new(driver,userspace): automatically generate syscall_info_table entries at startup time by FedeDP · Pull Request #649 · falcosecurity/libs

FedeDP · 2022-10-03T10:06:00Z

What type of PR is this?

/kind cleanup
/kind feature

Any specific area of the project related to this PR?

/area driver-kmod
/area driver-bpf
/area driver-modern-bpf
/area libscap
/area libsinsp

Does this PR require a change in the driver versions?

I don't think so since we are using the automatic generic filler / event.

What this PR does / why we need it:

We use a lazy generation, ie: first time scap_get_syscall_info_table is called, we fill the table.

The table is filled with correct names; the category is either fetched from the event_table, or EC_UNKNOWN (for syscalls that have no event attached, and use the generic one).

Moreover, added generic event support for falcosecurity/falco#1998 syscalls; they won't use any specific filler, just the automatic generic one, and there is no even mapping for them.

Only downside: we lost the ability to mark "generic" syscalls with a proper category. I don't think it is a huge downside, yet i want to highlight it.

Which issue(s) this PR fixes:

We add string-support (through generic event) for all syscalls listed here: falcosecurity/falco#1998

A proper specific filler where needed, will be introduced in subsequent PRs.

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

FedeDP · 2022-10-03T10:12:43Z

driver/ppm_events_public.h

 * System-independent syscall codes
 */
+
+#define PPM_SC_FIELDS \


We use an X_MACRO to be able to automatically generate syscall names from PPM_SC code name, while filling the syscall_info_table.

FedeDP · 2022-10-03T10:13:27Z

userspace/libscap/examples/01-open/scap_open.c

 extern const struct ppm_event_info g_event_info[PPM_EVENT_MAX];
 extern const struct syscall_evt_pair g_syscall_table[SYSCALL_TABLE_SIZE];

+static const struct ppm_syscall_desc *g_syscall_info_table;


Cleanup: use static where it makes sense.

FedeDP · 2022-10-03T10:13:49Z

userspace/libscap/examples/01-open/scap_open.c

 		return EXIT_FAILURE;
 	}

+	g_syscall_info_table = scap_get_syscall_info_table();


Fill our syscall_info_table from data gathered by libscap, triggering syscall_info_table filling.

FedeDP · 2022-10-03T10:14:01Z

userspace/libscap/scap.h

 */
 struct ppm_syscall_desc {
 	enum ppm_event_category category; /**< System call category. */
-	enum ppm_event_flags flags;


Flags where unused.

FedeDP · 2022-10-03T10:14:47Z

userspace/libscap/scap.h

 	enum ppm_event_category category; /**< System call category. */
-	enum ppm_event_flags flags;
-	char *name; /**< System call name, e.g. 'open'. */
+	char name[PPM_MAX_NAME_LEN]; /**< System call name, e.g. 'open'. */


We need to do some small trickery to obtain a lowercase string, thus the need to make this a char array.

FedeDP · 2022-10-03T10:17:18Z

TODO:

fix non-linux CI.

FedeDP · 2022-10-04T07:22:36Z

Rebased on top of master.

FedeDP · 2022-10-05T11:19:56Z

driver/syscall_table.c

 #endif
 #ifdef __NR_rt_sigreturn
-	[__NR_rt_sigreturn - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_SIGRETURN},
+	[__NR_rt_sigreturn - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_RT_SIGRETURN},


Renamed to match real syscall name.

FedeDP · 2022-10-05T11:20:00Z

driver/syscall_table.c

 #endif
 #ifdef __NR_newfstatat
-	[__NR_newfstatat - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_NEWFSSTAT},
+	[__NR_newfstatat - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_NEWFSTATAT},


Renamed to match real syscall name.

FedeDP · 2022-10-05T11:21:12Z

userspace/libsinsp/parsers.cpp

 			sinsp_evt_param *parinfo = evt->get_param(0);
 			uint16_t evid = *(uint16_t *)parinfo->m_val;
-			flags = g_infotables.m_syscall_info_table[evid].flags;
+			flags = EF_NONE;


All flags were already EF_NONE anyway.

This looks like the kind of change that is small enough to be ignored, yet can bring headaches to other people in the future. Could you elaborate on why do we need this change? If the only reason is the one you already provided, I would roll this back.

Well, we do not need flags in syscall info table; when they were present (and they are not present since some months now) they were just using the EF_DROP_SIMPLE_CONS one, that is now useless.
I think it creates more tech debt than its provided value (that is near 0 btw :D )

Then IMO the flags should be removed entirely and not silently escaped in a single place, this way we still have the flags field floating around, but it is not doing anything and can lead people to believing it is still being used. I would roll this back and open a PR properly removing flags entirely, would that make sense?

Mmh there is no flags field anymore:

struct ppm_syscall_desc { enum ppm_event_category category; /**< System call category. */ char name[PPM_MAX_NAME_LEN]; /**< System call name, e.g. 'open'. */ };

I think i am misunderstanding something here :D

I missed that, it's still early for me, guess I need more coffee.

ahahahah no problem my man! ☕

Then how about initializing the variable when declared in line 156 and removing this line entirely? That would make it really explicit that flags are no longer used in the case of generic events.

Yeah that's true, but at the same time it would be less explicit about handling the special generic case. I mean, if 2 months from now one decides to remove the initialization, we would end up reading garbage in case of generic events.
I don't know, it's a tradeoff :)

FedeDP · 2022-10-05T11:21:51Z

userspace/libsinsp/examples/util.cpp

 // Get the string representation of a ppm_event_type
 //
-std::string get_event_type_name(uint16_t type)
+std::string get_event_type_name(sinsp& inspector, sinsp_evt* ev)


Use same logic used in evt.type filtercheck!

userspace/libsinsp/filterchecks.cpp

FedeDP · 2022-10-17T10:21:58Z

You're welcome Mauro 💯

jasondellaluce

LGTM! This is a huge step forward!

Andreagit97 · 2022-10-20T10:49:43Z

/hold

Andreagit97

/approve

…ies at startup time. We use a lazy generation, ie: first time `scap_get_syscall_info_table` is called, we fill the table. The table is filled with correct names; the category is either fetched from the event_table, or EC_UNKNOWN (for syscalls that have no event attached, and use the generic one). Moreover, added generic event support for falcosecurity/falco#1998 syscalls; they won't use any specific filler, just the automatic generic one, and there is no even mapping for them. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

…ting evt.type in capture mode. If a ppm_sc is unknown, for generic enter events, try to use real syscall nr to fetch correct ppm_sc. This allows forward compatibility of scap files: even if scap file has some unknown events at creation time, if proper syscalls are added afterwards, their name will appear. Signed-off-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Andrea Terzolo <andrea.terzolo@polito.it>

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

…to also use syscall_info_table. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

… name. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com> Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com> Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP · 2022-10-25T15:44:13Z

Rebased on top of master @Andreagit97 @Molter73 !

Andreagit97

/approve

poiana · 2022-10-25T16:05:01Z

LGTM label has been added.

Details

Git tree hash: 7cdb2bed79147e4d95e89d099709fd5ac31d070e

leogr

🚀

poiana · 2022-10-26T13:57:30Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, leogr, Molter73

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [Andreagit97,FedeDP,Molter73,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

FedeDP · 2022-10-26T13:58:41Z

/unhold

poiana added release-note-none kind/cleanup dco-signoff: yes kind/feature New feature or request area/driver-kmod area/driver-bpf approved area/driver-modern-bpf area/libscap labels Oct 3, 2022

poiana requested review from hbrueckner and mstemm October 3, 2022 10:06

poiana added area/libsinsp size/XXL labels Oct 3, 2022

Andreagit97 added this to the 0.10.0 milestone Oct 3, 2022

FedeDP mentioned this pull request Oct 3, 2022

[UMBRELLA] Missing syscalls falcosecurity/falco#1998

Closed

35 tasks

FedeDP commented Oct 3, 2022

View reviewed changes

FedeDP force-pushed the new/autogen_syscall_info_table branch from 94678ba to 8732451 Compare October 4, 2022 07:22

FedeDP mentioned this pull request Oct 4, 2022

wip: fix: PT_FD, PT_ERRNO, PT_PID, PT_FDLIST with int32 #526

Closed

FedeDP commented Oct 5, 2022

View reviewed changes

userspace/libsinsp/filterchecks.cpp Outdated Show resolved Hide resolved

FedeDP mentioned this pull request Oct 5, 2022

wip: chore/improvements #298

Closed

FedeDP mentioned this pull request Oct 17, 2022

Donate fededp/syscalls-bumper to falcosecurity falcosecurity/evolution#209

Closed

jasondellaluce reviewed Oct 20, 2022

View reviewed changes

poiana added the do-not-merge/hold label Oct 20, 2022

Andreagit97 previously approved these changes Oct 20, 2022

View reviewed changes

FedeDP and others added 7 commits October 25, 2022 17:43

fix(userspace/libscap): allow build on non-linux oses.

64f1844

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

chore(userspace/libsinsp): fixed libsinsp example event type fetcher …

2e0db5c

…to also use syscall_info_table. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

chore(driver): updated a couple of PPM_SC codes using correct syscall…

1cd98cd

… name. Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

chore: addressed PR review.

83c8272

Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

chore(userspace/libscap): minor change.

a0efa5f

Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com> Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com> Signed-off-by: Federico Di Pierro <nierro92@gmail.com>

FedeDP dismissed stale reviews from Andreagit97 and Molter73 via a0efa5f October 25, 2022 15:44

FedeDP force-pushed the new/autogen_syscall_info_table branch from 6793c9c to a0efa5f Compare October 25, 2022 15:44

poiana removed the lgtm label Oct 25, 2022

poiana requested review from Andreagit97 and Molter73 October 25, 2022 15:44

Andreagit97 approved these changes Oct 25, 2022

View reviewed changes

poiana added the lgtm label Oct 25, 2022

leogr approved these changes Oct 26, 2022

View reviewed changes

poiana assigned leogr Oct 26, 2022

poiana removed the do-not-merge/hold label Oct 26, 2022

poiana merged commit e3bac2a into master Oct 26, 2022

poiana deleted the new/autogen_syscall_info_table branch October 26, 2022 13:59

Conversation

FedeDP commented Oct 3, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

FedeDP commented Oct 3, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

FedeDP commented Oct 4, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

FedeDP Oct 5, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

FedeDP commented Oct 17, 2022

Uh oh!

jasondellaluce left a comment

Choose a reason for hiding this comment

Uh oh!

Andreagit97 commented Oct 20, 2022

Uh oh!

Andreagit97 left a comment

Choose a reason for hiding this comment

Uh oh!

FedeDP commented Oct 25, 2022

Uh oh!

Andreagit97 left a comment

Choose a reason for hiding this comment

Uh oh!

poiana commented Oct 25, 2022

Uh oh!

leogr left a comment

Choose a reason for hiding this comment

Uh oh!

poiana commented Oct 26, 2022

Uh oh!

FedeDP commented Oct 26, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

FedeDP commented Oct 3, 2022 •

edited

Loading

FedeDP commented Oct 3, 2022 •

edited

Loading

FedeDP Oct 5, 2022 •

edited

Loading