on the exit program, but doesn't try
hard enough to build the socket tuple, as it does not leverage the
sockaddr provided by the user.
Align all three implementations, checking the system call return value
and leveraging the user-provided sockaddr information to build the
socket tuple.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_PWRITEV_E` parameters to` PPME_SYSCALL_PWRITEV_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update pwritev-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Recent additions increased `sinsp-example` instrumentation time in
such a way that now events can be produced by the testing framework
even before `sinsp-example` is initialized and receptive to them.
Increase `sinsp-example` initialization waiting interval to account
for this changes.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Complete the work in 3385c69812 by
aligning the dup2's and dup3's fillers returned value handling to the
other file descriptors handling. Moreover, it also align the dup's
fillers file descriptors handling.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Check that `epoll_create` and `epoll_create1` correctly set fd info
on the event and on the current thread's fd table.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_WRITEV_E` parameters to `PPME_SYSCALL_WRITEV_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update writev-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_LSEEK_E` parameters to `PPME_SYSCALL_LSEEK_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update lseek-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Select the SOURCE_PLUGIN_ENGINE only if SAVEFILE_ENGINE hasn't been
previously selected. This lets us process .scap files with a plugin.
This makes the "-s" and "-p" command line flags sensitive to order, so
document that behavior.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
Add `PPME_SYSCALL_{P}READV_E` parameters to `PPME_SYSCALL_{P}READV_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update {p}readv-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_COPY_FILE_RANGE_E` parameters to
`PPME_SYSCALL_COPY_FILE_RANGE_X` event definition and align all 3
kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update copy_file_range-related drivers, scap converter and sinsp
parser tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_SPLICE_E` parameters to `PPME_SYSCALL_SPLICE_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update splice-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_INOTIFY_INIT_E` parameters to
`PPME_SYSCALL_INOTIFY_INIT_X` event definition and align all 3 kernel
drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update inotify_init-related drivers, scap converter and sinsp
parser tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_TIMERFD_CREATE_E` parameters to
`PPME_SYSCALL_TIMERFD_CREATE_X` event definition and align all 3
kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update timerfd_create-related drivers, scap converter and sinsp
parser tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_NANOSLEEP_E` parameters to
`PPME_SYSCALL_NANOSLEEP_X` event definition and align all 3 kernel
drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update nanosleep-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_SIGNALFD_E` parameters to `PPME_SYSCALL_SIGNALFD_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update signalfd-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SOCKET_ACCEPT4_6_E` parameters to `PPME_SOCKET_ACCEPT4_6_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update accept4-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_{KILL,TKILL,TGKILL}_E` parameters to
`PPME_SYSCALL_{KILL,TKILL,TGKILL}_X` event definition and align all 3
kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update kill/tkill/tgkill-related drivers, scap converter and sinsp
parser tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_QUOTACTL_E` parameters to `PPME_SYSCALL_QUOTACTL_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update quotactl-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_SENDFILE_E` parameters to `PPME_SYSCALL_SENDFILE_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update sendfile-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Align dup2 and dup3 fillers implementations to other fillers
implementation by casting syscalls' file descriptor parameters to
`int32_t` before sending them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
- Adapt build_threadinfo to the new sinsp_threadinfo constructor
- Have sinsp_threadinfo_ctor_params to allow forward declaration and
avoid cyclic dependency
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
Add `PPME_SYSCALL_SIGNALFD4_E` parameters to
`PPME_SYSCALL_SIGNALFD4_X` event definition and align all 3 kernel
drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update signalfd4-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_EVENTFD2_E` parameters to `PPME_SYSCALL_EVENTFD2_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update eventfd2-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_UMOUNT2_E` parameters to `PPME_SYSCALL_UMOUNT2_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update umount2-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_EPOLL_CREATE{1}_E` parameters to
`PPME_SYSCALL_EPOLL_CREATE{1}_X` event definitions and align all 3
kernel drivers to them.
Add new rules to scap file converter table to convert events in old
scap files to the new layouts.
Add/update epoll_create{1}-related drivers, scap converter and sinsp
parser tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_MPROTECT_E` parameters to `PPME_SYSCALL_MPROTECT_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update mprotect-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_SECCOMP_E` parameters to `PPME_SYSCALL_SECCOMP_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update seccomp-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_UNSHARE_E` parameters to `PPME_SYSCALL_UNSHARE_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update unshare-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_ACCESS_E` parameters to `PPME_SYSCALL_ACCESS_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update access-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_MOUNT_E` parameters to `PPME_SYSCALL_MOUNT_X` event
definition and aligns all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update mount-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_PPOLL_E` parameters to `PPME_SYSCALL_PPOLL_X` event
definition and aligns all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update ppoll-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_SEMCTL_E`/`PPME_SYSCALL_SEMGET_E` parameters to
`PPME_SYSCALL_SEMCTL_X`/`PPME_SYSCALL_SEMGET_X` event definitions and
aligns all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update semctl/semget-related drivers, scap converter and sinsp
parser tests to account for the new layouts.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_SEMOP_E` parameters to `PPME_SYSCALL_SEMOP_X` event
definition and aligns all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update semop-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_FLOCK_E` parameters to `PPME_SYSCALL_FLOCK_X` event
definition and aligns all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update flock-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_GETDENTS{64}_E` parameters to
`PPME_SYSCALL_GETDENTS{64}_X` event definitions and aligns all 3
kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update getdents{64}-related drivers, scap converter and sinsp
parser tests to account for the new layouts.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_MUNMAP_E` parameters to `PPME_SYSCALL_MUNMAP_X`
event definition and aligns all 3 kernel drivers and gvisor engine
to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update munmap-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
When setre*id args where moved to exit event with commit
d7d1e7c861
the offset for the effective id was not updated to
point to the correct value. Instead it was pointing to
the offset where the real id is stored.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the setresuid syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the setresgid syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Partially revert changes introduced in
dfdd45cc2c by replacing the usage
of `socket_family_to_scap` helper with a calls to a new ad-hoc helper
for the legacy bpf probe. To avoid breaking the verifier on old kernel
version, just convert user-provided negative socket family values to
`PPM_AF_UNSPEC` and leave positive values as are. This simplified
version relies on the fact that `AF_*` and corresponding `PPM_AF_*`
macros map to the same values.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Extend `PPME_SYSCALL_CLOSE_X` event by adding the fd parameter to its
definition. Keep the sinsp parser logic associating the fdinfo to the
`close` enter event, but don't apply anymore any additional logic
for it: in other words, remove any code associated to the notion of
"close in progress" or "close canceled" as they have no meaning
anymore.
BREAKING CHANGE: remove `FLAGS_CLOSE_IN_PROGRESS` and
`FLAGS_CLOSE_CANCELED` `sinsp_fdinfo::flags`
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
The new driver does not emit `PPM_SYSCALL_MKDIR` events anymore, and
there is no longer need to handle the old version of the mkdir event.
This update removes the state handling and adds conversion rules for
the scap files.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Add `PPM_SYSCALL_GETRLIMIT_E` params to `PPM_SYSCALL_GETRLIMIT_X`
event definition and align all 3 kernel drivers to the it. Moreover,
align setrlimit_x parsing logic to getrlimit_x logic by unify the
implementation and avoiding storing setrlimit_e: this requires
adding ad-hoc conversion rules for old versions of setrlimit events
coming from old scap files.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Since we now do not store users and groups full info inside each threadinfo,
we would lose users and groups info for host processes after 1 minute.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Fix `domain` parameter exported value by converting it to its
corresponding scap representation in both legacy bpf and kernel
probes.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the setgid syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Commit https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=5b0af621c3f6
restricts `SO_REUSEPORT` socket option to inet sockets: this means
that calls to `setsockopt` setting `SO_REUSEPORT` on unix sockets are
not permitted anymore and will fail on any version backporting the
change. For this reason, still perform the call (to account for socket
belonging to inet families) but ignore its return value and hope any
subsequent call to bind is going to succeed.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the setpgid syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
After commit 3f3e3fb23 we're not directly using `init_keep_threadinfo()`
anymore, so let's merge it with `init()`.
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the fchdir syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the setns syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Replace helper to verify the presence of the exact number of events
of specific types inside a single scap file. Differently from the
old `assert_num_event_type()`, this helper is able to perform the
check on multiple event types at the same type: this helps
consolidating all the tests checking the number of events in all scap
file under a single test.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the mkdir syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Add enter events parameters to `PPME_SOCKET_RECVMSG_X` and align all
three kernel drivers to the new definition. Contextually, align tuple
parameter extraction in all three drivers, and remove exceptions
in recvmsg driver tests accounting for the removed differences.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the ptrace syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
This allows Falco outputs to be appended alphabetically sorted.
Also, should fix the build of Falco with old yaml-cpp versions.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
It allows people to set "static" filterchecks; for now, it only supports string ones.
The API is very simple since the filterchecks are initialized from an unordered_map<string,string>.
Added also a bunch of tests.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Libsinsp will now take a copy (not a reference) of scap event table,
and each plugin loaded with ASYNC cap will append its async_event_names
to the table, that will grow larger than PPM_EVENT_MAX, up to 1024 elements.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
The docs (and a unit test) specified `value_offsets` to be an array
of `ss_plugin_extract_value_offsets` structs, while the code in
plugin_filtercheck.cpp expected it to be a struct of arrays.
Things worked out only because we never extract multiple fields
in one go (at least in libsinsp itself).
Keep the plugin_filtercheck.cpp behavior and adapt the documentation
and tests to match.
Additionally, clarify that the offsets are counted from the start
of the event buffer (including the header).
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
* Remove references to the localhost `test/vm` framework
* Remove overly detailed build guidelines for containers
* Ensure more precise and accurate terminology
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
* No longer maintained: This framework will not receive updates or support in the future.
* Past usefulness: It was valuable for detecting regressions in legacy drivers but has now outlived its practical use.
* Compatibility issues: It was incompatible with the Firecracker framework. VirtualBox caused interference when trying to integrate it into the CI workflow on the same test server where kernel driver tests using Firecracker were conducted.
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Commit 72a6d4f39a changed the logic
governing when enter events are freed. Specifically, enter events
were freed after having performed a conversion (not a skipped
conversion) involving an exit event. With this configuration, the
following conversion would not work:
```c++
{conversion_key{EXAMPLE_E, 1},
conversion_info().action(C_ACTION_STORE)},
{conversion_key{EXAMPLE_X, 4},
conversion_info().action(C_ACTION_ADD_PARAMS)
.instrs({{C_INSTR_FROM_DEFAULT, 0}})},
{conversion_key{EXAMPLE_X, 5},
conversion_info().action(C_ACTION_ADD_PARAMS)
.instrs({{C_INSTR_FROM_ENTER, 0}})}
```
The reason why it would not work, is that the converter would
free the stored enter event upon execution of the second conversion,
and would not find it upon execution of the third one.
Revert only the logic applied to free the enter event, which means
freeing it only if it is used by a `C_INSTR_FROM_ENTER` instruction.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add test coverage for file descriptor parameters and some spurious
ones of other kind.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add enter events parameters to `RECVFROM_X` event definition and
align all three kernel drivers to the new definition.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
`event` can be NULL and code must not access it without guarding the
access. Fix it by avoiding the access to the event field and using
instead the `event_type` function parameter.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add enter events parameters to `RECV_X` event definition and align
all three kernel drivers to the new definition. Moreover, add the
`tuple` parameter to it, and align userspace logic to leverage its
presence. Finally, add the capability to leverage the content
extracted from the syscall data buffer in userspace.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Take into account possible misaligned accesses while printing scap
event parameters to standard output by first copying misaligned bytes
using memcpy. Contextually, factorize multiple switch case, sharing
the same handling code.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add two new CLI options for the modern eBPF probe in `sinsp-example`:
- `-c <num>, --cpus-for-each-buffer <num>` - allowing to select the
number of CPUs for each ring buffer
- `-A, --all-cpus` - allowing to allocate ring buffers for all
available CPUs (not only online ones)
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This update is part of the proposal for disabling support for
syscall enter events. It implements the following steps:
1. Add enter parameters to the exit event.
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the setuid syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
As the end goal is to remove unneeded duties from `sinsp`, remove
`sinsp::get_thread_ref()` API and let users directly call the
corresponding thread manager API.
BREAKING CHANGE: remove `sinsp::get_thread_ref()`
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make `sinsp_parser::reset()` const by removing the logic for
obtaining the syscall event source index and providing it directly
from sinsp.
BREAKING CHANGE: make `sinsp_parser::reset()` const
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Apply early return and idiom in `sinsp::handle_plugin_async_event()`
and contextually reformat comments.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As the end goal is to remove unneeded duties from `sinsp`, remove
`sinsp::remove_thread()` API and let users directly call the
corresponding thread manager API.
BREAKING CHANGE: remove `sinsp::remove_thread()`
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As the end goal is to remove unneeded duties from `sinsp`, remove
`sinsp::add_thread()` API and let users directly call the
corresponding thread manager API.
BREAKING CHANGE: remove `sinsp::add_thread()`
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
BREAKING CHANGE: remove `sinsp_dumper::get_memory_dump_cur_buf()` and
`sinsp_dumper::next_write_position()` public APIs
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Explicitely enforce, by accepting references, the non-nullness of the
input parameters in the `sinsp_parser` public APIs.
BREAKING CHANGE: update `sinsp_parser::process_event()`,
`sinsp_parser::event_cleanup()`, `sinsp_parser::reset()`,
`sinsp_parser::retrieve_enter_event()` and
`sinsp_parser::parse_dirfd()` signatures
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Replace pointers with references in `sinsp_parser`'s private APIs
wherever possible.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Introduce `sinsp_parser_verdict` component. This component is provided
by `sinsp` to the `sinsp_parser` component, and is populated by this
latter with information regarding the thread/file descriptors to
remove and/or the observer callbacks to execute. This helps moving the
state out of the sinsp_parser component.
BREAKING CHANGE: update `sinsp_parser` constructor, and
`sinsp_parser::process_event()` and `sinsp_parser::reset()` signatures
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove `sinsp_thread_manager` dependency on `sinsp` fields by
selectively providing each single dependency the component.
BREAKING CHANGE: update `sinsp_thread_manager` constructor, and
remove `sinsp::get_thread_manager_dyn_fields()` and
`sinsp::get_fdtable_dyn_fields()` public APIs
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Use fdinfo factory in `event_processor::build_fdinfo()`. In order to
avoid call loops, extract the fdinfo creation logic in a separate
private fdinfo factory method and provide access to it via the
attorney-client idiom.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Replace `sinsp::get_lastevent_ts()` and `sinsp::get_new_ts()`
accesses in `sinsp_usergroup_manager` with accesses to `timestamper`
APIs.
BREAKING CHANGE: update `sinsp_usergroup_manager` constructor
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `timestamper` component handling timestamp caching and
generation. The addition of this component is a preliminary step
needed for decoupling other components like `sinsp_thread_manager`
and `sinsp_usergroup_manager` from `sinsp`.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
BREAKING CHANGE: make
`sinsp_thread_manager::remove_main_thread_fdtable()` private and
const, and update `sinsp_thread_manager` constructor
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add extraction offsets to the filter cache. Add an offset parameter to
the various extract_nocache functions. Implement offset extraction in
sinsp_filter_check_plugin::extract_nocache, and ignore offsets
elsewhere. Add sinsp_filter_check::extract_with_offsets. Add an offsets
test to plugins.ut.cpp.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
Remove field_offsets from ss_plugin_field_extract_input. We can just
check to see if field_offsets is set. Update some comments.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
Avoid field name copy each time
`sinsp_thread_manager::get_field_accessor()` is called by passing a
string const reference.
BREAKING CHANGE: change `sinsp_thread_manager::get_field_accessor()`
signature
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Move `sinsp_thread_manager::load_foreign_fields_accessors()` method
logic in sinsp, and provide two new setters
`sinsp_thread_manager::set_foreign_field_accessors()` and
`sinsp_thread_manager::set_foreign_tables()` to enable tables
and accessors setting on thread manager from sinsp.
BREAKING CHANGE: remove
`sinsp_thread_manager::load_foreign_fields_accessors()` method
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Reduce threadinfo's params resources waste by moving them into a
separate struct provided at construction phase and shared among all
threadinfo instances.
BREAKING CHANGE: update `sinsp_threadinfo` constructor
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove unused `sinsp::get_fdinfo_factory()` and
`sinsp::get_fdtable_factory()` from `sinsp` public API.
BREAKING CHANGE: remove `sinsp::get_fdinfo_factory()` and
`sinsp::get_fdtable_factory()`
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove `sinsp_threadinfo` dependency on `sinsp` fields that are
mutable from the `sinsp_threadinfo` perspective by selectively
providing each single dependency the component needs. In order to
solve a cyclic dependency problem with the thread manager and the
thread info factory, add `sinsp_threadinfo_factory`'s
`set_thread_manager_attorney` inner class following the
attorney-client idiom to limit access to
`sinsp_threadinfo_factory::set_thread_manager` private method.
BREAKING CHANGE: update `sinsp_threadinfo` constructor
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove `sinsp_threadinfo` dependency on `sinsp` fields that are
immutable from the `sinsp_threadinfo` perspective by selectively
providing each single dependency the component needs. In order to
avoid code duplication in the event processor, add
`sinsp_threadinfo_factory`'s `create_unique_attorney` inner class
following the attorney-client idiom to limit access to
`sinsp_threadinfo_factory::create_unique` private method.
BREAKING CHANGE: update `sinsp_threadinfo` constructor
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove, in thread manager code, references to thread manager's methods
involving passing through the inspector.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Reduce fdtable's params resources waste by moving them into a
separate struct provided at construction phase and shared among all
fdtable instances.
BREAKING CHANGE: update `sinsp_fdtable` constructor
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
It might happen that a threadinfo has a container_id attached,
but the plugin already removed the container from its cache.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Pass `notify` as `sinsp_threadinfo::set_group()` flag to enable
external control over thread user update notification.
BREAKING CHANGE: update `sinsp_threadinfo::set_group()`,
`sinsp_threadinfo::init()` signatures and `user_group_updater`
constructor.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Pass `notify` as `sinsp_threadinfo::set_user()` flag to enable
external control over thread user update notification.
BREAKING CHANGE: update `sinsp_threadinfo::set_user()`,
`sinsp_threadinfo::init()` signatures and `user_group_updater`
constructor.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Move bound server ports accounting from
`sinsp_threadinfo::add_fd_from_scap()` to new
`sinsp_thread_manager::add_thread_fd_from_scap()` API.
BREAKING CHANGE: change sinsp_threadinfo::add_fd_from_scap() semantic
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `resolve_hostname_and_port` parameter to
`sinsp_threadinfo::fix_sockets_coming_from_proc()` and
`sinsp_thread_manager::fix_sockets_coming_from_proc()` signatures
BREAKING CHANGE: update
`sinsp_threadinfo::fix_sockets_coming_from_proc()` and
`sinsp_thread_manager::fix_sockets_coming_from_proc()` signatures
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
pkgconfig files are installed in CMAKE_INSTALL_LIBDIR/pkgconfig and we
need to find our way back to CMAKE_INSTALL_PREFIX. The correct
(relative) path is as many `../` up, as there are components in
`CMAKE_INSTALL_LIBDIR/pkgconfig` (the default being `lib/pkgconfig`).
Rather than hardcode the two components matching the default path,
figure it out at configure time.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
* use relative path as pkgconfig prefix (using CMAKE_INSTALL_PREFIX
breaks `make DESTDIR=...` installs)
* install generated uthash.h rather than point into local build
directory
* fix typos that prevented libscap.pc from specifying dependencies
Note: I was still unable to do a successful build with
ASAN/UBSAN-enabled libsinsp, but that's possibly my fault.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
This test verifies that a condition expression with a value containing
an `=` character can be printed and parsed again without errors.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
If a condition expression contains a value with a = character, when
the condition expression is printed as a string using
libsinsp::filter::ast::as_string, the value is not escaped.
This causes problems if you try to parse the condition expression string again.
For example, a condition of ... and not (proc.cmdline contains
"--coreutils-prog-shebang=") and not ... gets printed as ... and
not (proc.cmdline contains --coreutils-prog-shebang=) and not
... which results in an error when trying to parse it again.
The fix is to detect when a value contains a `=` character and escape
the value when found.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
When the fd table is full, evt->get_fd_info is reset to NULL, which
causes a crash when the observer accesses the fdinfo. Revert to
the previous behavior, where we always called the observer with
a valid fdinfo, even if the fd got later dropped.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
The pointer ends up being converted to a shared_ptr anyway so we can
do it a bit earlier without issues.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Many pcapng block types support optional fields, and the SHB is one of
those types:
https://ietf-opsawg-wg.github.io/draft-ietf-opsawg-pcap/draft-ietf-opsawg-pcapng.html#name-section-header-block
Some software lets you add file-level comments to the SHB. Make sure we
skip over any options in scap_read_section_header.
Add a note to next_event_from_file about the possibility of adding
support for comment options in event blocks.
Add a test capture file which contains comments along with a CI test.
Created by running
editcap --capture-comment "File-level comment" -a "1:Internal block comment" -a "211:Visible block comment, no padding" -a "213:Visible block comment, padding" curl_google.scap curl_google_comments.scap
Signed-off-by: Gerald Combs <gerald@wireshark.org>
Remove inspector's `sinsp::build_threadinfo()` exposed method and
force the other components (i.e.: `sinsp_thread_manager`, `sinsp`,
`sinsp_parser`, etc...) to use the threadinfo factory to create a new
`sinsp_threadinfo` object. Moreover, extract the thread manager's
dynamic fields initialization from thread manager, and pass them to
its constructor from sinsp: this allows to control the dynamic
fields in a single place and inject them both on the thread manager
and on the threadinfo factory. Together, these changes reduces the
number of dependencies of components that want to create a new
threadinfo. This step is needed to get rid of the `sinsp` pointer in
`sinsp_thread_manager`.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove inspector's `sinsp::build_fdinfo()` exposed method and force
the other components (i.e.: `sinsp_threadinfo`,
`sinsp_thread_manager`, etc...) to use the fdinfo factory to create a
new `sinsp_fdinfo` object. Moreover, remove the dependency of
`sinsp_fdinfo_factory` from `sinsp_thread_manager`. Together, these
changes reduces the number of dependencies of components that want to
create a new fdinfo. This step is needed to get rid of the `sinsp`
pointer in `fdtable`, `sinsp_thread_manager` and `sinsp_threadinfo`.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Store input plugin reference in parser to handle input plugin
reassignments in `sinsp`: indeed, if the input plugin is reassigned
(e.g.: `sinsp::set_input_plugin`), the parser would continue to
use the old input plugin value, as currently it makes a copy of the
provided shared_ptr.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
API 3.10 changed the layout of the plugin_api struct
in an ABI-incompatible way. This does not matter for shared library
plugins, but statically linked plugins do depend on binary compatibility
between the two structs.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Make `define_static_field` constexpr static and directly provide
the field offset. Introduce `OFFSETOF_STATIC_FIELD`,
`DEFINE_STATIC_FIELD_READONLY` and `DEFINE_STATIC_FIELD` macros to
hide the complexicity behind extracting the field type and offset
needed for `define_static_field`.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
De-referencing scap_evt fields is undefined behavior since
scap_evt is pragma packed and we may access fields whose address
is not correctly aligned.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Restructure recvmsg `SCM_RIGHTS` processing to avoid allocations
before sanity checks are performed.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove trailing comma as some old cmake versions cannot otherwise
parse the `CMakePresets.json` file.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Isolate `sinsp_parser` component from sinsp by removing the source
code dependency. Dependencies are now selectively pushed in the parser
constructor and their constness enforced wherever possible.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Nowadays, it was only filtering out gvisor (and thus protobuf), but we already have the `BUILD_LIBSCAP_GVISOR` flag for that.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
It leverages sinsp state table API to retrieve "container_id" field written by the plugin.
Use it where needed.
Moreover, user_group_manager cannot subscribe to container changes anymore, since container changes are no more in sinsp.
Instead, parse ASYNC event "container_removed" to cleanup user_group tables.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
They are now implemented by the plugin.
Also, dropped threadinfo::m_category, unused.
Finally, dropped `sinsp_observer::on_resolve_container`.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
* driver/CMakeLists.txt (DRIVER_SOURCES): Add missing headers.
* userspace/libsinsp/test/CMakeLists.txt (unit-test-libsinsp): Link to
libgrpc++ to avoid a missing DSO error.
* userspace/libscap/CMakeLists.txt: Do not hardcode STATIC type for
scap_event_schema and scap_platform libraries, so as to install
them (they are referenced in the pkg-config files).
Fixes: #1820
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
The generated pkg-config files of libscap and libsinsp now makes use
of pkg-config Requires and Requires.static fields, which should reduce
over-linking when linking to shared libraries.
* cmake/modules/BuildPkgConfigDependencies.cmake
(add_pkgconfig_library): Add debug messages and fix an issue where
IN_LIST had no effect.
* cmake/modules/libscap.cmake: Move pkgconfig dependency computation
to, pkg-config file configuration to...
* userspace/libscap/CMakeLists.txt: ... here, conditionally
accumulating Requires and Requires.private values.
* userspace/libscap/libscap.pc.in (prefix): Set directly to
CMAKE_INSTALL_PREFIX.
(Requires, Requires.private): New fields.
* userspace/libsinsp/CMakeLists.txt: Separate libraries into
pkg-config Requires and Requires.private lists. Add the pkg-config
requirements to the ignored link dependencies, since these are now
recorded as Requires in the pkg-config file.
* userspace/libsinsp/libsinsp.pc.in (Requires): Add
@LIBSINSP_REQUIRES@.
(Requires.private): New field.
(Libs): Remove -lsinsp, automatically computed in SINSP_PKG_CONFIG_LIBS.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
* userspace/libpman/libpman.pc.in: New file.
* userspace/libpman/CMakeLists.txt: Configure and install it along the
libpman header.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
This is to so that includes work whether using e.g. #include <scap.h>
or #include <libscap/scap.h>, and likewise for libsinp.
* userspace/libsinsp/libsinsp.pc.in (Cflags): Add include directive
for falcosecurity/driver.
* userspace/libscap/libscap.pc.in: Likewise. Also add include
directive for uthash.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Use anonymous unions in modern bpf driver. Moreover, add some debug prints to `pman_prepare_progs_before_loading`,
and always disable all unused programs autoload.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Try to inject each of them until success.
This allows us to inject `bpf_loop` sendmmsg and recvmmsg programs where supported,
and fallback at just sending first message where it isn't.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Make the CRI retry lookup configurable, this includes:
- maximum elapsed time
- number of retries
- maximum retry interval
Signed-off-by: Iacopo Rozzo <iacopo@sysdig.com>
Parse all control messages instead of parsing just the first one.
Leverage the new scap_get_fdinfo API to get info only from the file
in procfs associated to the file descriptor, instead of scanning each
time the entire procfs fd directory.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Co-authored-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
The API defined by libsinsp::state::base_table is about to be
removed (moved to libsinsp::state::built_in_table), so we introduce
a new API that's available for every table (including plugin-provided
tables), using the plugin table API underneath.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
This is an intermediate class in the hierarchy, that built-in sinsp
tables will inherit from, but plugin-provided table wrappers won't.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Kernel 6.3 changed fs functions to `struct mnt_idmap`.
Use the configure system in place of the version check to support driver
build on RHEL 9 (namely 5.14.0-547.el9.x86_64)
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
The spaces after the operator tokens were intended to indicate operators that mandate a whitespace character to be followed.
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
We can't use bpf_loop() helper since the `bpf_core_enum_value_exists` check
triggers a verifier failure on kernels prior to 5.13 that hadn't got `PTR_TO_FUNC` support.
See https://lore.kernel.org/bpf/CAGQdkDt9zyQwr5JyftXqL=OLKscNcqUtEteY4hvOkx2S4GdEkQ@mail.gmail.com/T/#u.
Instead, loop up to 16 messages.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
A new argument had to be added to the apply_dynamic_snaplen function, I
opted for using an auxiliar struct and pass a single pointer to it to
the function. I think this is a bit cleaner, since removing or adding
other arguments can be done by simply adding it to the struct, keeping
the function signature unchanged.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
The added fields were added in newer kernels and can be used to check
for access of some newer helpers.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
The current implementation is not complete, only the first message is
processed. In order to allow for multiple messages to be processed the
kmod needs to allow for multiple headers to be added to the ringbuffer
from the filler.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Due to limitations with the verifier, it won't be possible to iterate
over all messages, so the implementation is best effort and only the
first message is actually processed.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Instead, push them onto a queue owned by the inspector to be later called,
1 by 1, as requested.
This ensures that the whole libsinsp state has been processed,
even by plugins, before sinsp_observer methods are called.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Currently when a thread from a thread group is doing execve, we expect
that the kernel will reassign its tid at the end to the group leader,
and simulate this behavior in the parser accordingly. The final result
is all the threads in the thread group, except the leader, are removed
from the cache.
But looks like under certain circumstances it's possible to end up in a
situation when the kernel is not doing the reassignment, yet the syscall
ends successfully. This leads to a crash, since the parser removes the
thread associated with the execve_x event, which will be accessed later
during post processing -- and everything is expose in use-after-free.
It's hard to reproduce artificially, but there are crash reports from
the field, demonstrating the problem and confirming the patch fixes the
crash. So far the issue was discovered only on ppc64le (Power10 to be
more precise).
To handle this, keep the event thread in place. Note, that tid here
comes from the BPF probe directly, where it's captured via
bpf_get_current_task/_btf. This means that the tid is the one really
reported by the kernel, so keeping it represents the current state
precisely.
Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com>
Also, avoid subscribing to container manager "container removed" callback;
instead, use same RAII object to check whether init pid for the container did exit.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
We cannot rely anymore on the event number to search an event since we
could filter some enter events in the middle
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
We now expect `PPME_ASYNCEVENT_E` whose `name` matches one of the
plugin supported ones (get_async_events() API).
The new API is not required for async capability.
Added also a test.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
m_n_proc_lookups was incremented before doing the proc lookup, causing
<Reached max process lookup number, duration=0ms> logs when max is
configured to 1.
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
Firstly, properly refresh m_arginfo and m_customfield type and print format
given current event while extracting rawarg values.
Secondly, propelry support PT_FLAGS, PT_ENUMFLAGS, PT_GID and PT_UID types in `rawval_to_json` and `rawval_to_string`.
Lastly, honor PF_HEX print format for 8,16,32bits types.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Building with Red Hat g++ 11.2.1-9 we get the following error on string
assignment:
```
[ 34%] Building CXX object libsinsp/CMakeFiles/sinsp.dir/container_engine/libvirt_lxc.cpp.o
In file included from /opt/rh/devtoolset-11/root/usr/include/c++/11/ios:40,
from /opt/rh/devtoolset-11/root/usr/include/c++/11/ostream:38,
from /opt/rh/devtoolset-11/root/usr/include/c++/11/bits/unique_ptr.h:42,
from /opt/rh/devtoolset-11/root/usr/include/c++/11/memory:76,
from /code/agent/deps/agent-libs/userspace/libsinsp/container_engine/container_engine_base.h:21,
from /code/agent/deps/agent-libs/userspace/libsinsp/container_engine/libvirt_lxc.h:24,
from /code/agent/deps/agent-libs/userspace/libsinsp/container_engine/libvirt_lxc.cpp:19:
In static member function 'static constexpr std::char_traits<char>::char_type* std::char_traits<char>::copy(std::char_traits<char>::char_type*, const char_type*, std::size_t)',
inlined from 'static void std::basic_string<_CharT, _Traits, _Alloc>::_M_copy(_CharT*, const _CharT*, std::basic_string<_CharT, _Traits, _Alloc>::size_type) [with _CharT = char; _Traits = std::char_traits<char>; _Alloc = std::allocator<char>]' at /opt/rh/devtoolset-11/root/usr/include/c++/11/bits/basic_string.h:3464:21,
inlined from 'std::basic_string<_CharT, _Traits, _Allocator>& std::basic_string<_CharT, _Traits, _Alloc>::assign(const _CharT*, std::basic_string<_CharT, _Traits, _Alloc>::size_type) [with _CharT = char; _Traits = std::char_traits<char>; _Alloc = std::allocator<char>]' at /opt/rh/devtoolset-11/root/usr/include/c++/11/bits/basic_string.tcc:701:13,
inlined from 'std::basic_string<_CharT, _Traits, _Allocator>& std::basic_string<_CharT, _Traits, _Alloc>::assign(const _CharT*, std::basic_string<_CharT, _Traits, _Alloc>::size_type) [with _CharT = char; _Traits = std::char_traits<char>; _Alloc = std::allocator<char>]' at /opt/rh/devtoolset-11/root/usr/include/c++/11/bits/basic_string.tcc:689:5,
inlined from 'std::basic_string<_CharT, _Traits, _Alloc>& std::basic_string<_CharT, _Traits, _Alloc>::assign(const _CharT*) [with _CharT = char; _Traits = std::char_traits<char>; _Alloc = std::allocator<char>]' at /opt/rh/devtoolset-11/root/usr/include/c++/11/bits/basic_string.h:4461:21,
inlined from 'std::basic_string<_CharT, _Traits, _Alloc>& std::basic_string<_CharT, _Traits, _Alloc>::operator=(const _CharT*) [with _CharT = char; _Traits = std::char_traits<char>; _Alloc = std::allocator<char>]' at /opt/rh/devtoolset-11/root/usr/include/c++/11/bits/basic_string.h:3784:28,
inlined from 'bool libsinsp::container_engine::libvirt_lxc::match(sinsp_threadinfo*, sinsp_container_info&)' at /code/agent/deps/agent-libs/userspace/libsinsp/container_engine/libvirt_lxc.cpp:51:17:
/opt/rh/devtoolset-11/root/usr/include/c++/11/bits/char_traits.h:437:56: error: 'void* __builtin_memcpy(void*, const void*, long unsigned int)' writing 14 bytes into a region of size 7 overflows the destination [-Werror=stringop-overflow=]
437 | return static_cast<char_type*>(__builtin_memcpy(__s1, __s2, __n));
| ~~~~~~~~~~~~~~~~^~~~~~~~~~~~~~~~~
```
Let's just do a single assignment, and avoid eventual resize.
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
Default interesting syscalls set now avoids `read` and `pread` to avoid
back-pressure with `eventfd_read` being called at each loop iteration.
Moreover, `event_capture::run()` now accepts a ppm_sc_set parameter
to customize the sc set for the test.
Finally, in rlimit related tests, reset old limits upon leaving.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This fixes the `sys_call_test.container_libvirt` running on my machine.
Also, let event_capture always print capture stats for us.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
The `close` syscall might get lost leading to an infinite loop; instead,
now we ask to the main thread to leave using thread safe eventfd,
and the main thread will dequeue all remaining events until an error
is returned by sinsp::next.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
When using bundled dependencies, we install their headers into
.../include/falcosecurity, so we do not need to generate a fancy
include path. This way we don't leak the build-time include paths
to dependencies in the generated pkgconfig files.
When we're not using bundled dependencies, we still need to add their
include paths to ours though, so keep doing that (for the three
dependencies: tbb, curl, jsoncpp, that are actually used in any
headers).
The elephant in the room is gRPC (with its dependency absl), which we
don't install at all but also have never put in LIBSINSP_INCLUDE_DIRS,
so this patch doesn't make things worse: including pkgconfig-installed
sinsp headers that depend on gRPC didn't work before and doesn't work
now either.
The real fix would be to stop installing them (they're not really
public), but reviewing all headers for public/private status is out
of scope for this PR.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
I must be the only one for whom building gvisor in a shared library
fails (or maybe the only one actually trying to do this), but I can't
see how it could compile. We need to:
* privately link the object library with scap_platform_util to pick up
its includes
* publicly link with gRPC (and other dependencies) to ensure correct
linking order
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Unify the implementation between libscap and libsinsp, recursively
descend into dependencies to build the whole tree (while avoiding
the scap->scap_engine_gvisor->scap cyclic dependency) and skip
static libraries linked by shared libraries (they do not need to be
linked again when building the final binary).
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
The provided patch is great to fix large formatting errors, however, it
would be nice for CI to also show the diff for smaller changes that
could be directly typed without having to download the patch.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
otherwise test will give wrong result if compiler has -Werror flags,
complained with:
error: unused variable 'g_ppm_class' [-Werror=unused-variable]
Signed-off-by: Z. Liu <zhixu.liu@gmail.com>
Simplified a bit the whole logic.
Updated events_fspath tests adding the `PPM_O_DIRECTORY` flag as needed.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Luca Guerra <luca@guerra.sh>
The correct type is PT_FLAGS, not PT_ENUMFLAGS, as FUTEX_PRIVATE_FLAG
and FUTEX_CLOCK_REALTIME are bitwise-or'ed with the other values.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
This is a very small change that should have no major impact on how the
build works. However, when using ccache, having the clang executable
resolve to the real path completely breaks compilation for the modern
probe.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Instead, rely on the user running the benchmark to eventually provide `--benchmark_repetitions` CLI arg.
Provide `--benchmark_repetitions` CLI arg for perf CI.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
`mutex.h` already has a nice abstraction that allows exclusive access to
an object. This change extends that paradigm to allow similar simple
function calls that allow read/write locking primitives using a
`shared_mutex`.
Signed-off-by: Sahas Panda <sahasranshu.panda@sysdig.com>
Rather than passing the mode directly, introduce a new enum that
describes both the mode and the platform to use.
Fixes: #2281
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
This is a minimal Linux platformm intended to be useful with source
plugins that do not handle syscall data but still want access to some
info about the machine they're running on. Currently collected data
includes:
- machine info
- agent info
- interface list
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
This change splits configuration of the static container data away from
the sinsp constructor and into a separate set_static_container method.
The motivation behind this change is two fold:
- Configuration of other container engines is handled by a call to
set_container_engine_mask() before starting the inspector, the new
method is closer to this implementation.
- Enabling metrics collection should not require adopters to pass in 4
unrelated arguments to the sinsp constructor.
These changes will require some modifications into the Falco main repo,
as far as I can tell they should be relatively straight forward.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Modifying parse_ipv4_addr function to ensure that the IP address is correctly parsed and combined into a 32-bit integer of the correct byte order for Big-Endian systems.
Modifying the convert_to_string function to extract the bytes in the correct order for Big-Endian systems.
Signed-off-by: Soham Munshi <Soham.Munshi@ibm.com>
Pass `--parallel` to `cmake --build`. This requires CMake 3.12, but that
shouldn't be a problem on the affected runners.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
Create two expressions with the same lhs/rhs but different ops, and
ensure that is_equal() returns false.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
Fix a bug in binary_check_expr::is_equal()--the comparison should also
compare the operators in addition to both sides.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
Set CMAKE_POLICY_DEFAULT_CMP0091, CMAKE_MSVC_RUNTIME_LIBRARY,
and CMAKE_BUILD_TYPE when we configure zlib, similar to our other
dependencies.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
This is an alternative to the original implementation. Instead of using
capturing lambdas that get called back after some additional work is
done, we use classes and gather data during instantiation of the object.
This approach should be a lot more straight forward and it also doesn't
create unneeded objects when there's no need to do so.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Build zlib using CMake on Windows instead of nmake. The nmakefile passes
"-base:0x5A4C0000" to the linker, which is too small on Arm64 and not
really needed or wanted on any platform these days.
https://github.com/madler/zlib/issues/325
Signed-off-by: Gerald Combs <gerald@wireshark.org>
For now, this means that metrics that require `m_sinsp_stats_v2` will be automatically skipped when it is disabled.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Properly keep a reference on m_sinsp_stats_v2 where needed, instead of fetching it every time.
Moreover, improve perf in `sinsp_utils::ts_to_string`: cache `gmt2local` result instead of fetching it every time as it is an heavy operation.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Added a check on new leaks for heaptrack checks;
moreover, changed perf checks to run against
sum of diffs, that is more stable and useful.
Ie: if part of logic gets moved from one method to another,
we expect eg: method_A -> -7%, method_B -> +7%.
Before, this triggered the CI error; now it does not, since the sum is 0.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
4096 bytes are not enough for long verifier logs, we need to use the
same dimension provided by libbpf (UINT32_MAX >> 8)
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
It will be ran by perf CI on PRs and pages CI on master.
Also, add a new gh pages section with flamegraphs built from master.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Note, this is a potential breaking change due to the type of the exported field needing to change.
However, whoever tried to access this information up until now have accessed random byte blobs, so
this is effectively breaking something that never worked since its first release.
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Include cri.hpp in container.cpp in order to avoid
```
/usr/bin/ld: /usr/lib/aarch64-linux-gnu/libsinsp.so: undefined reference to `libsinsp::cri::cri_interface<libsinsp::cri::cri_api_v1>::get_cri_runtime_type() const'
collect2: error: ld returned 1 exit status
```
when building with shared libs on Linux.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
In scap.h, we have a couple of quite generic macros called IN and OUT
that can very easily leak into adopter's code bases and wreak havoc.
From my understanding, these macros are only used for documenting which
parameters in a function are input and which are output. Since they are
not consistently used, only appear in a handful of places in the
codebase and the preprocessor is the devil's spawn, we should replace
these macros with proper doxygen style string docs.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Co-authored-by: Olivier Valentin <ovalenti@redhat.com>
* Optimize memory allocations for static fields
* Ground work for supporting subtable access and complex state types
* Inlining functions wherever possible
* Improve checks in static and dynamic state fields defintions
* Expose new fields in thread infos
Co-authored-by: Gianmatteo Palmieri <mail@gian.im>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
For now, we exclude all fields that are internally-implemented with custom compare functions,
as it would get too ambiguous to define their behavior, and would become hard to maintain/debug.
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Luca Guerra <luca@guerra.sh>
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Luca Guerra <luca@guerra.sh>
Call gzclearerr if gzread returns fewer bytes than expected. This lets
us "tail" a file being written by another process.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
This commit handles `args` >= 4096. We always add a `\0` at the end of
the args even in case of partial reads. Moreover this changes uniform
the modern probe behavior with other drivers, before this commit we have
a max len of 4096 for `exe` and other `4096` for args. After this change
`exe + args` should be <= 4096
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Instruct `push__charbuf` to send a single `\0` when the unsafe pointer
points to an empty string `""`. Doing it inside `push__charbuf` avoid
extra ad-hoc code in various places
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
sinsp_threadinfo contains two fields with user and login_user
information. Since those fields are of scap_userinfo type and statically
allocated, they take a lot of space:
scap_userinfo m_user; /* 368 2312 */
scap_userinfo m_loginuser; /* 2680 2312 */
which is 4624 bytes out of 5728 for the whole sinsp_threadinfo:
/* size: 5728, cachelines: 90, members: 64 */
Most of this memory is coming from the fields name
(MAX_CREDENTIALS_STR_LEN), homedir and shell (both SCAP_MAX_PATH_SIZE).
For a process-heavy workload this can mean a lot of memory taken for
these purposes.
To make memory management more flexible, split m_user/m_loginuser into
two set of fields:
* one containing uid/gid, which are ubiquitous and generally used
everywhere
* one for the rest of heavy details, which are needed less often
The new sinsp_userinfo class is not supposed to use separately from
sinsp_threadinfo, thus it's defined inside the class.
Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com>
The `sys_call_test.forking_clone_fs` e2e test makes the assuption that,
if a children closes a file descriptor, the parent trying to close
the same file descriptor will get an error. This seems not to be
always the case. As the man says `It is probably unwise to close
file descriptors while they may be in use by system calls in other
threads in the same process. Since a file descriptor may be reused,
there are some obscure race conditions that may cause unintended side
effects.`
Given that we'll disable it upon further investigation.
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
The first transformations implemented are:
- `tolower`: converts to lower case fields of type string or path
- `toupper`: converts to upper case fields of type string or path
- `b64`: decodes with b64 a string or a byte buf
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Having `extract` methods all with the same name bacame confusing both to develop on and to review.
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Luca Guerra <luca@guerra.sh>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Fillers were removed because they are usually related to the SCHEMA_VERSION.
`ppm_events_public.h` was added due to IOCTL codes.
Also, the addition of bpf maps usually affects the API.
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
The schema version patch number should be incremented when code changes don't break compatibility (e.g. bug fixes in filler code)
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
the configure subsystem currently relies on
clang and llc being available.
However, building drivers in a containerized
environment might actually want to leverage
a specific CLANG version.
So just like we did for CC on the kmod driver,
have those variables passed over to the
configure subsystem.
Signed-off-by: Gerlando Falauto <gerlando.falauto@sysdig.com>
For example, <linux/net.h> defines the constants as enum variants,
not as preprocessor macros, making the original code work by accident
(because SHUT_* are the same as PPM_SHUT_*).
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
The cache implementation was broken (a no-op, effectively) but even
after fixing it doesn't provide noticeable performance wins.
Revert it and save a bit of complexity.
This reverts commit 6a9a0ec14d.
Fixes: #1724
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Basically, `scap_get_fdlist()` called in the sinsp parsers loop to manage SCM_RIGHTS flag for recvmsg,
updates the pointers in the thread fdtable.
After #1637, doing so invalidates `event` m_fdinfo field, that is a pointer to a now freed data.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
In Debian 12 we have `CC= gcc-12`, so we have to wrap it in quotes when
setting it to the configure system env
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
Honor Prometheus standards (https://prometheus.io/docs/practices/naming/ or https://prometheus.io/docs/practices/naming/#base-units),
except keep libbpf stats metrics and timestamps in nanoseconds to avoid precision loss when converting them to seconds. Note that the standards are recommendations and not requirements,
and not even cAdvisor always adheres to them. The Prometheus community acknowledges that the standards do not always fit the use case at hand.
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Separation of concerns: new metrics_converter subclasses
Rename the following metric names for consistency:
cpu_usage_perc_total_host -> host_cpu_usage_perc
memory_used_host -> host_memory_used_kb (or host_memory_used_mb if unit converted)
procs_running_host -> host_procs_running
open_fds_host -> host_open_fds
memory_rss -> memory_rss_kb (or memory_rss_mb if unit converted)
memory_pss -> memory_pss_kb (or memory_pss_mb if unit converted)
memory_vsz -> memory_vsz_kb (or memory_vsz_mb if unit converted)
container_memory_used -> container_memory_used_bytes (or container_memory_used_mb if unit converted)
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
* simplifies consuming metrics; now combines libscap and libsinsp metrics into one vector
* type of metrics uniformely gated via pushing flags down (as previously)
* easier memory management
* use std::vector as data structure for m_metrics for safer management; this also helps reduce the knowledge the client needs about the metrics or the number of possible metrics; client can just loop over metrics and gate actions based on the metrics string name etc
* changes do not affect the hot path and performance is not of primary concern
* previous metrics preserved; only code refactor
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
The fields returned by a plugin can be a static string and the plugin
framework doesn't have any business in modifying it so let's make it
const (to avoid a copy for plugins that can return a static string).
Note: I only bump the plugin API version by 0.0.1 since the changes
in this PR do not affect binary compatibility in any way.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Technically, this PR does change the schema, not just
the implementation, but all the changes are ABI-compatible and do not
affect driver<->userspace compatibility.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
We had finit_module_flags_to_scap defined but we did not have
the corresponding flag table for userspace.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
This follows the pattern for inotify_init1 and eventfd2, where
the syscalls technically do define their own flags but the subset
we're interested in maps to file_flags directly.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Per the comment in f_sys_inotify_init_e:
/* We have nothing to extract from the kernel here so we send `0`.
* This is done to preserve the `PPME_SYSCALL_INOTIFY_INIT_E` event with 1 param.
*/
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Per the comment in f_sys_signalfd_e:
/* The syscall `signalfd` has no flags! only `signalfd4` has the `flags` param.
* For compatibility with the event definition here we send `0` as flags.
*/
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Per the comment in f_sys_eventfd_e:
/* The syscall eventfd has no flags! only `eventfd2` has the `flags` param.
* For compatibility with the event definition here we send `0` as flags.
*/
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Apparently my compiler (gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0)
does not like initializing structs with {0} at all.
Honestly, I'm not convinced this is valid C++ either, though I'm
pretty sure it is valid C. E.g. this page:
https://en.cppreference.com/w/cpp/language/zero_initialization
does not mention {0} as a valid way to zero-initialize a struct.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Trust the kmod configure system for `ppm_devnode`, and drop
PPM_RHEL_RELEASE_CODE checks.
Fixes fedora-5.17 build, failing because of RHEL release version 9.99
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
When installing a new kernel, dkms would build the module for it, but
with KERNELDIR defined with `uname -r` the compilation will likely fail.
Define it with the current kernel headers only when the makefile is used
directly, and rely on the make current directory otherwise (coming from
make -C ...).
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
RHEL8.9 kernels (4.18.0) have an inconsistent behavior in that
the first releases (up to ~500) do NOT include the backported
change, which was however included from a certain point on.
The previous implementation empirically (but wrongly) assumed
that all RHEL8.9 kernels would have the patch, so the first
ones would not compile.
Now that we have a dynamic discovery mechanism, we can drop
this assumption and leverage HAS_DEVNODE_ARG1_CONST.
Notice how this includes a revert of:
commit 977f946e31
Author: Gerlando Falauto <gerlando.falauto@sysdig.com>
Date: Wed Aug 2 14:22:37 2023 +0200
fix(driver): fix build on RHEL 8.9 kernels
Signed-off-by: Gerlando Falauto <gerlando.falauto@sysdig.com>
Co-authored-by: Angelo Puglisi <angelo.puglisi@sysdig.com>
- embellish the output with a '[configure]' prefix
- show the make output of the configuration step
(notice it will be squashed into a single line)
Signed-off-by: Gerlando Falauto <gerlando.falauto@sysdig.com>
Co-authored-by: Angelo Puglisi <angelo.puglisi@sysdig.com>
Introduce a new mechanism for conditional build in the kernel module,
documented in driver/README.configure.md
Apply such mechanism to `ppm_access_ok`, easily detecting if `access_ok`
is the old version with 3 parameters or the new one with just two.
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
* Now more precise, logical and clean, set STARTED at the beginning
and SUCCESSFUL at the end of `parse_container_json_evt` if and only if
the container image was successfully retrieved and present before calling
`add_container` or if it's a pod sanbox container.
* In `lookup_sync` we previously set the lookup_status to SUCCESSFUL, which can be
avoided to have a more consolidated and clean behavior in `parse_container_json_evt`.
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
PR falcosecurity#943 has introduced ability to exclude a set of
tail-called programs from loading. Yet current such excluded program
will generate an error message, which could be misleading. Extend the
logging infrastructure to be able to use a specified log level and
downgrade the message to the debug level.
Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com>
Set CMAKE_MSVC_RUNTIME_LIBRARY to "MultiThreaded" unless it was set
externally or if we're building shared libs. This
- uses CMake's documented variable to control CRT linking.
- ensures that we use the static CRT by default.
- allows the CRT setting to be overridden.
Add a Windows shared CRT CI job.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
If we're using CMake 3.15 or later, select our Visual C++ runtime using
CMAKE_MSVC_RUNTIME_LIBRARY. Otherwise use FALCOSECURITY_LIBS_DEBUG_FLAGS
and FALCOSECURITY_LIBS_RELEASE_FLAGS.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
This will hopefully accomodate the Windows runners of our CI,
which seem to produce ~64 elements per second :/
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
recent updates to the driver broke the driver build for very
ancient 2.6.32 kernels on CentOS 6 (e.g. 2.6.32-71.24.1.el6):
socketcall_to_syscall.h:208:7: error: 'SYS_SENDMMSG' undeclared (first use in this function)
case SYS_SENDMMSG:
^
So add the appropriate preprocessor guards to get it to compile.
Signed-off-by: Gerlando Falauto <gerlando.falauto@sysdig.com>
* Allow for more flexibility in adoption as truncated IDs can cause collisions
* Considered as feature completeness
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
* k8s.pod.id incorrectly sends the pod uid which is a different identifier. Note that this is not a refactor nor a change intended for semantic adjustments, it is a bug.
* introduce k8s.pod.uid instead so the uid field is still accesible
* do not yet refactor the container engine and continue extracting these fields from the container labels
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
This loops through all filtercheck fields, creates a check, and
verifies that can_have_argument() only returns true for those checks
with EPF_ARG_* flags.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
Add EPF_ARG_ALLOWED flags to fields that can have arguments. This
will result in more accurate info about the field and will ensure that
filterchecks for these fields can not be cached.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
Add a can_have_argument() method that checks the flags for the field
for either EPF_ARG_REQUIRED/EPF_ARG_ALLOWED.
When can_have_argument() is true, skip caching of both extractions and
comparisons. This ensures that two fields that are the same but have
different arguments are not mistakenly cached together.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
Set the various paths in our .pc files based on the `pcfiledir` variable
instead of using absolute paths. This should make it possible to install
using a DESTDIR that differs from CMAKE_INSTALL_PREFIX.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
The CRI differentiates the normal containers from the pause container. The pause container
is the same as the "pod sandbox". In the CRI context the "pod sandbox" is the only place
where the labels of the pod (as in kubernetes pod) are set. When handling a "pod sandbox"
we populate the the labels field that are extracted when the "k8s.pod.labels" field is needed.
At the same time we make sure that the normal containers have a special label, "io.kubernetes.sandbox.id=podSandboxID".
The special labels is used by the filterchecks to retrive the right "pod sandbox" and then get its labels.
Signed-off-by: Aldo Lacuku <aldo@lacuku.eu>
Event extraction can be cached based on the event number. Add a setter
so that externally constructed events can be cached correctly.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
In a scap file I have here, minfo->num_cpus is 0 when
sinsp_filter_check_thread::extract_exectime is called. We handle this in
debug builds with an ASSERT, but need to check for this in release
builds as well. Bail out early if we either have no CPUs or if minfo is
NULL.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
The modern BPF driver maps the SYS_ACCEPT to SYS_ACCEPT4 which is being
tested in the socketcall SYS_ACCEPT tests.
The kmod and bpf drivers do not switch directly but rather ensure to
use the PPM event instead of syscall. The socketcall SYS_ACCEPT tests
contain a specific handling for kmod. Enable this handling to also for
the bpf driver.
Signed-off-by: Hendrik Brueckner <brueckner@de.ibm.com>
Commit a094db8f "cleanup: align modern bpf behavior with other drivers"
changed the drivers test in the system exit events. This commit also
ignores `socketcall`s with wrong call IDs in the system enter event
tests.
Signed-off-by: Hendrik Brueckner <brueckner@de.ibm.com>
LeakSanitizer: detected memory leaks
Direct leak of 8 byte(s) in 1 object(s) allocated from: ... 0x7f84317d54c8 in operator new(unsigned long) ../../../../src/libsanitizer/asan/asan_new_delete.cpp:95 ... 0x56319abb44cc in sinsp_dns_manager::match(char const*, int, void*, unsigned long) /build/falcosecurity-libs-repo/falcosecurity-libs-prefix/src/falcosecurity-libs/userspace/libsinsp/dns_manager.cpp:121
add destructor to class sinsp_dns_manager to ensure m_resolver is always released when the object goes out of scope
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
ERROR: AddressSanitizer: SEGV on unknown address 0x000000001578 ... The signal is caused by a WRITE memory access. #0 0x56074dd65dc8 in sinsp_parser::parse_connect_exit(sinsp_evt*) /build/falcosecurity-libs-repo/falcosecurity-libs-prefix/src/falcosecurity-libs/userspace/libsinsp/parsers.cpp:3361
Plus refactor few parsers to feature early returns if evt->m_tinfo is a nullptr
Remove some inconsistent debug ASSERT statements
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Uniformed: modern-bpf was already doing that after all.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: brandonxin <brandonxin@tencent.com>
* make m_sinsp_stats_v2 a smart pointer initialized only when enabling sinsp_stats_v2 counters
* only keep m_inspector nullptr check for `sinsp_thread_manager::remove_thread(int64_t tid)`
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
- Get container cache stats via hijacking the periodic container cache flush functionality
- Includes some general cleanup
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
- Finalize exposing valuable legacy libsinsp stats / metrics / counters related to the sinsp state tables (e.g. adding, removing, storing, failed lookup activities) to the consolidated libsinsp stats
- Add counter of currently cached containers as well
- Includes additional cleanups
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
- Prepare m_sinsp_stats_v2 buffer to hold more stats and metrics than resource utilization metrics
- Expand resource utilization metrics (e.g. include overall host CPU and memory usages)
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
It was always unclear (to me) what the proclist is used for, exactly.
It turns out it's just a holder for the callback which was ignored
in the previous implementation and now is replaced by a completely
different temporary proclist.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Threads from captures are now imported directly into the sinsp
thread table, so we do not need a separate processing step
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
* use proc callback in open_savefile; We need to handle tinfo==nullptr
when adding fds
* always pass threads_from_sinsp=true to sinsp_dumper::open
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
We can now mark a sinsp threadinfo as filtered out and use this flag
instead of relying on the scap one
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
jq's build system passes it to gcc, which then promptly fails
to compile anything as -all-static isn't a valid gcc option.
We still see mto build a fully static libjq.a, so nothing's
broken, at least at a glance.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Enabling this changes the behavior of timestamps for
downloaded/extracted file timestamps, but more importantly
avoids a ton of cmake warnings during build.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Rather than relying on the platform pointer from the main scap_t
handle, keep a pointer in the savefile engine params.
Apart from removing a dependency on scap_t->m_platform (just about
the only real one), int underscores the fact that the savefile
engine absolutely needs a platform to function properly.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Restore CMAKE_MAKE_PROGRAM for grpc, since it gets built with cmake and
inherits the generator
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
Exposing the list of container engines allows for more control over what
is loaded. This would allow adopters to load custom container engines
that might not fit in Falco.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Co-authored-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Yes, the strl* functions are used in libsinsp too, but that
doesn't make them too different from all the other helper
functions.
Eventually this could become a tiny library of its own but we're
not quite there yet.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
When CMAKE_GENERATOR is Ninja, CMAKE_MAKE_PROGRAM is ninja, and all the
ExternalProject_Add commands utterly fail.
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
scap_mode_t is now named sinsp_mode_t to reflect that it's not used
in libscap at all, and all the enum values are renamed from SCAP_MODE_*
to SINSP_MODE_*
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
libscap doesn't need it any more and sinsp can pass it to the only
place that needs it (sinsp::open_common) directly.
Note: we could just also set m_mode in the individual sinsp::open_*
methods but this way we save a tiny bit of code duplication.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
AS of now, libscap doesn't know anything about selecting engines
or platforms and defers this to sinsp (or the consumer, when using
scap directly)
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Note: we also allow having no platform at all, even though some
engines, notably savefile, won't work without a platform
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
We now have:
- scap_handle_alloc_platform which chooses and allocates the right
platform based on oargs
- scap_handle_init_engine which chooses and initializes the right
engine based on oargs
- scap_init which ties the two together
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
We no longer need to run scap_generic_init_platform before engine open
(proc callbacks are set up in the allocation phase), so pull it into
scap_platform_init and reduce the number of steps we have to do to open
a scap handle properly
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
The proc callbacks are the one part of the platform that needs to be
initialized very early (before the engine is open).
Move the proc callback setup to the allocation function so that we never
need to worry about the callback not getting set up early enough.
This isn't too pretty at an abstract level (we're mixing allocation
and a subset of initialization) but it's more practical this way.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
We want to decouple the engines from platforms further, so push
the common points higher up the call chain
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
The modern_bpf engine depends on scap_engine_util and scap_engine_noop
but they're not specified in its dependencies. Fix this.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
As opposed to the scap_suppress implementation, we only cache
tids (not hash tabe entries), because iterators pointing
at individual entries can get invalidated.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Note: this commit does not implement the suppressed tid cache.
It's in the next commit for easier review of the cache-specific
parts.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
An unusual syntax of the declaration of a constructor (`libsinps::events::set<T>()`) raises a
warning when the compiler is gcc-11 and the build is done with C++20.
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Federico Aponte <federico.aponte@sysdig.com>
Such messages might end up flooding kernel logs.
Silence them unless the "verbose" module parameter is enabled.
Also, add information about the consumer.
Signed-off-by: Jason Dellaluce <jasondellaluce@gmail.com>
Co-authored-by: Gerlando Falauto <gerlando.falauto@sysdig.com>
Doing these checks in the init method could cause some issues.
In the kernel module engine, an old driver with different IOCTL codes
could be loaded and if we use IOCTL codes before checking the
compatibility we could face a not user friendly error. For this reason,
we move this `mark_syscall` check when the `check_api_compatibility`
method is already called by scap.
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
The event flags are (currently) specific to the savefile engine
but accessing them requires an awkward reacharound through
a dedicated vtable method to a field stored on each call to next().
We can simplify this a bit and express the intent better by simply
returning the flags from next() via an out pointer.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
The device id does not necessarily correspond to the CPU id even
for the kmod engine (when CPUs are offline). Rename the parameter
to match reality a bit better.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
- Implement event handlers for recently-added gVisor native events, including WRITE
- Enhance event handlers to explicitly document which SCAP event fields are invalid
(e.g. where info is not provided by the native gVisor event)
- Improve gvisor config generator, to configure all fields needed by the event
parser, and only those fields
- Zero fill allocated scap_gvisor_platform structure, to avoid crash on startup
- Return SCAP_TIMEOUT instead of SCAP_EOF on interrupted socket read
- Add new gvisor parser unit tests for new event handlers; and fix existing unit
tests to reflect updated functionality of existing event handlers
Signed-off-by: Joseph Pittman <joseph.pittman@sysdig.com>
Moving `extract__network_args` before the ringbuf initialization keeps
the `ringbuf` variable into BPF registers.
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Modern bpf was not affected since it has no PPME_ event fallback for socketcall extraction logic.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
The behavior of these syscalls is different between modern bpf (whose jump table is syscalls-indexed),
and other drivers (whose jump table is events-indexed).
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
We don't need either CAPTURE_SOCKETCALL nor _HAS_SOCKETCALL anymore.
Moreover, added support for x86 ia32 socketcall for modern bpf.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Since we do not use a 32bit syscall table anymore.
Moreover, moved `socketcall_code_to_syscall_code` to its header file making it `static inline`,
allowing its usage in old bpf probe too.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This allows us to properly use `-1` (ie: an invalid syscall number) as a canary value,
instead of using `0` that, on x86_64, is `read` syscall.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
A 64bit process that execve's to a 32bit one (eg: a bash shell that executes a 32bit executable),
will receive the execve exit event as 64bit event, even if the compat flag is already set
on the task.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
This is that kmod already supported. Start with feature parity then eventually expand to support
compat binaries on all supported architectures.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Use it in old bpf probe to dynamically load the converting map between x32 and x64 syscall numbers.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Add build-shared-libs-macos-amd64 based on build-libs-others-amd64 which
builds and tests shared library support on macOS.
Windows will require some nontrivial work.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
For most use cases, bpftool version checking works fine, However, when
using bpftool compiled from a kernel with backported patches, the
version might not be the most reliable way to see if the required
capabilities are avilable. As an example, RHEL 8.8 uses a bpftool with
versions that match 4.18, but because of it having backported patches
the modern probe can be compiled without errors. With this patch we move
from checking a specific version to trying to catch if bpftool supports
the gen command.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
kernel_tests becomes a reusable workflow; pages is now triggered on master pushes and uses
the reusable_kernel_tests workflow.
release-body-driver is now triggered on github releases events only for releases set as "latest",
and calls the reusable_kernel_tests workflow.
release-body-libs is triggered on github releases events only for releases set as "latest".
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Moreover, made kmod loop more robust too.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
Historically, the minimal build was only able to run using the kernel
module driver, but since the addition of the modern probe this has also
become an option for running with minimal builds. I believe there's
value in allowing adopters of the libs to use the minimal build with the
eBPF probe.
This change means that scap will always be linked against zlib and
libelf, but I believe this is a worthwhile trade off.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Make the base sinsp dependency scopes PRIVATE. This fixes compilation
here on macOS when BUILD_SHARED_LIBS=ON.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
Without this change, having multiple levels of cgroups nested result on
the path removing the /.. sections, but leaves the prefix locked at the
first slash that is found.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Add an escape clause on the container lookup path to make sure we're not just constantly getting timeouts.
/kind bug
/area libsinsp
```release-note
NONE
```
Signed-off-by: Nathan Baker <nathan.baker@sysdig.com>
Leverage `get_file_rcu` being a define to use the safer version of
`get_mm_exe_file`.
This will allow kernel versions prior to 4.1, but with the fix being
backported don't suffer RCU violations.
Co-authored-by: Joseph Pittman <joseph.pittman@sysdig.com>
Signed-off-by: Angelo Puglisi <angelo.puglisi@sysdig.com>
This should technically be controlled by the platform, but we're
not quite there yet, so as long as we have test_input setups
where threads may not have a main thread, disable this assert.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
They were logged as JSON parse errors before, but we can simply
print them without trying to parse them.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
This is *really* raw (basic header info and a hexdump
of each parameter) but it may come in handy any time we need
to go deeper in analyzing individual events.
Note: to get an actual raw dump, we could use two extra features:
* show the sentinel if available
* verify the total event length vs the lengths of all parameters
Note 2: I really couldn't be bothered to fight with C++ iostreams
to get a usable hex dump so I went for classic C stdio.
To do this, we'd need the access to the raw `scap_evt`, which
would violate the abstraction layering even more.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
The formatter output should be good enough now
Note: we keep the old format in JSON mode for e2e tests compatibility
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
This makes sinsp-example actually useful for looking at events
in non-JSON mode.
--output-fields-json now also affects plaintext output and has been renamed
to --output-fields.
The default output format has been trimmed too, removing the items that
are present in the default output format. Effectively this leaves only
the container id (or `HOST`) and the event category.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
is_valid_version = re.match(semver_no_meta, tag_name) is not None
if not is_valid_version:
print(f'Release version {tag_name} is not a valid full or pre-release. See RELEASE.md for more information.')
sys.exit(1)
is_prerelease = '-' in tag_name
# Safeguard: you need to both set "latest" in GH and not have suffixes to overwrite latest
is_latest = '${{ steps.latest_release.outputs.release }}' == tag_name and not is_prerelease
is_driver = "+driver" in tag_name
with open(os.environ['GITHUB_OUTPUT'], 'a') as ofp:
print(f'is_latest={is_latest}'.lower(), file=ofp)
print(f'is_driver={is_driver}'.lower(), file=ofp)
release-body-libs:
needs:[release-settings]
if:${{ needs.release-settings.outputs.is_latest == 'true' && needs.release-settings.outputs.is_driver == 'false' }}# only for latest releases and not driver ones
permissions:
contents:write
runs-on:ubuntu-latest
steps:
# Note: there is no `tag` filter for `workflow_run`.
# We need to manually check whether we are running on a tag.
option(USE_BUNDLED_DEPS"Enable bundled dependencies instead of using the system ones"ON)
option(MINIMAL_BUILD"Produce a minimal build with only the essential features (no eBPF probe driver, no kubernetes, no mesos, no marathon and no container metadata)"OFF)
option(MUSL_OPTIMIZED_BUILD"Enable if you want a musl optimized build"OFF)
option(USE_BUNDLED_DRIVER"Use the driver/ subdirectory in the build process (only available in Linux)"ON)
This document introduces the coding style that will be applied in this repository.
This coding style involves all the following files: `.c`, `.h`, `.cpp`, `.cmake`, `CMakeLists.txt`. To enforce it we rely on two main tools:
1. `clang-format` version `18.1.8`.
2. `cmake-format` version `0.6.13`.
> __Please note__: tools versions are important! Different versions will enforce slightly different changes on the code. For example `clang-format-18` will produce a slightly different output respect to `clang-format-17` always respecting the imposed style.
The coding style is expressed through the 2 configuration file that you find in this repo: `.clang-format`, `.cmake-format.json`.
### Enforce the style locally
There are many ways to enforce the style locally, here we will describe two of them:
1. Use `pre-commit` framework.
2. Use the repo `Makefile`.
#### 1.Pre-commit framework (suggested if you don't have the 2 tools already installed on your machine)
The `pre-commit` framework allows you to automatically install different `git-hooks` that will run at every new commit. More precisely, if you use the `.pre-commit-config.yaml` in this repo you will install 3 different hooks:
1. The `clang-format` hook: this is a `pre-commit` git hook that runs `clang-format` on your staged changes.
2. The `cmake-format` hook: this is a `pre-commit` git hook that runs `cmake-format` on your staged changes.
3. The `DCO signed-off` hook: this is a `pre-commit-msg` git hook that adds the `DCO` on your commit if not present. This hook is not strictly related to the coding style so we will talk about it in a separate section: [Add DCO signed-off to your commits](#add-dco-signed-off-to-your-commits).
Now let's see what we need to use `pre-commit` framework.
##### Step 1
Install `pre-commit` framework following the [official documentation](https://pre-commit.com/#installation).
> __Please note__: you have to follow only the "Installation" section.
##### Step 2
Once you have installed `pre-commit`, you don't need to install anything else! This is the good point of using a framework like `pre-commit`, all the tools necessary to format your code will be directly managed by the framework. But in order to be ready, you need to install the git hooks in your local repo.
This simple command allows you to install the two `pre-commit` git hooks, `clang-format` and `cmake-format`.
If you want to install also the `pre-commit-msg` git hook for the DCO you have to type the following command, but be sure to have configured all you need as said in the [dedicated section]((#add-dco-signed-off-to-your-commits))
In order to use the repo `Makefile`, you need to install on your local machine the two aforementioned tools:
__clang-format v18.1.8__
One of the easiest ways to install `clang-format` could be directly downloading its static binary from [here](https://github.com/muttleyxd/clang-tools-static-binaries).
There are other ways for example you can download the package for your distro or you can also build it from sources.
__cmake-format v0.6.13__
To install `cmake-format` you can follow the official documentation [here](https://cmake-format.readthedocs.io/en/latest/installation.html).
> __NOTE__: Please check the versions of the two tool with `clang-format --version` and `cmake-format --version`.
##### Step 2
Once you have installed the __right__ versions of the 2 tools, you can simply type `make format-all` from the root directory of the project (`/libs`) to format all your code according to the coding style.
Remember to do that before submitting a new patch upstream! 😁
#### Other solutions
Obviously, you can also install the 2 tools locally and enable some extension of your favorite IDE (like `VScode`) to format your code every time you save your files!
## Add DCO signed-off to your commits 🔏
### Introduction
Another requirement for contributing to the `libs` repository, is applying the [DCO](https://cert-manager.io/docs/contributing/sign-off/) to every commit you want to push upstream.
Before doing this you have to configure your git user `name` and `email` if you haven't already done it. To check your actual `name` and `email` type:
```bash
git config --get user.name
git config --get user.email
```
If they are correct you have done, otherwise, you have to set them:
>__Please note__: If you have problems in doing this you can read the full documentation [here](https://docs.github.com/en/get-started/getting-started-with-git/setting-your-username-in-git).
### Enforce the DCO locally
Now you are ready to sign your commits! You have two main ways to do this:
1. Manually with `git` tool.
2. Use the `pre-commit-msg` hook quoted before.
### Manually
To do this you just need to remember the `-s` while performing your commits:
```bash
git commit -s
```
or with the inline message:
```bash
git commit -s -m "my first commit"
```
### Use `pre-commit` hook
Here if you have already added the hook in the [previous section](#step-2), you have to do nothing otherwise you have to simply install the DCO hook with:
And you have done! Now you don't have to remember the `-s` option every time you commit something, the DCO hook will automatically add the DCO if you forget it! 😄
## Some best practices 📏
### Class variables
To know whether a variable belongs to a `class` or a `function`, we start member variables with `m_`.
Example:
```c
public int32_t m_counter;
```
### Global variables
To know whether the variable is global or not, we start globals with `g_`.
Example:
```c
int g_nplugins;
```
### Capitalization
The naming convention is camel-cased "Unix" style, i.e. always lower case. Words are separated by underscores.
Example:
```c
int32_t g_global_bean_counter;
int32_t count_beans();
```
and not,
```c
int32_t GlobalBeanCounter;
int32_t CountBeans();
```
### Packed Structures
Packed structures should use the GCC and MSVC-style supported `pragma`:
Example:
```c
#pragma pack(push,1)
struct frame_control
{
struct fields....
};
#pragma pack(pop)
```
### 64-bit constants
Put an `LL` at the end of your `64-bit` constants. Without the `LL`, some platform compilers try to interpret the constant on the right-hand side as a `long integer` instead of a `long long` and this could lead to an error at building time.
This repository contains **libsinsp**, **libscap**, the **kernel module** and the **eBPF probes** sources.
These components are at the foundation of [Falco](https://github.com/falcosecurity/falco) and other projects that work with the same kind of data.
This component stack mainly operates on syscall events. We monitor syscalls using either a kernel module or an eBPF probe, which we call *drivers*. On top of the drivers, `libscap` manages the data capture process, while `libsinsp` enriches the data, and provides a rich set of API to consume the data. Furthermore, these two libraries also implement a [plugin](https://github.com/falcosecurity/plugins) framework that extends this stack to potentially any other data sources. For further details, please refer to the [official documentation](https://falco.org/docs/).
This component stack mainly operates on syscall events. We monitor syscalls using either a kernel module or an eBPF probe, which we call *drivers*. On top of the drivers, `libscap` manages the data capture process, while `libsinsp` enriches the data, and provides a rich set of API to consume the data. Furthermore, these two libraries also implement a [plugin](https://github.com/falcosecurity/plugins) framework that extends this stack to potentially any other data sources. For further details, please refer to Falco's [official documentation](https://falco.org/docs/).
An image is worth a thousand words, they say:
@ -23,8 +22,7 @@ An image is worth a thousand words, they say:
* [_driver/_](./driver) contains kernel module and eBPF probe source code,
so-called **drivers**.
* [_userspace/_](./userspace) contains libscap and libsinsp libraries code,
plus chisels related code and common utilities.
* [_userspace/_](./userspace) contains libscap and libsinsp libraries code.
* **libscap** (aka lib for *System CAPture*) is the userspace library
that directly communicates with the drivers, reading syscall events from
the ring buffer (where drivers place them), and forwarding them
@ -34,9 +32,6 @@ plus chisels related code and common utilities.
libscap and enriches them with machine state: moreover, it performs
events filtering with rule evaluation through its internal rule engine.
Finally, it manages outputs.
* **chisels** are just little Lua scripts to analyze an event stream
and perform useful actions. In this subfolder, the backend code for
chisels support can be found.
* [_proposals/_](./proposals) unexpectedly contains the list of proposals.
* [_cmake/modules/_](./cmake/modules) contains modules to build
external dependencies, plus the libscap and libsinsp ones; consumers
@ -46,11 +41,13 @@ external dependencies, plus the libscap and libsinsp ones; consumers
Our drivers officially support the following architectures:
| | Kernel module | eBPF probe | Modern eBPF probe | Status |
To access up-to-date status reports on Falco drivers kernel testing, please visit this [page](https://falcosecurity.github.io/libs/). It provides a list of supported syscalls as well as the [report](https://falcosecurity.github.io/libs/report/).
@ -107,13 +104,13 @@ If you are building this project outside of a Git working directory, or if you w
<details>
<summary>Expand Build Instructions</summary>
For your convenience, we have included the instructions for building the `libs` modules here, in addition to the information available in the [official documentation](https://falco.org/docs/install-operate/source/). These instructions are designed for building and testing `libs` on your own Linux development machine. However, if you intend to adopt CI or build within containers, there are additional considerations to take into account. The official [website]((https://falco.org/docs/install-operate/source/)) continually extends its guidance in this respect.
For your convenience, we have included the instructions for building the `libs` modules here, in addition to the information available in Falco's [official documentation](https://falco.org/docs/install-operate/source/). These instructions are designed for building and testing `libs` on your own Linux development machine. However, if you intend to adopt CI or build within containers, there are additional considerations to take into account. The official [website]((https://falco.org/docs/install-operate/source/)) continually extends its guidance in this respect.
The project utilizes the `cmake` build system, and the key `make` targets are as follows:
* `driver` -> build the kmod
* `bpf` -> build the eBPF probe
* `scap` -> build libscap (`modern_bpf` driver will be bundled into `scap` if enabled)
* `bpf` -> build the legacy `ebpf` probe
* `scap` -> build libscap (`modern_ebpf` driver will be bundled into `scap` if enabled)
* `sinsp` -> build libsinsp (depends upon `scap` target)
* `scap-open` -> build a small example binary for `libscap` to test the drivers (dependent on `scap`)
* `sinsp-example` -> build a small example binary for `libsinsp` to test the drivers and/or `libsinsp` functionality (dependent on `scap` and `sinsp`)
@ -138,7 +135,7 @@ make sinsp
### Build userspace using system deps
To build using the system deps instead, first, make sure to have all the needed packages installed. Refer to the [official documentation](https://falco.org/docs/install-operate/source/).
To build using the system deps instead, first, make sure to have all the needed packages installed. Refer to Falco's [official documentation](https://falco.org/docs/install-operate/source/).
```bash
cmake -DUSE_BUNDLED_DEPS=OFF ../;
@ -149,29 +146,27 @@ make sinsp
### Build driver - kmod
To build the kmod driver, you need your kernel headers installed. Check out the [official documentation](https://falco.org/docs/install-operate/source/).
To build the kmod driver, you need your kernel headers installed. Check out Falco's [official documentation](https://falco.org/docs/install-operate/source/).
```bash
make driver
# Verify the kmod object code was created, uses `.ko` extension.
# Verify the kmod binary object file was created, uses `.ko` extension.
ls -l driver/src/scap.ko;
```
### Build driver - eBPF probe
To build the eBPF probe, you need `clang` and `llvm` packages and you also need your kernel headers installed. Check out the [official documentation](https://falco.org/docs/install-operate/source/).
To build the eBPF probe, you need `clang` and `llvm` packages and you also need your kernel headers installed. Check out Falco's [official documentation](https://falco.org/docs/install-operate/source/).
```bash
cmake -DBUILD_BPF=ON ../;
make bpf
# Verify the eBPF object code was created, uses `.o` extension.
# Verify the eBPF bytecode file was created, uses `.o` extension.
ls -l driver/bpf/probe.o;
```
>__WARNING__: **clang-7** is the oldest supported version to build our BPF probe.
Initial guidance for CI and building within containers: To build either the kmod or eBPF probe in a container, you will need to make the extracted kernel headers available. The [test/vm](test/vm/) directory contains example [scripts](test/vm/scripts/compile_drivers.sh) demonstrating how to pass them to the `make` command using the argument `KERNELDIR=${EXTRACTED_KERNEL_HEADERS_DIR}`. You can also use the [falcosecurity/driverkit](https://github.com/falcosecurity/driverkit) or explore the scripts within the driverkit repository. The mentioned resources also provide candidate builder containers.
### Build driver - modern eBPF probe
To build the modern eBPF probe, further prerequisites are necessary:
@ -196,13 +191,13 @@ To build the modern eBPF probe, further prerequisites are necessary:
> __NOTE:__ These are not the requirements to use the modern BPF probe, but rather for building it from source.
Regarding the previously discussed bpf drivers, they create a kernel-specific object code (`driver/bpf/probe.o`) for your machine's kernel release (`uname -r`). This object code is then used as an argument for testing with`scap-open` and `sinsp-example` binaries.
Regarding the previously discussed legacy eBPF driver, it generates kernel-specific bytecode (`driver/bpf/probe.o`) tailored to your machine's kernel release (`uname -r`). The location of the bytecode file can then be passed as an argument for testing with the`scap-open` and `sinsp-example` binaries.
However, the modern BPF driver operates differently. It doesn't require kernel headers, and its build isn't tied to your kernel release. This is enabled by the CO-RE (Compile Once - Run Everywhere) feature of the modern BPF driver. CO-RE allows the driver to work on kernels with backported BTF (BPF Type Format) support or kernel versions >= 5.8.
However, the modern eBPF driver build process doesn't require kernel headers, and it isn't tied to your kernel release. This is enabled by the CO-RE (Compile Once - Run Everywhere) feature of the modern eBPF driver.
To comprehend how the driver understands kernel data structures without knowledge of the kernel it runs on, there's no black magic involved. We maintain a [vmlinux.h](driver/modern_bpf/definitions/vmlinux.h) file in our project containing all necessary kernel data structure definitions. Additionally, we sometimes rely on macros or functions typically found in system header files, which we redefine in [struct_flavors.h](driver/modern_bpf/definitions/struct_flavors.h).
CO-RE allows the driver to work on kernels with backported BTF (BPF Type Format) support or kernel versions >= 5.8. The way the driver interprets kernel data structures without direct knowledge of the running kernel is not magic — it leverages predefined type information and BTF-based relocations. We maintain a [vmlinux.h](driver/modern_bpf/definitions/vmlinux.h) file containing essential kernel data structure definitions, allowing the eBPF program to reference fields dynamically. Additionally, for cases where macros or functions from system headers are required, we redefine them in [struct_flavors.h](driver/modern_bpf/definitions/struct_flavors.h). Combined with CO-RE (Compile Once, Run Everywhere), this enables the driver to remain portable across different kernel versions.
That being said, the modern BPF driver still produces an object file, which you can create using the target below. Nevertheless, we ultimately include it in `scap` regardless. Hence, when modern BPF is enabled, building `scap` will already cover this step for you.
The modern eBPF driver build process produces an eBPF header skeleton file using `bpftool`. The skeleton file is a C header file that embeds the compiled eBPF program as bytecode.
```bash
cmake \
@ -210,13 +205,15 @@ cmake \
-DBUILD_LIBSCAP_MODERN_BPF=ON ../;
make ProbeSkeleton
# Verify the modern eBPF object code / final composed header file including all `.o` modern_bpf files was created, uses `.h` extension.
# Verify the modern eBPF bytecode / final composed header file including all `.o` modern_ebpf files was created, uses `.h` extension.
ls -l skel_dir/bpf_probe.skel.h;
# Now includes skel_dir/bpf_probe.skel.h in `scap` during the linking process.
make scap
```
Initial guidance for CI and building within containers: The Falco Project, for instance, compiles the final Falco userspace binary within older centos7 [falco-builder](https://falco.org/docs/install-operate/source/#build-using-falco-builder-container) containers with bundled dependencies. This ensures compatibility across supported systems, mainly due to GLIBC versions and other intricacies. However, you won't be able to compile the modern BPF driver on such old systems or builder containers. One solution is to build `skel_dir/bpf_probe.skel.h` in a more recent builder container. For example, you can refer to this [container](test/vm/containers/ubuntu2310.Dockerfile) as a guide. Subsequently, you can provide the modern BPF header file as an artifact to `scap` during building in an older builder container. As an illustrative example, we use `/tmp/skel-dir` containing the `bpf_probe.skel.h` file.
Since modern eBPF is included in `scap`, running `make scap` automatically covers the `make ProbeSkeleton` build step.
You can also split the build process and specify the directory containing the `bpf_probe.skel.h` file.
```bash
cmake \
@ -246,7 +243,7 @@ This repository includes convenient test example binaries for both `scap` and `s
When developing new features, you would run either one depending on what you're working on, in order to test and validate your changes.
> __NOTE:__ When you're working on driver development, it can be quite useful to make use of the kernel's built-in `printk` functionality. However, for the traditional bpf driver, you'll need to uncomment a line in the [bpf Makefile](driver/bpf/Makefile) first and use a dedicated build flag `BPF_DEBUG`. For modern BPF, use the build flag `MODERN_BPF_DEBUG_MODE`. Any logs generated by `bpf_printk()` will be written to `/sys/kernel/debug/tracing/trace_pipe`. Just make sure you have the right permissions set up for this.
> __NOTE:__ When you're working on driver development, it can be quite useful to make use of the kernel's built-in `printk` functionality. However, for the traditional bpf driver, you'll need to uncomment a line in the [bpf Makefile](driver/bpf/Makefile) first and use a dedicated build flag `BPF_DEBUG`. For modern eBPF, use the build flag `MODERN_BPF_DEBUG_MODE`. Any logs generated by `bpf_printk()` will be written to `/sys/kernel/debug/tracing/trace_pipe`. Just make sure you have the right permissions set up for this.
Here's an example of a `cmake` command that will enable everything you need for all tests and components. By default, the following flags are disabled, with the exception of `USE_BUNDLED_DEPS` and `CREATE_TEST_TARGETS` (they are enabled by default).
@ -262,9 +259,11 @@ cmake \
-DCREATE_TEST_TARGETS=ON \
-DENABLE_LIBSCAP_TESTS=ON \
-DENABLE_DRIVERS_TESTS=ON \
-DENABLE_VM_TESTS=ON ../;
-DENABLE_LIBSINSP_E2E_TESTS=ON ../;
```
> __NOTE:__ The `ENABLE_LIBSINSP_E2E_TESTS` flag enables the new e2e tests for libsinsp. Please keep in mind these tests are currently in heavy development and need some extra steps (see in the section below) to run correctly.
> __TIP:__ Installing and using the package `ccache` can optimize repeated testing, but we don't offer official support or testing for it.
The tests mentioned below expand beyond the scope of "unit tests". In this context as well, we are dedicated to making sure they run smoothly on your `localhost` for pre-PR testing, to the best of our ability:
- [test/e2e](test/e2e) - enforced by our CI
- [test/vm](test/vm) - our CI includes comparable tests, but it employs a distinct framework. For current status reports on Falco drivers kernel testing, please visit this [page](https://falcosecurity.github.io/libs/).
As mentioned earlier, The Falco Project's `libs` repository includes numerous CI-powered checks. For the most current information, please refer to the CI definitions under the [workflows](.github/workflows/) directory.
For current status reports on the CI powered Falco drivers kernel testing, please visit this [page](https://falcosecurity.github.io/libs/).
In general, The Falco Project's `libs` repository includes numerous CI-powered checks. For the most current information, please refer to the CI definitions under the [workflows](.github/workflows/) directory.
### [EXPERIMENTAL] Run libsinsp e2e tests
To correctly run the new libsinsp e2e tests on x86_64 `gcc-multilib` and `g++-multilib` are needed. To run the tests, use the following commands:
and always run `checkpatch.pl` from the kernel tree before submitting pull requests.
Thanks for your attention and time.
1 Curly Braces
------
Every curly brace ("{" and "}") should go on its own line.
Example:
if(a == 0)
{
b = 1;
}
2 If and for statements
------
Every `if` and `for` statement should have the curly braces.
Example:
if(a == 0)
{
b = 1;
}
and not
if(a == 0)
b = 1;
3 Whitespace usage
------
Spaces are used in the following way:
int32_t foo(int32_t a, int32_t b)
{
for(j = 0; j <10;j++)
{
foo(a, b);
}
}
Note that:
* in a function declaration, there is no space between the function name and the "(".
* in a function declaration, there is no space between the "(" and the first parameter.
* in a statement (e.g `for`, `while`...), there is no space between the "for" and the "(".
* in a statement (e.g `for`), there is no space between the "(" and the variable name.
* in a function call, there is no space between the function name and the "(".
* in a function call, there is no space between the "(" and the first parameter.
* "," and ";" work like in English: there should be a space after them.
4 Primitive types
------
For portability reasons, please use the standard C99 types instead of the native C types
like `int` and `long`. C99 types types will be available in all the user level
source files:
Example:
int32_t foo;
5 Commenting Style
------
Comments should be in the C++ style so we can use `/* */` to quickly remove
portions of code during development.
Example:
// this is a comment
6 Commenting Content
------
Code comments work in the following 2-level way:
* A three-line comment should document what the code does and give higher level explanations.
* A one line comment should detail single code lines or explain specific actions.
Example:
//
// Swap two variables
//
int a = 1, b = 2, t;
// make a copy of a
t = a;
// perform the swap
a = b;
b = t;
7 Class variables
------
In order to know whether a variable belongs to a `class` or a `function` we start member variables with "`m_`".
Example:
public int32_t m_counter;
8 Global variables
------
Similarly, in order to know whether the variable is global or not, we start
globals with "`g_`".
Example:
int g_nplugins;
9 Capitalization
------
The naming convention is camel-cased "Unix" style, i.e. always lower case. Words are separated by underscores.
Example:
int32_t g_global_bean_counter;
int32_t count_beans();
and not,
int32_t GlobalBeanCounter;
10 Packed Structures
-------
Packed structures should use the GCC and MSVC-style supported `pragma`:
#pragma pack(push,1)
struct frame_control
{
struct fields....
};
#pragma pack(pop)
11 OS-specific macros
-------
There's an online wiki which enumerates the different macros for compilers, operating systems, and architectures.
It's available at [http://sourceforge.net/p/predef/wiki/Home/](http://sourceforge.net/p/predef/wiki/Home/). Generally speaking we use the operating system page: [http://sourceforge.net/p/predef/wiki/OperatingSystems/](http://sourceforge.net/p/predef/wiki/OperatingSystems/).
12 64-bit constants
-------
Put an "LL" at the end of your 64 bit constants. Without the LL, on some platforms the compiler tries to interpret the constant on the right hand side
as a long integer instead of a long long and in some platform this generate an error at building time.
Example:
x=0X00FF00000000000LL
13 Class Declaration
-------
Class declarations follow the following sequence
1. constructors and destructor
2. public functions
3. public data
4. private functions
5. private data
6. friend declarations
Example:
class foo
{
public:
foo();
~foo();
int32_t lonli();
int32_t m_val;
private:
int32_t temustra();
int32_t m_val2;
};
14 Struct guidelines
-------
We think hiding the presence of a pointer makes the code unnecessarily
ambiguous and more difficult.
Seeing a * in a variable declaration immediately identifies a pointer, which
is easier to mentally keep track of!
Also we think that defining the struct as a typedef makes forward declarations
clunky and find using the C++ style when declaring our structs makes our
lives easier.
//
// Us human parsers find this confusing.
//
typedef struct _my_struct
{
u_int16 m_field;
} my_struct,
*p_my_struct;
//
// This is easier!
//
struct my_struct {
u_int16 m_field;
};
15 Temporary variables
-------
Since "j" is used less frequently in english prose than "a" or "i", we find
that these variables (in hierarchical order) are great for counters: j, k, l,
m, n.
Example:
int32_t j,k;
for(j = 0; j <10;j++)
{
for(k = 0; k <10;k++)
{
int32_t foo = j + k;
}
}
as opposed to:
int32_t i,counter;
for(i = 0; i <10;i++)
{
for(counter = 0; counter <10;counter++)
{
int32_t foo = i + counter;
}
}
16 Error management
-------
Error management inside libscap is done through return values, since the scap
library is written in C.
Error management in the rest of the user level code base is done through
exceptions. We know there's a lot of debate between return values and
exceptions. We decided to pick the latter, so please stick with that.
## You Made It!
Phew! That's it. Thanks!
If we've left anything in the open, feel free to contact us and we'll be happy
to get back to you. Also, you can look at the existing code and see how it's
@ -11,3 +11,7 @@ Navigate to the Home of Falco Drivers Kernel Testing on the left, or click this
## Supported Syscalls Report
Navigate to the Home of Falco Drivers Syscalls Report on the left, or click this [link](syscalls.md), or directly proceed to the supported syscalls [report](report.md).
## Perf Continuous Monitoring
Navigate to the Home of Falco Perf Monitoring on the left, or click this [link](perf.md).
message(WARNING"[KMOD] To run this driver you need a Linux kernel version >= ${kmod_min_kver_map_${TARGET_ARCH}} but actual kernel version is: ${UNAME_RESULT}")
1. Create a new folder under `configure/` with a meaningful name. That has to be all UPPERCASE with underscores, because it will be used as a macro name, prefixed by HAS_ (e.g. `ACCESS_OK_2` generates `HAS_ACCESS_OK_2`).
2. Name the *sub-kmod* source `test.c`. CMake and the predefined Makefile relies on the name being `test.c`.
3. Update the kernel module code to use the new macro.
message(WARNING"[BPF] To run this driver you need a Linux kernel version >= ${bpf_min_kver_map_${TARGET_ARCH}} but actual kernel version is: ${UNAME_RESULT}")
Angelo Puglisi
Holger Hoffstätte
Federico Di Pierro
Tero Kauppinen
Leonardo Di Giovanna
Leonardo Grasso
Francesco Emmi
Super User
Gerald Combs
dependabot[bot]
Melissa Kilby
Iacopo Rozzo
Leonardo Di Giovanna
Andrea Terzolo
Grzegorz Nosek
Luca Guerra
FedeDP
Aldo Lacuku
Nathan Baker
Wiktor Gołgowski
Jason Dellaluce
Mark Stemm
Shane Lawrence
Gerlando Falauto
Maxim Cournoyer
Roberto Scolaro
Adam Roberts
Mauro Ezequiel Moltrasio
Lorenzo Susini
Federico Aponte
Dmitrii Dolgov
Gianmatteo Palmieri
cpanato
therealbobo
albe19029
Grzegorz Nosek
Andrea Terzolo
Giles Hutton
Z. Liu
Poiana
Francesco Furlan
Eddy Duer
Sahas Panda
FedeDP
seraphGod
SohamM-Ibm
poiana
Lovel Rishi
yzewei
yzewei
Stefan Reimer
Lorenzo Susini
RohithRaju
Everett Badeaux
Matthew Knight
Hendrik Brueckner
mdafsanhossain
vadim.zyarko
Afsan Hossain
Vadim Zyarko
Marco Vito Moscaritolo
brandonxin
Nitro Cao
Federico Aponte
Gerlando Falauto
Joseph Pittman
Xeonacid
Angelo Puglisi