Feat: Support for pidfd_getfd syscall #1145

Rohith-Raju · 2023-06-07T12:54:50Z

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

area driver-kmod

area driver-bpf

area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap-engine-udig

area libscap

/area libpman

/area libsinsp

area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This PR adds support to pidfd_getfd syscall.

[UMBRELLA] Missing syscalls falco#1998

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

new: support for pidfd_getfd syscall

github-actions · 2023-06-07T12:55:15Z

Please double check driver/API_VERSION file. See versioning.

jasondellaluce · 2023-06-07T13:15:42Z

/milestone 0.12.0

hbrueckner · 2023-06-13T16:15:32Z

test/drivers/test_suites/syscall_exit_suite/execveat_x.cpp

@@ -174,7 +174,6 @@ TEST(SyscallExit, execveatX_correct_exit)
 	/* Prepare the execve args */
 	int dirfd = 0;
 	const char *pathname = "/usr/bin/echo";
-	const char *comm = "echo";


This line should not be removed as this is required below for the __s390x__ block. However, I have corrected this with PR #1150. Thanks.

uhm probably now we should remove it otherwise we will have it defined twice on s390x 🤔

On master this line is already removed and I have added it again for s390x with PR #1150 . I think this hunk above will go away with rebasing to latest master.

oh, bad trip hahaha! thank you for the hint

Andreagit97

Amazing work, thank you!

driver/bpf/fillers.h

Andreagit97 · 2023-06-14T15:17:11Z

driver/event_table.c

@@ -453,6 +453,8 @@ const struct ppm_event_info g_event_info[] = {
 	[PPME_SYSCALL_PRCTL_X] = {"prctl", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 4, {{"res", PT_ERRNO, PF_DEC}, {"option", PT_ENUMFLAGS32, PF_DEC, prctl_options}, {"arg2_str", PT_CHARBUF, PF_NA}, {"arg2_int", PT_INT64, PF_DEC} } },
 	[PPME_ASYNCEVENT_E] = {"asyncevent", EC_OTHER | EC_METAEVENT, EF_LARGE_PAYLOAD, 3, {{"plugin_id", PT_UINT32, PF_DEC}, {"name", PT_CHARBUF, PF_NA}, {"data", PT_BYTEBUF, PF_NA} } },
 	[PPME_ASYNCEVENT_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
+	[PPME_SYSCALL_PIDFD_GETFD_E] = {"pidfd_getfd", EC_PROCESS | EC_SYSCALL, EF_CREATES_FD | EF_NONE, 0},


we don't need the EF_NONE

Suggested change

[PPME_SYSCALL_PIDFD_GETFD_E] = {"pidfd_getfd", EC_PROCESS | EC_SYSCALL, EF_CREATES_FD | EF_NONE, 0},

[PPME_SYSCALL_PIDFD_GETFD_E] = {"pidfd_getfd", EC_PROCESS | EC_SYSCALL, EF_CREATES_FD, 0},

we still need to address it, same for exit event

driver/flags_table.c

driver/ppm_events_public.h

driver/ppm_fillers.c

driver/syscall_table.c

Andreagit97 · 2023-06-14T15:28:32Z

test/drivers/test_suites/syscall_exit_suite/execveat_x.cpp

@@ -174,7 +174,6 @@ TEST(SyscallExit, execveatX_correct_exit)
 	/* Prepare the execve args */
 	int dirfd = 0;
 	const char *pathname = "/usr/bin/echo";
-	const char *comm = "echo";


uhm probably now we should remove it otherwise we will have it defined twice on s390x 🤔

test/drivers/test_suites/syscall_exit_suite/pidfd_getfd_x.cpp

Signed-off-by: Rohith Raju <[email protected]>

Signed-off-by: rohith-raju <[email protected]>

Andreagit97

Left some really minor comments! Great job!
To bump the SCHEMA_VERSION you have to do exactly this 2f1c561
Please note that you have to change it from 2.4.1 to 2.5.1 as I've done in that commit since it is not yet merged, so you will be the first to bump it this time :)

driver/bpf/fillers.h

Andreagit97 · 2023-06-21T09:51:57Z

driver/event_table.c

@@ -453,6 +453,8 @@ const struct ppm_event_info g_event_info[] = {
 	[PPME_SYSCALL_PRCTL_X] = {"prctl", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 4, {{"res", PT_ERRNO, PF_DEC}, {"option", PT_ENUMFLAGS32, PF_DEC, prctl_options}, {"arg2_str", PT_CHARBUF, PF_NA}, {"arg2_int", PT_INT64, PF_DEC} } },
 	[PPME_ASYNCEVENT_E] = {"asyncevent", EC_OTHER | EC_METAEVENT, EF_LARGE_PAYLOAD, 3, {{"plugin_id", PT_UINT32, PF_DEC}, {"name", PT_CHARBUF, PF_NA}, {"data", PT_BYTEBUF, PF_NA} } },
 	[PPME_ASYNCEVENT_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
+	[PPME_SYSCALL_PIDFD_GETFD_E] = {"pidfd_getfd", EC_PROCESS | EC_SYSCALL, EF_CREATES_FD | EF_NONE, 0},


we still need to address it, same for exit event

driver/flags_table.c

driver/ppm_events_public.h

driver/ppm_fillers.c

driver/ppm_flag_helpers.h

test/drivers/test_suites/syscall_exit_suite/pidfd_getfd_x.cpp

driver/ppm_flag_helpers.h

driver/ppm_fillers.c

driver/SCHEMA_VERSION

Signed-off-by: rohith-raju <[email protected]>

Andreagit97

Thank you!
/approve

poiana · 2023-06-22T08:37:29Z

LGTM label has been added.

Git tree hash: 7a424fee13b674ef9e5d2847d28d108537db28fe

Andreagit97 · 2023-06-22T08:41:38Z

/hold

Signed-off-by: Andrea Terzolo <[email protected]>

Andreagit97

/approve
/unhold
sorry for the SCHEMA_VERSION dance now we should be finally ready!

poiana · 2023-06-22T08:47:00Z

LGTM label has been added.

Git tree hash: b72b12e6fff039dbeedd94a067095566fcd79dc4

hbrueckner

Thanks a lot @Rohith-Raju !

poiana · 2023-06-22T09:00:06Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, hbrueckner, Rohith-Raju

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Andreagit97]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

FedeDP · 2023-07-28T13:01:37Z

/milestone 5.1.0+driver

poiana added release-note dco-signoff: yes size/XL labels Jun 7, 2023

poiana requested review from Andreagit97 and hbrueckner June 7, 2023 12:55

poiana added this to the 0.12.0 milestone Jun 7, 2023

Andreagit97 modified the milestones: 0.12.0, driver-backlog, next-driver Jun 7, 2023

hbrueckner reviewed Jun 13, 2023

View reviewed changes

Andreagit97 mentioned this pull request Jun 14, 2023

[UMBRELLA] Missing syscalls falcosecurity/falco#1998

Open

35 tasks

Andreagit97 reviewed Jun 14, 2023

View reviewed changes

Rohith-Raju requested review from Andreagit97 and hbrueckner June 15, 2023 09:58

poiana added size/XXL and removed size/XL labels Jun 15, 2023

jasondellaluce force-pushed the pidfd_getfd branch from 43e17d2 to 1cf25be Compare June 15, 2023 10:47

poiana added size/XL and removed size/XXL labels Jun 15, 2023

Rohith-Raju force-pushed the pidfd_getfd branch from 1cf25be to 787fd9a Compare June 18, 2023 08:04

Rohith-Raju added 3 commits June 21, 2023 08:32

feat: support for syscall pidfd_getfd

e422fed

Signed-off-by: Rohith Raju <[email protected]>

Address review requests

d7232c1

Signed-off-by: Rohith Raju <[email protected]>

fix missed merge issues

43baf33

Signed-off-by: rohith-raju <[email protected]>

Rohith-Raju force-pushed the pidfd_getfd branch from 515c224 to 076293c Compare June 21, 2023 08:32

Andreagit97 reviewed Jun 21, 2023

View reviewed changes

Rohith-Raju force-pushed the pidfd_getfd branch from 076293c to 2a6d7d3 Compare June 21, 2023 14:23

Andreagit97 reviewed Jun 21, 2023

View reviewed changes

driver/ppm_flag_helpers.h Outdated Show resolved Hide resolved

driver/ppm_fillers.c Show resolved Hide resolved

Andreagit97 reviewed Jun 21, 2023

View reviewed changes

driver/SCHEMA_VERSION Outdated Show resolved Hide resolved

address review requests

c8fc8e0

Signed-off-by: rohith-raju <[email protected]>

Rohith-Raju force-pushed the pidfd_getfd branch from 2a6d7d3 to c8fc8e0 Compare June 22, 2023 03:22

Andreagit97 previously approved these changes Jun 22, 2023

View reviewed changes

poiana assigned Andreagit97 Jun 22, 2023

poiana added the lgtm label Jun 22, 2023

poiana added the approved label Jun 22, 2023

poiana added the do-not-merge/hold label Jun 22, 2023

chore: bump schema version

ece5324

Signed-off-by: Andrea Terzolo <[email protected]>

Andreagit97 dismissed their stale review via ece5324 June 22, 2023 08:45

poiana removed the lgtm label Jun 22, 2023

poiana requested a review from Andreagit97 June 22, 2023 08:45

Andreagit97 approved these changes Jun 22, 2023

View reviewed changes

poiana added lgtm and removed do-not-merge/hold labels Jun 22, 2023

Andreagit97 mentioned this pull request Jun 22, 2023

[TRAKING] Driver versions history #1158

Closed

hbrueckner approved these changes Jun 22, 2023

View reviewed changes

poiana assigned hbrueckner Jun 22, 2023

poiana merged commit a65fe73 into falcosecurity:master Jun 22, 2023

poiana modified the milestones: next-driver, 5.1.0+driver Jul 28, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feat: Support for pidfd_getfd syscall #1145

Feat: Support for pidfd_getfd syscall #1145

Rohith-Raju commented Jun 7, 2023 •

edited

Loading

github-actions bot commented Jun 7, 2023 •

edited

Loading

jasondellaluce commented Jun 7, 2023

hbrueckner Jun 13, 2023

Andreagit97 Jun 14, 2023

hbrueckner Jun 15, 2023

Andreagit97 Jun 15, 2023

Andreagit97 left a comment

Andreagit97 Jun 14, 2023

Andreagit97 Jun 21, 2023

Andreagit97 Jun 14, 2023

Andreagit97 left a comment

Andreagit97 Jun 21, 2023

Andreagit97 left a comment

poiana commented Jun 22, 2023

Andreagit97 commented Jun 22, 2023

Andreagit97 left a comment

poiana commented Jun 22, 2023

hbrueckner left a comment

poiana commented Jun 22, 2023

FedeDP commented Jul 28, 2023

	[PPME_SYSCALL_PIDFD_GETFD_E] = {"pidfd_getfd", EC_PROCESS \| EC_SYSCALL, EF_CREATES_FD \| EF_NONE, 0},
	[PPME_SYSCALL_PIDFD_GETFD_E] = {"pidfd_getfd", EC_PROCESS \| EC_SYSCALL, EF_CREATES_FD, 0},

Feat: Support for pidfd_getfd syscall #1145

Feat: Support for pidfd_getfd syscall #1145

Conversation

Rohith-Raju commented Jun 7, 2023 • edited Loading

github-actions bot commented Jun 7, 2023 • edited Loading

jasondellaluce commented Jun 7, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Andreagit97 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Andreagit97 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Andreagit97 left a comment

Choose a reason for hiding this comment

poiana commented Jun 22, 2023

Andreagit97 commented Jun 22, 2023

Andreagit97 left a comment

Choose a reason for hiding this comment

poiana commented Jun 22, 2023

hbrueckner left a comment

Choose a reason for hiding this comment

poiana commented Jun 22, 2023

FedeDP commented Jul 28, 2023

Rohith-Raju commented Jun 7, 2023 •

edited

Loading

github-actions bot commented Jun 7, 2023 •

edited

Loading