new(driver,userspace/libsinsp): added support for state modifying `epoll_create` and `epoll_create1`. by FedeDP · Pull Request #596 · falcosecurity/libs

FedeDP · 2022-09-12T08:16:48Z

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area driver-kmod
/area driver-bpf
/area libsinsp

Does this PR require a change in the driver versions?

Yep, because it adds a new event.

/version driver-SCHEMA-version-minor

What this PR does / why we need it:

Adds support for epoll_create and epoll_create1 syscalls, because they create a FD thus are needed for sinsp state.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

new: support `epoll_create` and `epoll_create1` syscalls.

FedeDP · 2022-09-12T12:06:36Z

Github 503 :/

jasondellaluce

LGTM

Andreagit97 · 2022-09-12T14:12:53Z

Probably we need to add them also in the modern probe
/hold

LucaGuerra · 2022-09-12T16:08:11Z

Would this case fit along the others in the creates_fd_generic test you recently added?

FedeDP · 2022-09-13T06:51:55Z

Would this case fit along the others in the creates_fd_generic test you recently added?

Done!

Probably we need to add them also in the modern probe

Done!

@LucaGuerra @Andreagit97

hbrueckner · 2022-09-13T07:25:57Z

Probably we need to add them also in the modern probe

Done!

Awesome @FedeDP . I will look later thru the patch set. Thanks.

FedeDP · 2022-09-13T07:28:16Z

But epoll_create1 tests are failing and i don't get why :/

hbrueckner · 2022-09-13T08:19:31Z

But epoll_create1 tests are failing and i don't get why :/

Looks like the syscall passes but does not create an event:

[ RUN      ] SyscallEnter.epoll_create1E
HALLO: fd=245 errno=Success
/root/git/falcosecurity/libs/test/modern_bpf/event_class/event_class.cpp:378: Failure
Failed
There is no event in the buffer.

with using printf("HALLO: fd=%i errno=%s\n", fd, strerror(errno));

hbrueckner · 2022-09-13T09:12:42Z

@FedeDP Tests pass on s390x:

# ./test/modern_bpf/bpf_test  |grep epoll
[ RUN      ] SyscallExit.epoll_create1X
[       OK ] SyscallExit.epoll_create1X (0 ms)
[ RUN      ] SyscallExit.epoll_createX
[       OK ] SyscallExit.epoll_createX (0 ms)
[ RUN      ] SyscallEnter.epoll_create1E
[       OK ] SyscallEnter.epoll_create1E (0 ms)
[ RUN      ] SyscallEnter.epoll_createE
[       OK ] SyscallEnter.epoll_createE (0 ms)

will review then later.

hbrueckner

@FedeDP Reviewed the modern bpf part. Few minor typos and we should map the flags to scap.

driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_create.bpf.c

driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_create1.bpf.c

FedeDP · 2022-09-13T10:50:51Z

@hbrueckner fixed everything!

hbrueckner

@FedeDP only minor comments for kernel / bpf driver.

driver/bpf/fillers.h

hbrueckner · 2022-09-13T14:51:43Z

@FedeDP other the minors above, this looks good to me.
/lgtm

Moreover, actually make mlock2 use correct flags, instead of mlockall ones. Finally, fixed sinsp tests on syscall-driver events number. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP · 2022-10-28T07:57:48Z

Rebased on top of master.

poiana · 2022-10-28T14:28:34Z

LGTM label has been added.

Details

Git tree hash: 8daa64dbb061e4f2e87d90f356b29bbf5f80b615

Andreagit97

Amazing work as always!

driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/epoll_create1.bpf.c

driver/ppm_flag_helpers.h

driver/modern_bpf/definitions/events_dimensions.h

driver/ppm_fillers.c

driver/ppm_flag_helpers.h

test/modern_bpf/test_suites/syscall_enter_suite/epoll_create1_e.cpp

FedeDP · 2022-10-31T09:06:41Z

@Andreagit97 thanks for your review! Addressed in latest commit!

Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Andrea Terzolo <andreaterzolo@polito.it>

Andreagit97

/approve

poiana · 2022-10-31T10:06:21Z

LGTM label has been added.

Details

Git tree hash: b57738ff9664e41821f9765b3a8adcd2cbccef33

poiana · 2022-10-31T12:52:51Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, hbrueckner, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [Andreagit97,FedeDP,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

FedeDP · 2022-10-31T13:02:13Z

/unhold

poiana added kind/feature New feature or request release-note dco-signoff: yes area/driver-kmod area/driver-bpf area/libsinsp approved labels Sep 12, 2022

poiana requested review from hbrueckner and mstemm September 12, 2022 08:16

poiana added the size/L label Sep 12, 2022

FedeDP force-pushed the new/epoll_create branch from 17e5b30 to 1d1080e Compare September 12, 2022 11:06

jasondellaluce reviewed Sep 12, 2022

View reviewed changes

poiana added the do-not-merge/hold label Sep 12, 2022

FedeDP force-pushed the new/epoll_create branch from 1d1080e to d1d9ce6 Compare September 13, 2022 06:51

poiana added size/XL and removed size/L labels Sep 13, 2022

hbrueckner requested changes Sep 13, 2022

View reviewed changes

poiana assigned hbrueckner Sep 13, 2022

hbrueckner reviewed Sep 13, 2022

View reviewed changes

driver/bpf/fillers.h Outdated Show resolved Hide resolved

driver/bpf/fillers.h Outdated Show resolved Hide resolved

poiana added the lgtm label Sep 13, 2022

FedeDP added 4 commits October 28, 2022 09:56

chore(driver,userspace): fixed epoll_create1 flags terminator value.

2e241ee

Moreover, actually make mlock2 use correct flags, instead of mlockall ones. Finally, fixed sinsp tests on syscall-driver events number. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

fix(driver): add back cut line.

51ec22b

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

fix(userspace/libsinsp): fixed ppm_sc_set tests.

5e057d3

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

update(driver): bump schema version minor.

2a0dcdb

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP dismissed leogr’s stale review via 2a0dcdb October 28, 2022 07:57

FedeDP force-pushed the new/epoll_create branch from b63125e to 2a0dcdb Compare October 28, 2022 07:57

poiana removed the lgtm label Oct 28, 2022

poiana requested a review from leogr October 28, 2022 07:57

leogr previously approved these changes Oct 28, 2022

View reviewed changes

poiana added the lgtm label Oct 28, 2022

Andreagit97 reviewed Oct 29, 2022

View reviewed changes

FedeDP dismissed leogr’s stale review via 4509227 October 31, 2022 09:06

poiana removed the lgtm label Oct 31, 2022

poiana requested a review from leogr October 31, 2022 09:06

FedeDP force-pushed the new/epoll_create branch from 4509227 to e41fff2 Compare October 31, 2022 09:33

chore(driver, test): address review comments.

bb06017

Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Andrea Terzolo <andreaterzolo@polito.it>

FedeDP force-pushed the new/epoll_create branch from e41fff2 to bb06017 Compare October 31, 2022 09:48

Andreagit97 approved these changes Oct 31, 2022

View reviewed changes

poiana assigned Andreagit97 Oct 31, 2022

poiana added the lgtm label Oct 31, 2022

leogr approved these changes Oct 31, 2022

View reviewed changes

poiana removed the do-not-merge/hold label Oct 31, 2022

poiana merged commit 212870e into master Oct 31, 2022

poiana deleted the new/epoll_create branch October 31, 2022 13:02

Conversation

FedeDP commented Sep 12, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

FedeDP commented Sep 12, 2022

Uh oh!

jasondellaluce left a comment

Choose a reason for hiding this comment

Uh oh!

Andreagit97 commented Sep 12, 2022

Uh oh!

LucaGuerra commented Sep 12, 2022

Uh oh!

FedeDP commented Sep 13, 2022

Uh oh!

hbrueckner commented Sep 13, 2022

Uh oh!

FedeDP commented Sep 13, 2022

Uh oh!

hbrueckner commented Sep 13, 2022

Uh oh!

hbrueckner commented Sep 13, 2022

Uh oh!

hbrueckner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

FedeDP commented Sep 13, 2022

Uh oh!

hbrueckner left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

hbrueckner commented Sep 13, 2022

Uh oh!

FedeDP commented Oct 28, 2022

Uh oh!

poiana commented Oct 28, 2022

Uh oh!

Andreagit97 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

FedeDP commented Oct 31, 2022

Uh oh!

Andreagit97 left a comment

Choose a reason for hiding this comment

Uh oh!

poiana commented Oct 31, 2022

Uh oh!

poiana commented Oct 31, 2022

Uh oh!

FedeDP commented Oct 31, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

FedeDP commented Sep 12, 2022 •

edited

Loading