tetragon: Separate execve sensor into taill called programs #456
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
olsajiri
force-pushed
the
execve_split
branch
3 times, most recently
from
b9dd8aa to
d0094ef
Compare
kkourt
reviewed
Oct 4, 2022
Adding mergeSensorMaps function that merges sensor maps together. Signed-off-by: Jiri Olsa <[email protected]>
Signed-off-by: Jiri Olsa <[email protected]>
Separating execve sensor into 2 programs: 1) event_execve 2) execve_send The 1) does the data retrieval and 2) sends event to the user space. This separation simplifies the code and allows us to move to clang 14, which generates un-verifiable code without the split. We can split 1) even further in future if needed, so far separating 2) simplified the code enough. Signed-off-by: Jiri Olsa <[email protected]>
Closed
kkourt
approved these changes
Oct 7, 2022
tixxdz
reviewed
Oct 7, 2022
jrfastab
reviewed
Oct 7, 2022
| @@ -185,10 +188,37 @@ event_execve(struct sched_execve_args *ctx) | |||
| fileoff = ctx->filename & 0xFFFF; | |||
| binary = event_filename_builder(ctx, execve, pid, EVENT_EXECVE, binary, | |||
| (char *)ctx + fileoff); | |||
| event->binary = binary; | |||
There was a problem hiding this comment.
this reads a bit strange I'm not sure why
event->binary = event_filename_builder(...)
is not used.
There was a problem hiding this comment.
ugh, will fix that in another PR, thanks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The execve is getting more complex and on 4.19 it's reaching
the maximum program size.
Splitting execve sensor into 2 (so far) tail called programs and
adjusting TestLoad* tests.
Signed-off-by: Jiri Olsa [email protected]