glibc-2.42 added __inet_ntop_chk fortification, which started to fail:
*** buffer overflow detected ***: terminated
Program received signal SIGABRT, Aborted.
0x00007ffff629b0dc in __pthread_kill_implementation () from /lib64/libc.so.6
(gdb) bt
#0 0x00007ffff629b0dc in __pthread_kill_implementation () from /lib64/libc.so.6
#1 0x00007ffff6242572 in raise () from /lib64/libc.so.6
#2 0x00007ffff6229f3b in abort () from /lib64/libc.so.6
#3 0x00007ffff622b148 in __libc_message_impl.cold () from /lib64/libc.so.6
#4 0x00007ffff6327337 in __fortify_fail () from /lib64/libc.so.6
#5 0x00007ffff6326c92 in __chk_fail () from /lib64/libc.so.6
#6 0x00007ffff6327a62 in __inet_ntop_chk () from /lib64/libc.so.6
#7 0x000055555569da3d in inet_ntop (__af=10, __src=0x555555ee0800, __dst=0x7fffffff4f90 "\260P\377\377\377\177", __dst_size=100) at /usr/include/bits/inet-fortified.h:36
#8 ipv6tuple_to_string[abi:cxx11](ipv6tuple*, bool) (tuple=0x555555ee0800, resolve=false) at /tmp/portage/dev-debug/sysdig-0.40.1/work/libs-0.20.0/userspace/libsinsp/utils.c
Use INET6_ADDRSTRLEN as destination buffer size.
Fixes: https://github.com/falcosecurity/libs/issues/2573
Signed-off-by: Holger Hoffstätte <holger@applied-asynchrony.com>
Support for empty parameters was added with
https://github.com/falcosecurity/libs/pull/2550.
This update adds empty parameter support for `PPME_SYSCALL_SETPGID_X`.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Support for empty parameters was added with
https://github.com/falcosecurity/libs/pull/2550.
This update adds empty parameter support for `PPME_SYSCALL_SETNS_X`.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Support for empty parameters was added with
https://github.com/falcosecurity/libs/pull/2550.
This update adds empty parameter support for `PPME_SYSCALL_FCHDIR_X`.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Remove unused timestamp saving custom logic in parser for
`PPME_SYSCALL_SELECT_E`, `PPME_SYSCALL_POLL_X`,
`PPME_SYSCALL_PPOLL_X` and `PPME_SYSCALL_EPOLLWAIT_X` events
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
The current implementation uses custom code for fetching
the location of fd-related arguments for specific syscalls.
This update removes the custom code and utilizes the
existing `get_exit_event_fd_location` function instead by
expanding it with the location of the `dirfd' argument.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Some of the events in `g_event_info` structure are not flagged
with `EF_USES_FD` but still use the fd information when parsing.
Add the flag to the following events:
PPME_SYSCALL_SYMLINKAT_X
PPME_SYSCALL_UNLINKAT_2_X
PPME_SYSCALL_MKDIRAT_X
PPME_SYSCALL_FCHMODAT_X
PPME_SYSCALL_FCHOWNAT_X
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Make `PPME_SYSCALL_CLONE3_E` and `PPME_SYSCALL_CLONE3_X` managed by
the scap converter and contextually fix some tests using clone3 and
clone events.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_VFORK_E` and `PPME_SYSCALL_VFORK_X` events
managed by the scap-converter. Specifically, convert them to the
corresponding `PPME_SYSCALL_VFORK_17_{E, X}` event types; this allows
userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_VFORK_17_E` and `PPME_SYSCALL_VFORK_17_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_VFORK_20_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_FORK_E` and `PPME_SYSCALL_FORK_X` events
managed by the scap-converter. Specifically, convert them to the
corresponding `PPME_SYSCALL_FORK_17_{E, X}` event types; this allows
userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_FORK_17_E` and `PPME_SYSCALL_FORK_17_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_FORK_20_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
and PPM_SYSCALL_LINKAT
The new driver does not emit `PPM_SYSCALL_LINK` and
`PPM_SYSCALL_LINKAT` events anymore, and there is no longer need
to handle the old version of the events. This update removes the
state handling and adds conversion rules for the scap files.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Make both `PPME_SYSCALL_CLONE_11_E` and `PPME_SYSCALL_CLONE_11_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_CLONE_11_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_CLONE_16_E` and `PPME_SYSCALL_CLONE_16_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_CLONE_17_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_CLONE_17_E` and `PPME_SYSCALL_CLONE_17_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_CLONE_20_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
and PPM_SYSCALL_UNLINKAT
The new driver does not emit `PPM_SYSCALL_UNLINK` and
`PPM_SYSCALL_UNLINKAT` events anymore, and there is no longer need
to handle the old version of the events. This update removes the
state handling and adds conversion rules for the scap files.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Make both `PPME_SYSCALL_EXECVE_8_E` and `PPME_SYSCALL_EXECVE_8_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_13_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_EXECVE_13_E` and `PPME_SYSCALL_EXECVE_13_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_14_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_EXECVE_14_E` and `PPME_SYSCALL_EXECVE_14_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_15_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_EXECVE_15_E` and `PPME_SYSCALL_EXECVE_15_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_16_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_EXECVE_16_E` and `PPME_SYSCALL_EXECVE_16_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_17_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_EXECVE_17_E` and `PPME_SYSCALL_EXECVE_17_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_18_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make both `PPME_SYSCALL_EXECVE_18_E` and `PPME_SYSCALL_EXECVE_18_X`
events managed by the scap-converter. Specifically, convert them to
the corresponding `PPME_SYSCALL_EXECVE_19_{E, X}` event types; this
allows userspace code to get rid of special handling code for them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Let the scap converter managing all the possible variation of
`PPME_SYSCALL_EXECVEAT_X` event, adapting the userspace code to
handle possible empty values coming from the conversion.
The `PPME_SYSCALL_EXECVEAT_E` event is stil sent to sinsp, as its
parameters are still used as a fallback if the `trusted_exepath`
parameter is not present in the exit event.
Moreover, fixes some execveat tests.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
In the previous implementation, some specific parameter configurations
(empty or containing '(NULL)', with the type being equal to
`PT_CHARBUF`, `PT_FSPATH` or `PT_FSRELPATH`) were patched at loading
time with the following configuration:
- data: "<NA>"
- len: 5
This made empty parameters indistinguishable from non-empty
parameters.
The new implementation loads the parameters and keeps them untouched:
in this way, it is possible to inspect their original data and
lengths.
Since majority of the userspace space implementation still relies on
the aforementioned particular "null" encoding, a couple of new methods
(i.e. `sinsp_evt_param::used_legacy_null_encoding()` and
`sinsp_evt_param::data_and_len_with_legacy_null_encoding()`),
helping to check or simulate the old behaviour, are provided.
Moreover, parameter conversion methods (e.g.
`sinsp_evt_param::as<T>()`), still return the legacy encoded version.
BREAKING CHANGE: make parameter data and len private
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Introduce two fixes:
- turn "NULL" into "<NA>" upon string conversion for parameters that
couldn't be empty before the introduction of the notion of "empty
parameters" in the scap-converter
- fix implementation of `exists` operator for `evt.rawarg` by
flagging zero-length parameters as non-existing.
Moreover, introduce a bunch of unit tests for `evt.arg.*` and
`evt.rawarg.*`, and move some of the old one to new locations. Tests
are annotated in order to reflect the expectation of a future good
implementation.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Do not use GCC extension to define `SCAP_EMPTY_PARAMS_SET`. In this
way, it can be used in Windows.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
The function extracting `fd` parameter's location from the
exit event is missing information for the dup syscalls.
Add location of the `fd` parameter in the exit event for
all dup syscalls.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Add support for `evt.rawarg.*` raw value evaluation for `PT_PID`,
`PT_UID`, `PT_GID` and `PT_SOCKTUPLE`.
Moreover, add support for numerical comparison for `PT_UID` and
`PT_GID`.
Finally, introduce some helpers letting generating execve and connect
events for testing purposes.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Addresses https://github.com/falcosecurity/libs/issues/2546
Ensures that `comm-based` suppression correctly applies not only to processes matching
the configured comm values, but also to their child processes—even when those processes
were already running at the time the library is initialized.
This is achieved by having scap notify sinsp when a `/proc` scan refresh begins and ends.
While the scan is in progress, sinsp builds a temporary `TID` tree to track parent-child relationships.
Once the scan completes, sinsp performs a post-processing step that traverses the tree and suppresses
all children of any process already marked as suppressed by comm.
Signed-off-by: Francesco Emmi <francesco.as@gmail.com>
Add scap API to create/encode events with empty parameters, as this is
required to easily tests events whose type is managed by the scap
converter.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
The new driver does not emit `PPM_SYSCALL_RMDIR` events anymore, and
there is no longer need to handle the old version of the rmdir event.
This update removes the state handling and adds conversion rules for
the scap files.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
The current implementation does no longer emit PPME_SYSCALL_MKDIR_X
events and these events are also converted to PPME_SYSCALL_MKDIR_2_X
events for older scap files. Remove unused PPME_SYSCALL_MKDIR_X
statements from the codebase.
Added the CIF_FALLBACK_TO_EMPTY flag for parameters copied from
the enter event.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
https://github.com/falcosecurity/libs/pull/2544 implements conversion
of the exceve_x event which increases the number of parameters to 30.
Adjust the number of expected parameters from 27 to 30 for execve_x
events with the gvisor engine.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Let the scap converter managing all the possible variation of
`PPME_SYSCALL_EXECVE_19_X` event, adapting the userspace code to
handle possible empty values coming from the conversion.
The `PPME_SYSCALL_EXECVE_19_E` event is stil sent to sinsp, as its
`filename` parameter value is still used as a fallback if the
`trusted_exepath` parameter is not present in the exit event.
Moreover, fixes some execve and execveat tests and align comments
to the new one-line style in the kernel drivers and tests.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
There is no need to store the prlimit entry event, because all
required parameters are available in the exit event.
Modify the prlimit exit event handler to retrieve information from
the exit event instead of the entry event. Added scap conversion
rules for the exit event with 5 parameters.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Old PPME_SYSCALL_PTRACE_X events have zero parameters and they
need conversion support. Add support for converting events
with zero parameters to events with 3 parameters.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Add `C_INSTR_FROM_EMPTY` converter instruction code. This specify
to generate an empty parameter. In order to keep compatibility with
old scap files, an empty parameter has a parameter length set to 0
but it still have `len` bytes set to 0 as parameter value, where
`len` is determined from the parameter type.
E.g.: a `PT_UINT64` parameter will have the length set to 0 and its
value will occupy 8 bytes, all set to 0.
Contextually, introduce the notion of conversion flags and
particularly, the `CIF_FALLBACK_TO_EMPTY` flag: by default, if a
`C_INSTR_FROM_ENTER` instruction is encountered, and for some reason
the converter is not able to obtain a parameter from the enter event,
it pushes a default parameter; if `CIF_FALLBACK_TO_EMPTY` is
specified, it will fallback to an empty parameter.
This flag is a temporary solution to avoid handling empty parameters
in place of default ones in a single shot.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As buster reached its EOL, the official debian repo URL doesn't
host anymore buster packages info. For this reason, change the URLs
to point to the `20250630T203427Z` snapshot, which still contains
them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Fix the scap converter `PT_UID` parameters default value by setting it
to `UINT32_MAX`. Moreover, fix scap converter tests and sinsp parser
code to correctly account for the default value.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
`sinsp_threadinfo_ctor_params` is declared as struct but
forward-declared as class. Fix forward declaration by declaring it
as struct.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_CONNECT_E` parameters to` PPME_SYSCALL_CONNECT_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update connect-related drivers, scap converter and sinsp parser
tests to account the new layout.
For the moment, do not touch userspace connect "enter event"-related
logic as it requires additional work to be done on driver's tuple
generation logic.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Introduce typeinfo::from convenience function, to create a typeinfo
object from ss_plugin_state_type
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
The current `sched_process_exec_args` raw tracepoint definition is
actually the tracepoint one; similarly, the current tracepoint
defintion is actually the raw tracepoint one. Swap them to give the
correct definition on each context.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This update adds scap event conversion for the fcntl syscall exit
events and it eliminates the need to store the entry event in
libsinsp.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Revise the socketcall test case for accept for modern BPF and
other drivers.
On s390x, there is no direct accept syscall and for modern BPF
accept4 is used instead.
The BPF and kernel drivers handle socketcalls internally and, thus,
can handle accept. There was only special handling for setting up
the event. This commit also adds handling for the argument assertions.
Solving these test case failures:
````
Expected: (m_current_param) <= (m_event_header->nparams), actual: 6 vs 5
>>>>> The param id '6' is too big.
/root/git/libs/test/drivers/event_class/event_class.cpp:1457: Failure
Expected equality of these values:
size
Which is: 0
expected_size
Which is: 4
>>>>> length of the param is not correct. Param id = 6
[ FAILED ] SyscallExit.socketcall_acceptX_INET
[ FAILED ] SyscallExit.socketcall_acceptX_INET6
[ FAILED ] SyscallExit.socketcall_acceptX_UNIX
[ FAILED ] SyscallExit.socketcall_acceptX_failure
````
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Recent compilers complain about missing climits header file:
libs/test/libsinsp_e2e/sys_call_test.cpp: In lambda function:
/root/git/libs/test/libsinsp_e2e/sys_call_test.cpp:266:23: error: ‘INT_MAX’ was not declared in this scope
266 | close(INT_MAX);
| ^~~~~~~
libs/test/libsinsp_e2e/sys_call_test.cpp:266:23: note: ‘INT_MAX’ is defined in header ‘<climits>’; this is probably fixable by adding ‘#include <climits>’
Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com>
The current bpf and kmod's `connect` fillers implementations extract
socket tuple information only if the socket file descriptor is greater
than or equal to zero: this does not ensure that the file descriptor
is valid and that the kernel has the correct amount of information
needed to build the socket tuple.
On the other side, the modern probe implementation correctly checks
the system call return value on the exit program, but doesn't try
hard enough to build the socket tuple, as it does not leverage the
sockaddr provided by the user.
Align all three implementations, checking the system call return value
and leveraging the user-provided sockaddr information to build the
socket tuple.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_PWRITEV_E` parameters to` PPME_SYSCALL_PWRITEV_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update pwritev-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Recent additions increased `sinsp-example` instrumentation time in
such a way that now events can be produced by the testing framework
even before `sinsp-example` is initialized and receptive to them.
Increase `sinsp-example` initialization waiting interval to account
for this changes.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Complete the work in 3385c69812 by
aligning the dup2's and dup3's fillers returned value handling to the
other file descriptors handling. Moreover, it also align the dup's
fillers file descriptors handling.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Check that `epoll_create` and `epoll_create1` correctly set fd info
on the event and on the current thread's fd table.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_WRITEV_E` parameters to `PPME_SYSCALL_WRITEV_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update writev-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_LSEEK_E` parameters to `PPME_SYSCALL_LSEEK_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update lseek-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Select the SOURCE_PLUGIN_ENGINE only if SAVEFILE_ENGINE hasn't been
previously selected. This lets us process .scap files with a plugin.
This makes the "-s" and "-p" command line flags sensitive to order, so
document that behavior.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
Add `PPME_SYSCALL_{P}READV_E` parameters to `PPME_SYSCALL_{P}READV_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update {p}readv-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_COPY_FILE_RANGE_E` parameters to
`PPME_SYSCALL_COPY_FILE_RANGE_X` event definition and align all 3
kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update copy_file_range-related drivers, scap converter and sinsp
parser tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_SPLICE_E` parameters to `PPME_SYSCALL_SPLICE_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update splice-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_INOTIFY_INIT_E` parameters to
`PPME_SYSCALL_INOTIFY_INIT_X` event definition and align all 3 kernel
drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update inotify_init-related drivers, scap converter and sinsp
parser tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_TIMERFD_CREATE_E` parameters to
`PPME_SYSCALL_TIMERFD_CREATE_X` event definition and align all 3
kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update timerfd_create-related drivers, scap converter and sinsp
parser tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_NANOSLEEP_E` parameters to
`PPME_SYSCALL_NANOSLEEP_X` event definition and align all 3 kernel
drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update nanosleep-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_SIGNALFD_E` parameters to `PPME_SYSCALL_SIGNALFD_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update signalfd-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SOCKET_ACCEPT4_6_E` parameters to `PPME_SOCKET_ACCEPT4_6_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update accept4-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_{KILL,TKILL,TGKILL}_E` parameters to
`PPME_SYSCALL_{KILL,TKILL,TGKILL}_X` event definition and align all 3
kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update kill/tkill/tgkill-related drivers, scap converter and sinsp
parser tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_QUOTACTL_E` parameters to `PPME_SYSCALL_QUOTACTL_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update quotactl-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_SENDFILE_E` parameters to `PPME_SYSCALL_SENDFILE_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update sendfile-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Align dup2 and dup3 fillers implementations to other fillers
implementation by casting syscalls' file descriptor parameters to
`int32_t` before sending them.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
- Adapt build_threadinfo to the new sinsp_threadinfo constructor
- Have sinsp_threadinfo_ctor_params to allow forward declaration and
avoid cyclic dependency
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
Add `PPME_SYSCALL_SIGNALFD4_E` parameters to
`PPME_SYSCALL_SIGNALFD4_X` event definition and align all 3 kernel
drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update signalfd4-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_EVENTFD2_E` parameters to `PPME_SYSCALL_EVENTFD2_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update eventfd2-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_UMOUNT2_E` parameters to `PPME_SYSCALL_UMOUNT2_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update umount2-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_EPOLL_CREATE{1}_E` parameters to
`PPME_SYSCALL_EPOLL_CREATE{1}_X` event definitions and align all 3
kernel drivers to them.
Add new rules to scap file converter table to convert events in old
scap files to the new layouts.
Add/update epoll_create{1}-related drivers, scap converter and sinsp
parser tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_MPROTECT_E` parameters to `PPME_SYSCALL_MPROTECT_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update mprotect-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_SECCOMP_E` parameters to `PPME_SYSCALL_SECCOMP_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update seccomp-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_UNSHARE_E` parameters to `PPME_SYSCALL_UNSHARE_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update unshare-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_ACCESS_E` parameters to `PPME_SYSCALL_ACCESS_X`
event definition and align all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update access-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_MOUNT_E` parameters to `PPME_SYSCALL_MOUNT_X` event
definition and aligns all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update mount-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_PPOLL_E` parameters to `PPME_SYSCALL_PPOLL_X` event
definition and aligns all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update ppoll-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_SEMCTL_E`/`PPME_SYSCALL_SEMGET_E` parameters to
`PPME_SYSCALL_SEMCTL_X`/`PPME_SYSCALL_SEMGET_X` event definitions and
aligns all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update semctl/semget-related drivers, scap converter and sinsp
parser tests to account for the new layouts.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_SEMOP_E` parameters to `PPME_SYSCALL_SEMOP_X` event
definition and aligns all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update semop-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_FLOCK_E` parameters to `PPME_SYSCALL_FLOCK_X` event
definition and aligns all 3 kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update flock-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_GETDENTS{64}_E` parameters to
`PPME_SYSCALL_GETDENTS{64}_X` event definitions and aligns all 3
kernel drivers to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update getdents{64}-related drivers, scap converter and sinsp
parser tests to account for the new layouts.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `PPME_SYSCALL_MUNMAP_E` parameters to `PPME_SYSCALL_MUNMAP_X`
event definition and aligns all 3 kernel drivers and gvisor engine
to it.
Add new rules to scap file converter table to convert events in old
scap files to the new layout.
Add/update munmap-related drivers, scap converter and sinsp parser
tests to account the new layout.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
When setre*id args where moved to exit event with commit
d7d1e7c861
the offset for the effective id was not updated to
point to the correct value. Instead it was pointing to
the offset where the real id is stored.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the setresuid syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the setresgid syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Partially revert changes introduced in
dfdd45cc2c by replacing the usage
of `socket_family_to_scap` helper with a calls to a new ad-hoc helper
for the legacy bpf probe. To avoid breaking the verifier on old kernel
version, just convert user-provided negative socket family values to
`PPM_AF_UNSPEC` and leave positive values as are. This simplified
version relies on the fact that `AF_*` and corresponding `PPM_AF_*`
macros map to the same values.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Extend `PPME_SYSCALL_CLOSE_X` event by adding the fd parameter to its
definition. Keep the sinsp parser logic associating the fdinfo to the
`close` enter event, but don't apply anymore any additional logic
for it: in other words, remove any code associated to the notion of
"close in progress" or "close canceled" as they have no meaning
anymore.
BREAKING CHANGE: remove `FLAGS_CLOSE_IN_PROGRESS` and
`FLAGS_CLOSE_CANCELED` `sinsp_fdinfo::flags`
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
The new driver does not emit `PPM_SYSCALL_MKDIR` events anymore, and
there is no longer need to handle the old version of the mkdir event.
This update removes the state handling and adds conversion rules for
the scap files.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Add `PPM_SYSCALL_GETRLIMIT_E` params to `PPM_SYSCALL_GETRLIMIT_X`
event definition and align all 3 kernel drivers to the it. Moreover,
align setrlimit_x parsing logic to getrlimit_x logic by unify the
implementation and avoiding storing setrlimit_e: this requires
adding ad-hoc conversion rules for old versions of setrlimit events
coming from old scap files.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Since we now do not store users and groups full info inside each threadinfo,
we would lose users and groups info for host processes after 1 minute.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Fix `domain` parameter exported value by converting it to its
corresponding scap representation in both legacy bpf and kernel
probes.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the setgid syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Commit https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=5b0af621c3f6
restricts `SO_REUSEPORT` socket option to inet sockets: this means
that calls to `setsockopt` setting `SO_REUSEPORT` on unix sockets are
not permitted anymore and will fail on any version backporting the
change. For this reason, still perform the call (to account for socket
belonging to inet families) but ignore its return value and hope any
subsequent call to bind is going to succeed.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the setpgid syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
After commit 3f3e3fb23 we're not directly using `init_keep_threadinfo()`
anymore, so let's merge it with `init()`.
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the fchdir syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the setns syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Replace helper to verify the presence of the exact number of events
of specific types inside a single scap file. Differently from the
old `assert_num_event_type()`, this helper is able to perform the
check on multiple event types at the same type: this helps
consolidating all the tests checking the number of events in all scap
file under a single test.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the mkdir syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
Add enter events parameters to `PPME_SOCKET_RECVMSG_X` and align all
three kernel drivers to the new definition. Contextually, align tuple
parameter extraction in all three drivers, and remove exceptions
in recvmsg driver tests accounting for the removed differences.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This update is part of the implementation for disabling support for
syscall enter events. It implements the following steps:
1. Adds enter parameters to the exit event
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the ptrace syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
This allows Falco outputs to be appended alphabetically sorted.
Also, should fix the build of Falco with old yaml-cpp versions.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
It allows people to set "static" filterchecks; for now, it only supports string ones.
The API is very simple since the filterchecks are initialized from an unordered_map<string,string>.
Added also a bunch of tests.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Libsinsp will now take a copy (not a reference) of scap event table,
and each plugin loaded with ASYNC cap will append its async_event_names
to the table, that will grow larger than PPM_EVENT_MAX, up to 1024 elements.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
The docs (and a unit test) specified `value_offsets` to be an array
of `ss_plugin_extract_value_offsets` structs, while the code in
plugin_filtercheck.cpp expected it to be a struct of arrays.
Things worked out only because we never extract multiple fields
in one go (at least in libsinsp itself).
Keep the plugin_filtercheck.cpp behavior and adapt the documentation
and tests to match.
Additionally, clarify that the offsets are counted from the start
of the event buffer (including the header).
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
* Remove references to the localhost `test/vm` framework
* Remove overly detailed build guidelines for containers
* Ensure more precise and accurate terminology
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
* No longer maintained: This framework will not receive updates or support in the future.
* Past usefulness: It was valuable for detecting regressions in legacy drivers but has now outlived its practical use.
* Compatibility issues: It was incompatible with the Firecracker framework. VirtualBox caused interference when trying to integrate it into the CI workflow on the same test server where kernel driver tests using Firecracker were conducted.
Signed-off-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
Commit 72a6d4f39a changed the logic
governing when enter events are freed. Specifically, enter events
were freed after having performed a conversion (not a skipped
conversion) involving an exit event. With this configuration, the
following conversion would not work:
```c++
{conversion_key{EXAMPLE_E, 1},
conversion_info().action(C_ACTION_STORE)},
{conversion_key{EXAMPLE_X, 4},
conversion_info().action(C_ACTION_ADD_PARAMS)
.instrs({{C_INSTR_FROM_DEFAULT, 0}})},
{conversion_key{EXAMPLE_X, 5},
conversion_info().action(C_ACTION_ADD_PARAMS)
.instrs({{C_INSTR_FROM_ENTER, 0}})}
```
The reason why it would not work, is that the converter would
free the stored enter event upon execution of the second conversion,
and would not find it upon execution of the third one.
Revert only the logic applied to free the enter event, which means
freeing it only if it is used by a `C_INSTR_FROM_ENTER` instruction.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add test coverage for file descriptor parameters and some spurious
ones of other kind.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add enter events parameters to `RECVFROM_X` event definition and
align all three kernel drivers to the new definition.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
`event` can be NULL and code must not access it without guarding the
access. Fix it by avoiding the access to the event field and using
instead the `event_type` function parameter.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add enter events parameters to `RECV_X` event definition and align
all three kernel drivers to the new definition. Moreover, add the
`tuple` parameter to it, and align userspace logic to leverage its
presence. Finally, add the capability to leverage the content
extracted from the syscall data buffer in userspace.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Take into account possible misaligned accesses while printing scap
event parameters to standard output by first copying misaligned bytes
using memcpy. Contextually, factorize multiple switch case, sharing
the same handling code.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add two new CLI options for the modern eBPF probe in `sinsp-example`:
- `-c <num>, --cpus-for-each-buffer <num>` - allowing to select the
number of CPUs for each ring buffer
- `-A, --all-cpus` - allowing to allocate ring buffers for all
available CPUs (not only online ones)
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
This update is part of the proposal for disabling support for
syscall enter events. It implements the following steps:
1. Add enter parameters to the exit event.
2. Adapt sinsp state to work just with exit events.
3. Create a scap-file conversion (in a dedicated scap-file converter)
to convert ENTER events into merged EXIT ones.
4. Add some tests replaying scap-files.
for the setuid syscall.
Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
As the end goal is to remove unneeded duties from `sinsp`, remove
`sinsp::get_thread_ref()` API and let users directly call the
corresponding thread manager API.
BREAKING CHANGE: remove `sinsp::get_thread_ref()`
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Make `sinsp_parser::reset()` const by removing the logic for
obtaining the syscall event source index and providing it directly
from sinsp.
BREAKING CHANGE: make `sinsp_parser::reset()` const
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Apply early return and idiom in `sinsp::handle_plugin_async_event()`
and contextually reformat comments.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As the end goal is to remove unneeded duties from `sinsp`, remove
`sinsp::remove_thread()` API and let users directly call the
corresponding thread manager API.
BREAKING CHANGE: remove `sinsp::remove_thread()`
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
As the end goal is to remove unneeded duties from `sinsp`, remove
`sinsp::add_thread()` API and let users directly call the
corresponding thread manager API.
BREAKING CHANGE: remove `sinsp::add_thread()`
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
BREAKING CHANGE: remove `sinsp_dumper::get_memory_dump_cur_buf()` and
`sinsp_dumper::next_write_position()` public APIs
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Explicitely enforce, by accepting references, the non-nullness of the
input parameters in the `sinsp_parser` public APIs.
BREAKING CHANGE: update `sinsp_parser::process_event()`,
`sinsp_parser::event_cleanup()`, `sinsp_parser::reset()`,
`sinsp_parser::retrieve_enter_event()` and
`sinsp_parser::parse_dirfd()` signatures
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Replace pointers with references in `sinsp_parser`'s private APIs
wherever possible.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Introduce `sinsp_parser_verdict` component. This component is provided
by `sinsp` to the `sinsp_parser` component, and is populated by this
latter with information regarding the thread/file descriptors to
remove and/or the observer callbacks to execute. This helps moving the
state out of the sinsp_parser component.
BREAKING CHANGE: update `sinsp_parser` constructor, and
`sinsp_parser::process_event()` and `sinsp_parser::reset()` signatures
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove `sinsp_thread_manager` dependency on `sinsp` fields by
selectively providing each single dependency the component.
BREAKING CHANGE: update `sinsp_thread_manager` constructor, and
remove `sinsp::get_thread_manager_dyn_fields()` and
`sinsp::get_fdtable_dyn_fields()` public APIs
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Use fdinfo factory in `event_processor::build_fdinfo()`. In order to
avoid call loops, extract the fdinfo creation logic in a separate
private fdinfo factory method and provide access to it via the
attorney-client idiom.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Replace `sinsp::get_lastevent_ts()` and `sinsp::get_new_ts()`
accesses in `sinsp_usergroup_manager` with accesses to `timestamper`
APIs.
BREAKING CHANGE: update `sinsp_usergroup_manager` constructor
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `timestamper` component handling timestamp caching and
generation. The addition of this component is a preliminary step
needed for decoupling other components like `sinsp_thread_manager`
and `sinsp_usergroup_manager` from `sinsp`.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
BREAKING CHANGE: make
`sinsp_thread_manager::remove_main_thread_fdtable()` private and
const, and update `sinsp_thread_manager` constructor
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add extraction offsets to the filter cache. Add an offset parameter to
the various extract_nocache functions. Implement offset extraction in
sinsp_filter_check_plugin::extract_nocache, and ignore offsets
elsewhere. Add sinsp_filter_check::extract_with_offsets. Add an offsets
test to plugins.ut.cpp.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
Remove field_offsets from ss_plugin_field_extract_input. We can just
check to see if field_offsets is set. Update some comments.
Signed-off-by: Gerald Combs <gerald@wireshark.org>
Avoid field name copy each time
`sinsp_thread_manager::get_field_accessor()` is called by passing a
string const reference.
BREAKING CHANGE: change `sinsp_thread_manager::get_field_accessor()`
signature
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Move `sinsp_thread_manager::load_foreign_fields_accessors()` method
logic in sinsp, and provide two new setters
`sinsp_thread_manager::set_foreign_field_accessors()` and
`sinsp_thread_manager::set_foreign_tables()` to enable tables
and accessors setting on thread manager from sinsp.
BREAKING CHANGE: remove
`sinsp_thread_manager::load_foreign_fields_accessors()` method
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Reduce threadinfo's params resources waste by moving them into a
separate struct provided at construction phase and shared among all
threadinfo instances.
BREAKING CHANGE: update `sinsp_threadinfo` constructor
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove unused `sinsp::get_fdinfo_factory()` and
`sinsp::get_fdtable_factory()` from `sinsp` public API.
BREAKING CHANGE: remove `sinsp::get_fdinfo_factory()` and
`sinsp::get_fdtable_factory()`
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove `sinsp_threadinfo` dependency on `sinsp` fields that are
mutable from the `sinsp_threadinfo` perspective by selectively
providing each single dependency the component needs. In order to
solve a cyclic dependency problem with the thread manager and the
thread info factory, add `sinsp_threadinfo_factory`'s
`set_thread_manager_attorney` inner class following the
attorney-client idiom to limit access to
`sinsp_threadinfo_factory::set_thread_manager` private method.
BREAKING CHANGE: update `sinsp_threadinfo` constructor
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove `sinsp_threadinfo` dependency on `sinsp` fields that are
immutable from the `sinsp_threadinfo` perspective by selectively
providing each single dependency the component needs. In order to
avoid code duplication in the event processor, add
`sinsp_threadinfo_factory`'s `create_unique_attorney` inner class
following the attorney-client idiom to limit access to
`sinsp_threadinfo_factory::create_unique` private method.
BREAKING CHANGE: update `sinsp_threadinfo` constructor
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove, in thread manager code, references to thread manager's methods
involving passing through the inspector.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Reduce fdtable's params resources waste by moving them into a
separate struct provided at construction phase and shared among all
fdtable instances.
BREAKING CHANGE: update `sinsp_fdtable` constructor
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
It might happen that a threadinfo has a container_id attached,
but the plugin already removed the container from its cache.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Pass `notify` as `sinsp_threadinfo::set_group()` flag to enable
external control over thread user update notification.
BREAKING CHANGE: update `sinsp_threadinfo::set_group()`,
`sinsp_threadinfo::init()` signatures and `user_group_updater`
constructor.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Pass `notify` as `sinsp_threadinfo::set_user()` flag to enable
external control over thread user update notification.
BREAKING CHANGE: update `sinsp_threadinfo::set_user()`,
`sinsp_threadinfo::init()` signatures and `user_group_updater`
constructor.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Move bound server ports accounting from
`sinsp_threadinfo::add_fd_from_scap()` to new
`sinsp_thread_manager::add_thread_fd_from_scap()` API.
BREAKING CHANGE: change sinsp_threadinfo::add_fd_from_scap() semantic
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Add `resolve_hostname_and_port` parameter to
`sinsp_threadinfo::fix_sockets_coming_from_proc()` and
`sinsp_thread_manager::fix_sockets_coming_from_proc()` signatures
BREAKING CHANGE: update
`sinsp_threadinfo::fix_sockets_coming_from_proc()` and
`sinsp_thread_manager::fix_sockets_coming_from_proc()` signatures
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
pkgconfig files are installed in CMAKE_INSTALL_LIBDIR/pkgconfig and we
need to find our way back to CMAKE_INSTALL_PREFIX. The correct
(relative) path is as many `../` up, as there are components in
`CMAKE_INSTALL_LIBDIR/pkgconfig` (the default being `lib/pkgconfig`).
Rather than hardcode the two components matching the default path,
figure it out at configure time.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
* use relative path as pkgconfig prefix (using CMAKE_INSTALL_PREFIX
breaks `make DESTDIR=...` installs)
* install generated uthash.h rather than point into local build
directory
* fix typos that prevented libscap.pc from specifying dependencies
Note: I was still unable to do a successful build with
ASAN/UBSAN-enabled libsinsp, but that's possibly my fault.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
This test verifies that a condition expression with a value containing
an `=` character can be printed and parsed again without errors.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
If a condition expression contains a value with a = character, when
the condition expression is printed as a string using
libsinsp::filter::ast::as_string, the value is not escaped.
This causes problems if you try to parse the condition expression string again.
For example, a condition of ... and not (proc.cmdline contains
"--coreutils-prog-shebang=") and not ... gets printed as ... and
not (proc.cmdline contains --coreutils-prog-shebang=) and not
... which results in an error when trying to parse it again.
The fix is to detect when a value contains a `=` character and escape
the value when found.
Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
When the fd table is full, evt->get_fd_info is reset to NULL, which
causes a crash when the observer accesses the fdinfo. Revert to
the previous behavior, where we always called the observer with
a valid fdinfo, even if the fd got later dropped.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
The pointer ends up being converted to a shared_ptr anyway so we can
do it a bit earlier without issues.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Many pcapng block types support optional fields, and the SHB is one of
those types:
https://ietf-opsawg-wg.github.io/draft-ietf-opsawg-pcap/draft-ietf-opsawg-pcapng.html#name-section-header-block
Some software lets you add file-level comments to the SHB. Make sure we
skip over any options in scap_read_section_header.
Add a note to next_event_from_file about the possibility of adding
support for comment options in event blocks.
Add a test capture file which contains comments along with a CI test.
Created by running
editcap --capture-comment "File-level comment" -a "1:Internal block comment" -a "211:Visible block comment, no padding" -a "213:Visible block comment, padding" curl_google.scap curl_google_comments.scap
Signed-off-by: Gerald Combs <gerald@wireshark.org>
Remove inspector's `sinsp::build_threadinfo()` exposed method and
force the other components (i.e.: `sinsp_thread_manager`, `sinsp`,
`sinsp_parser`, etc...) to use the threadinfo factory to create a new
`sinsp_threadinfo` object. Moreover, extract the thread manager's
dynamic fields initialization from thread manager, and pass them to
its constructor from sinsp: this allows to control the dynamic
fields in a single place and inject them both on the thread manager
and on the threadinfo factory. Together, these changes reduces the
number of dependencies of components that want to create a new
threadinfo. This step is needed to get rid of the `sinsp` pointer in
`sinsp_thread_manager`.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove inspector's `sinsp::build_fdinfo()` exposed method and force
the other components (i.e.: `sinsp_threadinfo`,
`sinsp_thread_manager`, etc...) to use the fdinfo factory to create a
new `sinsp_fdinfo` object. Moreover, remove the dependency of
`sinsp_fdinfo_factory` from `sinsp_thread_manager`. Together, these
changes reduces the number of dependencies of components that want to
create a new fdinfo. This step is needed to get rid of the `sinsp`
pointer in `fdtable`, `sinsp_thread_manager` and `sinsp_threadinfo`.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Store input plugin reference in parser to handle input plugin
reassignments in `sinsp`: indeed, if the input plugin is reassigned
(e.g.: `sinsp::set_input_plugin`), the parser would continue to
use the old input plugin value, as currently it makes a copy of the
provided shared_ptr.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
API 3.10 changed the layout of the plugin_api struct
in an ABI-incompatible way. This does not matter for shared library
plugins, but statically linked plugins do depend on binary compatibility
between the two structs.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Make `define_static_field` constexpr static and directly provide
the field offset. Introduce `OFFSETOF_STATIC_FIELD`,
`DEFINE_STATIC_FIELD_READONLY` and `DEFINE_STATIC_FIELD` macros to
hide the complexicity behind extracting the field type and offset
needed for `define_static_field`.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
De-referencing scap_evt fields is undefined behavior since
scap_evt is pragma packed and we may access fields whose address
is not correctly aligned.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Restructure recvmsg `SCM_RIGHTS` processing to avoid allocations
before sanity checks are performed.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Remove trailing comma as some old cmake versions cannot otherwise
parse the `CMakePresets.json` file.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Isolate `sinsp_parser` component from sinsp by removing the source
code dependency. Dependencies are now selectively pushed in the parser
constructor and their constness enforced wherever possible.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Nowadays, it was only filtering out gvisor (and thus protobuf), but we already have the `BUILD_LIBSCAP_GVISOR` flag for that.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
It leverages sinsp state table API to retrieve "container_id" field written by the plugin.
Use it where needed.
Moreover, user_group_manager cannot subscribe to container changes anymore, since container changes are no more in sinsp.
Instead, parse ASYNC event "container_removed" to cleanup user_group tables.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
They are now implemented by the plugin.
Also, dropped threadinfo::m_category, unused.
Finally, dropped `sinsp_observer::on_resolve_container`.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
* driver/CMakeLists.txt (DRIVER_SOURCES): Add missing headers.
* userspace/libsinsp/test/CMakeLists.txt (unit-test-libsinsp): Link to
libgrpc++ to avoid a missing DSO error.
* userspace/libscap/CMakeLists.txt: Do not hardcode STATIC type for
scap_event_schema and scap_platform libraries, so as to install
them (they are referenced in the pkg-config files).
Fixes: #1820
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
The generated pkg-config files of libscap and libsinsp now makes use
of pkg-config Requires and Requires.static fields, which should reduce
over-linking when linking to shared libraries.
* cmake/modules/BuildPkgConfigDependencies.cmake
(add_pkgconfig_library): Add debug messages and fix an issue where
IN_LIST had no effect.
* cmake/modules/libscap.cmake: Move pkgconfig dependency computation
to, pkg-config file configuration to...
* userspace/libscap/CMakeLists.txt: ... here, conditionally
accumulating Requires and Requires.private values.
* userspace/libscap/libscap.pc.in (prefix): Set directly to
CMAKE_INSTALL_PREFIX.
(Requires, Requires.private): New fields.
* userspace/libsinsp/CMakeLists.txt: Separate libraries into
pkg-config Requires and Requires.private lists. Add the pkg-config
requirements to the ignored link dependencies, since these are now
recorded as Requires in the pkg-config file.
* userspace/libsinsp/libsinsp.pc.in (Requires): Add
@LIBSINSP_REQUIRES@.
(Requires.private): New field.
(Libs): Remove -lsinsp, automatically computed in SINSP_PKG_CONFIG_LIBS.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
* userspace/libpman/libpman.pc.in: New file.
* userspace/libpman/CMakeLists.txt: Configure and install it along the
libpman header.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
This is to so that includes work whether using e.g. #include <scap.h>
or #include <libscap/scap.h>, and likewise for libsinp.
* userspace/libsinsp/libsinsp.pc.in (Cflags): Add include directive
for falcosecurity/driver.
* userspace/libscap/libscap.pc.in: Likewise. Also add include
directive for uthash.
Signed-off-by: Maxim Cournoyer <maxim.cournoyer@gmail.com>
Use anonymous unions in modern bpf driver. Moreover, add some debug prints to `pman_prepare_progs_before_loading`,
and always disable all unused programs autoload.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Try to inject each of them until success.
This allows us to inject `bpf_loop` sendmmsg and recvmmsg programs where supported,
and fallback at just sending first message where it isn't.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Make the CRI retry lookup configurable, this includes:
- maximum elapsed time
- number of retries
- maximum retry interval
Signed-off-by: Iacopo Rozzo <iacopo@sysdig.com>
Parse all control messages instead of parsing just the first one.
Leverage the new scap_get_fdinfo API to get info only from the file
in procfs associated to the file descriptor, instead of scanning each
time the entire procfs fd directory.
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Co-authored-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
The API defined by libsinsp::state::base_table is about to be
removed (moved to libsinsp::state::built_in_table), so we introduce
a new API that's available for every table (including plugin-provided
tables), using the plugin table API underneath.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
This is an intermediate class in the hierarchy, that built-in sinsp
tables will inherit from, but plugin-provided table wrappers won't.
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Kernel 6.3 changed fs functions to `struct mnt_idmap`.
Use the configure system in place of the version check to support driver
build on RHEL 9 (namely 5.14.0-547.el9.x86_64)
Signed-off-by: Angelo Puglisi <angelopuglisi86@gmail.com>
The spaces after the operator tokens were intended to indicate operators that mandate a whitespace character to be followed.
Co-authored-by: Jason Dellaluce <jasondellaluce@gmail.com>
Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
We can't use bpf_loop() helper since the `bpf_core_enum_value_exists` check
triggers a verifier failure on kernels prior to 5.13 that hadn't got `PTR_TO_FUNC` support.
See https://lore.kernel.org/bpf/CAGQdkDt9zyQwr5JyftXqL=OLKscNcqUtEteY4hvOkx2S4GdEkQ@mail.gmail.com/T/#u.
Instead, loop up to 16 messages.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Co-authored-by: Andrea Terzolo <andreaterzolo3@gmail.com>
A new argument had to be added to the apply_dynamic_snaplen function, I
opted for using an auxiliar struct and pass a single pointer to it to
the function. I think this is a bit cleaner, since removing or adding
other arguments can be done by simply adding it to the struct, keeping
the function signature unchanged.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
The added fields were added in newer kernels and can be used to check
for access of some newer helpers.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
The current implementation is not complete, only the first message is
processed. In order to allow for multiple messages to be processed the
kmod needs to allow for multiple headers to be added to the ringbuffer
from the filler.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Due to limitations with the verifier, it won't be possible to iterate
over all messages, so the implementation is best effort and only the
first message is actually processed.
Signed-off-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>
Instead, push them onto a queue owned by the inspector to be later called,
1 by 1, as requested.
This ensures that the whole libsinsp state has been processed,
even by plugins, before sinsp_observer methods are called.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
Currently when a thread from a thread group is doing execve, we expect
that the kernel will reassign its tid at the end to the group leader,
and simulate this behavior in the parser accordingly. The final result
is all the threads in the thread group, except the leader, are removed
from the cache.
But looks like under certain circumstances it's possible to end up in a
situation when the kernel is not doing the reassignment, yet the syscall
ends successfully. This leads to a crash, since the parser removes the
thread associated with the execve_x event, which will be accessed later
during post processing -- and everything is expose in use-after-free.
It's hard to reproduce artificially, but there are crash reports from
the field, demonstrating the problem and confirming the patch fixes the
crash. So far the issue was discovered only on ppc64le (Power10 to be
more precise).
To handle this, keep the event thread in place. Note, that tid here
comes from the BPF probe directly, where it's captured via
bpf_get_current_task/_btf. This means that the tid is the one really
reported by the kernel, so keeping it represents the current state
precisely.
Signed-off-by: Dmitrii Dolgov <9erthalion6@gmail.com>
Also, avoid subscribing to container manager "container removed" callback;
instead, use same RAII object to check whether init pid for the container did exit.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
We cannot rely anymore on the event number to search an event since we
could filter some enter events in the middle
Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>
We now expect `PPME_ASYNCEVENT_E` whose `name` matches one of the
plugin supported ones (get_async_events() API).
The new API is not required for async capability.
Added also a test.
Signed-off-by: Federico Di Pierro <nierro92@gmail.com>
@ -11,7 +11,7 @@ This repository contains **libsinsp**, **libscap**, the **kernel module** and th
These components are at the foundation of [Falco](https://github.com/falcosecurity/falco) and other projects that work with the same kind of data.
This component stack mainly operates on syscall events. We monitor syscalls using either a kernel module or an eBPF probe, which we call *drivers*. On top of the drivers, `libscap` manages the data capture process, while `libsinsp` enriches the data, and provides a rich set of API to consume the data. Furthermore, these two libraries also implement a [plugin](https://github.com/falcosecurity/plugins) framework that extends this stack to potentially any other data sources. For further details, please refer to the [official documentation](https://falco.org/docs/).
This component stack mainly operates on syscall events. We monitor syscalls using either a kernel module or an eBPF probe, which we call *drivers*. On top of the drivers, `libscap` manages the data capture process, while `libsinsp` enriches the data, and provides a rich set of API to consume the data. Furthermore, these two libraries also implement a [plugin](https://github.com/falcosecurity/plugins) framework that extends this stack to potentially any other data sources. For further details, please refer to Falco's [official documentation](https://falco.org/docs/).
An image is worth a thousand words, they say:
@ -104,13 +104,13 @@ If you are building this project outside of a Git working directory, or if you w
<details>
<summary>Expand Build Instructions</summary>
For your convenience, we have included the instructions for building the `libs` modules here, in addition to the information available in the [official documentation](https://falco.org/docs/install-operate/source/). These instructions are designed for building and testing `libs` on your own Linux development machine. However, if you intend to adopt CI or build within containers, there are additional considerations to take into account. The official [website]((https://falco.org/docs/install-operate/source/)) continually extends its guidance in this respect.
For your convenience, we have included the instructions for building the `libs` modules here, in addition to the information available in Falco's [official documentation](https://falco.org/docs/install-operate/source/). These instructions are designed for building and testing `libs` on your own Linux development machine. However, if you intend to adopt CI or build within containers, there are additional considerations to take into account. The official [website]((https://falco.org/docs/install-operate/source/)) continually extends its guidance in this respect.
The project utilizes the `cmake` build system, and the key `make` targets are as follows:
* `driver` -> build the kmod
* `bpf` -> build the eBPF probe
* `scap` -> build libscap (`modern_bpf` driver will be bundled into `scap` if enabled)
* `bpf` -> build the legacy `ebpf` probe
* `scap` -> build libscap (`modern_ebpf` driver will be bundled into `scap` if enabled)
* `sinsp` -> build libsinsp (depends upon `scap` target)
* `scap-open` -> build a small example binary for `libscap` to test the drivers (dependent on `scap`)
* `sinsp-example` -> build a small example binary for `libsinsp` to test the drivers and/or `libsinsp` functionality (dependent on `scap` and `sinsp`)
@ -135,7 +135,7 @@ make sinsp
### Build userspace using system deps
To build using the system deps instead, first, make sure to have all the needed packages installed. Refer to the [official documentation](https://falco.org/docs/install-operate/source/).
To build using the system deps instead, first, make sure to have all the needed packages installed. Refer to Falco's [official documentation](https://falco.org/docs/install-operate/source/).
```bash
cmake -DUSE_BUNDLED_DEPS=OFF ../;
@ -146,29 +146,27 @@ make sinsp
### Build driver - kmod
To build the kmod driver, you need your kernel headers installed. Check out the [official documentation](https://falco.org/docs/install-operate/source/).
To build the kmod driver, you need your kernel headers installed. Check out Falco's [official documentation](https://falco.org/docs/install-operate/source/).
```bash
make driver
# Verify the kmod object code was created, uses `.ko` extension.
# Verify the kmod binary object file was created, uses `.ko` extension.
ls -l driver/src/scap.ko;
```
### Build driver - eBPF probe
To build the eBPF probe, you need `clang` and `llvm` packages and you also need your kernel headers installed. Check out the [official documentation](https://falco.org/docs/install-operate/source/).
To build the eBPF probe, you need `clang` and `llvm` packages and you also need your kernel headers installed. Check out Falco's [official documentation](https://falco.org/docs/install-operate/source/).
```bash
cmake -DBUILD_BPF=ON ../;
make bpf
# Verify the eBPF object code was created, uses `.o` extension.
# Verify the eBPF bytecode file was created, uses `.o` extension.
ls -l driver/bpf/probe.o;
```
>__WARNING__: **clang-7** is the oldest supported version to build our BPF probe.
Initial guidance for CI and building within containers: To build either the kmod or eBPF probe in a container, you will need to make the extracted kernel headers available. The [test/vm](test/vm/) directory contains example [scripts](test/vm/scripts/compile_drivers.sh) demonstrating how to pass them to the `make` command using the argument `KERNELDIR=${EXTRACTED_KERNEL_HEADERS_DIR}`. You can also use the [falcosecurity/driverkit](https://github.com/falcosecurity/driverkit) or explore the scripts within the driverkit repository. The mentioned resources also provide candidate builder containers.
### Build driver - modern eBPF probe
To build the modern eBPF probe, further prerequisites are necessary:
@ -193,13 +191,13 @@ To build the modern eBPF probe, further prerequisites are necessary:
> __NOTE:__ These are not the requirements to use the modern BPF probe, but rather for building it from source.
Regarding the previously discussed bpf drivers, they create a kernel-specific object code (`driver/bpf/probe.o`) for your machine's kernel release (`uname -r`). This object code is then used as an argument for testing with`scap-open` and `sinsp-example` binaries.
Regarding the previously discussed legacy eBPF driver, it generates kernel-specific bytecode (`driver/bpf/probe.o`) tailored to your machine's kernel release (`uname -r`). The location of the bytecode file can then be passed as an argument for testing with the`scap-open` and `sinsp-example` binaries.
However, the modern BPF driver operates differently. It doesn't require kernel headers, and its build isn't tied to your kernel release. This is enabled by the CO-RE (Compile Once - Run Everywhere) feature of the modern BPF driver. CO-RE allows the driver to work on kernels with backported BTF (BPF Type Format) support or kernel versions >= 5.8.
However, the modern eBPF driver build process doesn't require kernel headers, and it isn't tied to your kernel release. This is enabled by the CO-RE (Compile Once - Run Everywhere) feature of the modern eBPF driver.
To comprehend how the driver understands kernel data structures without knowledge of the kernel it runs on, there's no black magic involved. We maintain a [vmlinux.h](driver/modern_bpf/definitions/vmlinux.h) file in our project containing all necessary kernel data structure definitions. Additionally, we sometimes rely on macros or functions typically found in system header files, which we redefine in [struct_flavors.h](driver/modern_bpf/definitions/struct_flavors.h).
CO-RE allows the driver to work on kernels with backported BTF (BPF Type Format) support or kernel versions >= 5.8. The way the driver interprets kernel data structures without direct knowledge of the running kernel is not magic — it leverages predefined type information and BTF-based relocations. We maintain a [vmlinux.h](driver/modern_bpf/definitions/vmlinux.h) file containing essential kernel data structure definitions, allowing the eBPF program to reference fields dynamically. Additionally, for cases where macros or functions from system headers are required, we redefine them in [struct_flavors.h](driver/modern_bpf/definitions/struct_flavors.h). Combined with CO-RE (Compile Once, Run Everywhere), this enables the driver to remain portable across different kernel versions.
That being said, the modern BPF driver still produces an object file, which you can create using the target below. Nevertheless, we ultimately include it in `scap` regardless. Hence, when modern BPF is enabled, building `scap` will already cover this step for you.
The modern eBPF driver build process produces an eBPF header skeleton file using `bpftool`. The skeleton file is a C header file that embeds the compiled eBPF program as bytecode.
```bash
cmake \
@ -207,13 +205,15 @@ cmake \
-DBUILD_LIBSCAP_MODERN_BPF=ON ../;
make ProbeSkeleton
# Verify the modern eBPF object code / final composed header file including all `.o` modern_bpf files was created, uses `.h` extension.
# Verify the modern eBPF bytecode / final composed header file including all `.o` modern_ebpf files was created, uses `.h` extension.
ls -l skel_dir/bpf_probe.skel.h;
# Now includes skel_dir/bpf_probe.skel.h in `scap` during the linking process.
make scap
```
Initial guidance for CI and building within containers: The Falco Project, for instance, compiles the final Falco userspace binary within older centos7 [falco-builder](https://falco.org/docs/install-operate/source/#build-using-falco-builder-container) containers with bundled dependencies. This ensures compatibility across supported systems, mainly due to GLIBC versions and other intricacies. However, you won't be able to compile the modern BPF driver on such old systems or builder containers. One solution is to build `skel_dir/bpf_probe.skel.h` in a more recent builder container. For example, you can refer to this [container](test/vm/containers/ubuntu2310.Dockerfile) as a guide. Subsequently, you can provide the modern BPF header file as an artifact to `scap` during building in an older builder container. As an illustrative example, we use `/tmp/skel-dir` containing the `bpf_probe.skel.h` file.
Since modern eBPF is included in `scap`, running `make scap` automatically covers the `make ProbeSkeleton` build step.
You can also split the build process and specify the directory containing the `bpf_probe.skel.h` file.
```bash
cmake \
@ -243,7 +243,7 @@ This repository includes convenient test example binaries for both `scap` and `s
When developing new features, you would run either one depending on what you're working on, in order to test and validate your changes.
> __NOTE:__ When you're working on driver development, it can be quite useful to make use of the kernel's built-in `printk` functionality. However, for the traditional bpf driver, you'll need to uncomment a line in the [bpf Makefile](driver/bpf/Makefile) first and use a dedicated build flag `BPF_DEBUG`. For modern BPF, use the build flag `MODERN_BPF_DEBUG_MODE`. Any logs generated by `bpf_printk()` will be written to `/sys/kernel/debug/tracing/trace_pipe`. Just make sure you have the right permissions set up for this.
> __NOTE:__ When you're working on driver development, it can be quite useful to make use of the kernel's built-in `printk` functionality. However, for the traditional bpf driver, you'll need to uncomment a line in the [bpf Makefile](driver/bpf/Makefile) first and use a dedicated build flag `BPF_DEBUG`. For modern eBPF, use the build flag `MODERN_BPF_DEBUG_MODE`. Any logs generated by `bpf_printk()` will be written to `/sys/kernel/debug/tracing/trace_pipe`. Just make sure you have the right permissions set up for this.
Here's an example of a `cmake` command that will enable everything you need for all tests and components. By default, the following flags are disabled, with the exception of `USE_BUNDLED_DEPS` and `CREATE_TEST_TARGETS` (they are enabled by default).
@ -259,8 +259,7 @@ cmake \
-DCREATE_TEST_TARGETS=ON \
-DENABLE_LIBSCAP_TESTS=ON \
-DENABLE_DRIVERS_TESTS=ON \
-DENABLE_LIBSINSP_E2E_TESTS=ON \
-DENABLE_VM_TESTS=ON ../;
-DENABLE_LIBSINSP_E2E_TESTS=ON ../;
```
> __NOTE:__ The `ENABLE_LIBSINSP_E2E_TESTS` flag enables the new e2e tests for libsinsp. Please keep in mind these tests are currently in heavy development and need some extra steps (see in the section below) to run correctly.
The tests mentioned below expand beyond the scope of "unit tests". In this context as well, we are dedicated to making sure they run smoothly on your `localhost` for pre-PR testing, to the best of our ability:
- [test/e2e](test/e2e) - enforced by our CI
- [test/vm](test/vm) - our CI includes comparable tests, but it employs a distinct framework. For current status reports on Falco drivers kernel testing, please visit this [page](https://falcosecurity.github.io/libs/).
As mentioned earlier, The Falco Project's `libs` repository includes numerous CI-powered checks. For the most current information, please refer to the CI definitions under the [workflows](.github/workflows/) directory.
For current status reports on the CI powered Falco drivers kernel testing, please visit this [page](https://falcosecurity.github.io/libs/).
In general, The Falco Project's `libs` repository includes numerous CI-powered checks. For the most current information, please refer to the CI definitions under the [workflows](.github/workflows/) directory.
Angelo Puglisi
Holger Hoffstätte
Federico Di Pierro
Tero Kauppinen
Leonardo Di Giovanna
Leonardo Grasso
Francesco Emmi
Super User
Gerald Combs
dependabot[bot]
Melissa Kilby
Iacopo Rozzo
Leonardo Di Giovanna
Andrea Terzolo
Grzegorz Nosek
Luca Guerra
FedeDP
Aldo Lacuku
Nathan Baker
Wiktor Gołgowski
Jason Dellaluce
Mark Stemm
Shane Lawrence
Gerlando Falauto
Maxim Cournoyer
Roberto Scolaro
Adam Roberts
Mauro Ezequiel Moltrasio
Lorenzo Susini
Federico Aponte
Dmitrii Dolgov
Gianmatteo Palmieri