diff --git a/pkg/process/cache.go b/pkg/process/cache.go index 82a3c13b8c9..8274e17fc0f 100644 --- a/pkg/process/cache.go +++ b/pkg/process/cache.go @@ -197,12 +197,16 @@ func (pc *Cache) len() int { func (pc *Cache) dump(opts *tetragon.DumpProcessCacheReqArgs) []*tetragon.ProcessInternal { execveMapPath := filepath.Join(defaults.DefaultMapRoot, defaults.DefaultMapPrefix, "execve_map") - execveMap, err := ebpf.LoadPinnedMap(execveMapPath, &ebpf.LoadPinOptions{ReadOnly: true}) - if err != nil { - logger.GetLogger().WithError(err).Warn("failed to open execve_map") - return []*tetragon.ProcessInternal{} + var execveMap *ebpf.Map + var err error + if opts.ExcludeExecveMapProcesses { + execveMap, err = ebpf.LoadPinnedMap(execveMapPath, &ebpf.LoadPinOptions{ReadOnly: true}) + if err != nil { + logger.GetLogger().WithError(err).Warn("failed to open execve_map") + return []*tetragon.ProcessInternal{} + } + defer execveMap.Close() } - defer execveMap.Close() var processes []*tetragon.ProcessInternal for _, v := range pc.cache.Values() { diff --git a/pkg/sensors/exec/cache_test.go b/pkg/sensors/exec/cache_test.go new file mode 100644 index 00000000000..816d06bbeb2 --- /dev/null +++ b/pkg/sensors/exec/cache_test.go @@ -0,0 +1,60 @@ +// SPDX-License-Identifier: Apache-2.0 +// Copyright Authors of Tetragon + +package exec + +import ( + "context" + "os/exec" + "sync" + "testing" + "time" + + "github.com/cilium/tetragon/api/v1/tetragon" + "github.com/cilium/tetragon/pkg/observer/observertesthelper" + "github.com/cilium/tetragon/pkg/process" + tus "github.com/cilium/tetragon/pkg/testutils/sensors" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" +) + +func processInList(pid uint32, processes []*tetragon.ProcessInternal) bool { + for _, p := range processes { + if p.Process.Pid.Value == pid { + return true + } + } + return false +} + +func TestProcessCacheInterval(t *testing.T) { + var doneWG, readyWG sync.WaitGroup + defer doneWG.Wait() + + ctx, cancel := context.WithTimeout(context.Background(), tus.Conf().CmdWaitTime) + defer cancel() + + sleepBin := "/bin/sleep" + + obs, err := observertesthelper.GetDefaultObserver(t, ctx, tus.Conf().TetragonLib, observertesthelper.WithProcCacheGcInterval(2*time.Second)) + if err != nil { + t.Fatalf("GetDefaultObserver error: %s", err) + } + observertesthelper.LoopEvents(ctx, t, &doneWG, &readyWG, obs) + + readyWG.Wait() + cmd := exec.Command(sleepBin, "1") + assert.NoError(t, cmd.Start()) + pid := cmd.Process.Pid + time.Sleep(1500 * time.Millisecond) + + processes := process.DumpProcessCache(&tetragon.DumpProcessCacheReqArgs{SkipZeroRefcnt: false, ExcludeExecveMapProcesses: false}) + // Should find our sleep process in the list, even though the process should have finished. + require.True(t, processInList(uint32(pid), processes)) + + time.Sleep(8 * time.Second) + processes = process.DumpProcessCache(&tetragon.DumpProcessCacheReqArgs{SkipZeroRefcnt: false, ExcludeExecveMapProcesses: false}) + // Should not find our sleep process in the list, as it should have been evicted by now. + require.False(t, processInList(uint32(pid), processes)) +}