[CWS-6123] Implement pivot_root (#47935)

kovagsm · web-flow · commit 7fc93bdbdd71 · 2026-03-18T20:17:12.000Z
### What does this PR do?

Implement the pivot_root syscall

### Motivation

When containers are spawned and create their mounts, it uses pivot_root to pivot the mounted mountpoint to the root of the mount namespace. This wasn't being tracked and was creating erroneous mountpoints in our events.

### Describe how you validated your changes

* KMT tests
* Deployed on a cluster

Co-authored-by: marcio.kovags &lt;marcio.kovags@datadoghq.com&gt;
diff --git a/pkg/security/ebpf/c/include/constants/enums.h b/pkg/security/ebpf/c/include/constants/enums.h
@@ -74,6 +74,7 @@ enum event_type
     FAILED_DNS,
     EVENT_TRACER_MEMFD_CREATE,
     EVENT_TRACER_MEMFD_SEAL,
+    EVENT_PIVOT_ROOT,
     EVENT_NOP,
     EVENT_MAX, // has to be the last one
 
@@ -260,6 +261,7 @@ enum mount_source_t
     SOURCE_FSMOUNT,
     SOURCE_OPEN_TREE,
     SOURCE_MOVE_MOUNT,
+    SOURCE_PIVOT_ROOT,
 };
 
 #endif
diff --git a/pkg/security/ebpf/c/include/helpers/events_predicates.h b/pkg/security/ebpf/c/include/helpers/events_predicates.h
@@ -29,23 +29,23 @@ static int __attribute__((always_inline)) credentials_predicate(u64 type) {
 }
 
 static int __attribute__((always_inline)) mountpoint_predicate(u64 type) {
-    return type == EVENT_MOUNT || type == EVENT_UNSHARE_MNTNS || type == EVENT_OPEN_TREE || type == EVENT_MOVE_MOUNT;
+    return type == EVENT_MOUNT || type == EVENT_UNSHARE_MNTNS || type == EVENT_OPEN_TREE || type == EVENT_MOVE_MOUNT || type == EVENT_PIVOT_ROOT;
 }
 
 static int __attribute__((always_inline)) mount_or_open_tree(u64 type) {
     return type == EVENT_MOUNT || type == EVENT_OPEN_TREE;
 }
 
 static int __attribute__((always_inline)) unshare_or_move_mount(u64 type) {
-    return type == EVENT_UNSHARE_MNTNS || type == EVENT_MOVE_MOUNT;
+    return type == EVENT_UNSHARE_MNTNS || type == EVENT_MOVE_MOUNT || type == EVENT_PIVOT_ROOT;
 }
 
 static int __attribute__((always_inline)) mount_or_move_mount(u64 type) {
     return type == EVENT_MOUNT || type == EVENT_MOVE_MOUNT;
 }
 
 static int __attribute__((always_inline)) unshare_or_open_tree_or_move_mount(u64 type) {
-    return type == EVENT_UNSHARE_MNTNS || type == EVENT_OPEN_TREE || type == EVENT_MOVE_MOUNT;
+    return type == EVENT_UNSHARE_MNTNS || type == EVENT_OPEN_TREE || type == EVENT_MOVE_MOUNT || type == EVENT_PIVOT_ROOT;
 }
 
 #endif
diff --git a/pkg/security/ebpf/c/include/hooks/all.h b/pkg/security/ebpf/c/include/hooks/all.h
@@ -19,6 +19,7 @@
 #include "mprotect.h"
 #include "namespaces.h"
 #include "open.h"
+#include "pivot_root.h"
 #include "procfs.h"
 #include "ptrace.h"
 #include "raw_syscalls.h"
diff --git a/pkg/security/ebpf/c/include/hooks/mount.h b/pkg/security/ebpf/c/include/hooks/mount.h
@@ -259,7 +259,7 @@ int __attribute__((always_inline)) dr_mount_stage_two_callback(void *ctx) {
         return 0;
     }
 
-    if (syscall->type == EVENT_MOUNT || syscall->type == EVENT_OPEN_TREE || syscall->type == EVENT_MOVE_MOUNT) {
+    if (syscall->type == EVENT_MOUNT || syscall->type == EVENT_OPEN_TREE || syscall->type == EVENT_MOVE_MOUNT || syscall->type == EVENT_PIVOT_ROOT) {
         struct mount_event_t event = {
             .syscall.retval = 0,
             .syscall_ctx.id = syscall->ctx_id,
@@ -284,6 +284,11 @@ int __attribute__((always_inline)) dr_mount_stage_two_callback(void *ctx) {
                 event.source = SOURCE_MOVE_MOUNT;
             }
         }
+        if (syscall->type == EVENT_PIVOT_ROOT) {
+            event.source = SOURCE_PIVOT_ROOT;
+            send_event(ctx, EVENT_PIVOT_ROOT, event);
+            return 0;
+        }
         if (syscall->type == EVENT_MOVE_MOUNT) {
             send_event(ctx, EVENT_MOVE_MOUNT, event);
             return 0;
diff --git a/pkg/security/ebpf/c/include/hooks/pivot_root.h b/pkg/security/ebpf/c/include/hooks/pivot_root.h
@@ -0,0 +1,31 @@
+#ifndef _HOOKS_PIVOT_ROOT_H_
+#define _HOOKS_PIVOT_ROOT_H_
+
+#include "constants/syscall_macro.h"
+#include "helpers/syscalls.h"
+
+HOOK_SYSCALL_ENTRY0(pivot_root) {
+    struct syscall_cache_t syscall = {
+        .type = EVENT_PIVOT_ROOT,
+    };
+
+    cache_syscall(&syscall);
+
+    return 0;
+}
+
+int __attribute__((always_inline)) sys_pivot_root_ret(void *ctx, int retval) {
+    pop_syscall(EVENT_PIVOT_ROOT);
+    return 0;
+}
+
+HOOK_SYSCALL_EXIT(pivot_root) {
+    int retval = SYSCALL_PARMRET(ctx);
+    return sys_pivot_root_ret(ctx, retval);
+}
+
+TAIL_CALL_TRACEPOINT_FNC(handle_sys_pivot_root_exit, struct tracepoint_raw_syscalls_sys_exit_t *args) {
+    return sys_pivot_root_ret(args, args->ret);
+}
+
+#endif
diff --git a/pkg/security/ebpf/c/include/maps.h b/pkg/security/ebpf/c/include/maps.h
@@ -144,7 +144,7 @@ BPF_PROG_ARRAY(dentry_resolver_tracepoint_callbacks, EVENT_MAX)
 BPF_PROG_ARRAY(dentry_resolver_kprobe_or_fentry_progs, 6)
 BPF_PROG_ARRAY(dentry_resolver_tracepoint_progs, 3)
 BPF_PROG_ARRAY(classifier_router, 10)
-BPF_PROG_ARRAY(sys_exit_progs, 64)
+BPF_PROG_ARRAY(sys_exit_progs, EVENT_MAX)
 BPF_PROG_ARRAY(raw_packet_classifier_router, 32)
 BPF_PROG_ARRAY(flush_network_stats_progs, 2)
 BPF_PROG_ARRAY(open_ret_progs, 1)
diff --git a/pkg/security/ebpf/probes/event_types.go b/pkg/security/ebpf/probes/event_types.go
@@ -265,6 +265,7 @@ func GetSelectorsPerEventType(hasFentry bool, hasCgroupSocket bool) map[eval.Eve
 			&manager.BestEffort{Selectors: ExpandSyscallProbesSelector(SecurityAgentUID, "move_mount", hasFentry, EntryAndExit, false)},
 			&manager.BestEffort{Selectors: ExpandSyscallProbesSelector(SecurityAgentUID, "umount", hasFentry, Exit)},
 			&manager.OneOf{Selectors: ExpandSyscallProbesSelector(SecurityAgentUID, "unshare", hasFentry, EntryAndExit)},
+			&manager.BestEffort{Selectors: ExpandSyscallProbesSelector(SecurityAgentUID, "pivot_root", hasFentry, EntryAndExit)},
 			&manager.OneOf{Selectors: []manager.ProbesSelector{
 				hookFunc("hook_attach_mnt"),
 				hookFunc("hook___attach_mnt"),
diff --git a/pkg/security/ebpf/probes/mount.go b/pkg/security/ebpf/probes/mount.go
@@ -122,5 +122,11 @@ func getMountProbes(fentry bool) []*manager.Probe {
 		},
 		SyscallFuncName: "move_mount",
 	}, fentry, EntryAndExit)...)
+	mountProbes = append(mountProbes, ExpandSyscallProbes(&manager.Probe{
+		ProbeIdentificationPair: manager.ProbeIdentificationPair{
+			UID: SecurityAgentUID,
+		},
+		SyscallFuncName: "pivot_root",
+	}, fentry, EntryAndExit)...)
 	return mountProbes
 }
diff --git a/pkg/security/ebpf/probes/raw_sys_exit.go b/pkg/security/ebpf/probes/raw_sys_exit.go
@@ -226,5 +226,12 @@ func getSysExitTailCallRoutes() []manager.TailCallRoute {
 				EBPFFuncName: tailCallTracepointFnc("handle_sys_prctl_exit"),
 			},
 		},
+		{
+			ProgArrayName: "sys_exit_progs",
+			Key:           uint32(model.PivotRootEventType),
+			ProbeIdentificationPair: manager.ProbeIdentificationPair{
+				EBPFFuncName: tailCallTracepointFnc("handle_sys_pivot_root_exit"),
+			},
+		},
 	}
 }
diff --git a/pkg/security/probe/probe_ebpf.go b/pkg/security/probe/probe_ebpf.go
@@ -1240,7 +1240,7 @@ func (p *EBPFProbe) handleRegularEvent(event *model.Event, offset int, dataLen u
 	eventType := event.GetEventType()
 	switch eventType {
 
-	case model.FileMountEventType, model.FileMoveMountEventType:
+	case model.FileMountEventType, model.FileMoveMountEventType, model.PivotRootEventType:
 		if !p.regularUnmarshalEvent(&event.Mount, eventType, offset, dataLen, data) {
 			return false
 		}
@@ -2310,7 +2310,7 @@ func (p *EBPFProbe) handleNewMount(ev *model.Event, m *model.Mount) error {
 	// so we remove all dentry entries belonging to the mountID.
 	p.Resolvers.DentryResolver.DelCacheEntriesForMountID(m.MountID)
 
-	if !m.Detached && ev.GetEventType() != model.FileMoveMountEventType {
+	if !m.Detached && ev.GetEventType() != model.FileMoveMountEventType && ev.GetEventType() != model.PivotRootEventType {
 		// Resolve mount point
 		if err := p.Resolvers.PathResolver.SetMountPoint(ev, m); err != nil {
 			return fmt.Errorf("failed to set mount point: %w", err)
@@ -2323,7 +2323,7 @@ func (p *EBPFProbe) handleNewMount(ev *model.Event, m *model.Mount) error {
 	}
 
 	var err error
-	if ev.GetEventType() == model.FileMoveMountEventType {
+	if ev.GetEventType() == model.FileMoveMountEventType || ev.GetEventType() == model.PivotRootEventType {
 		err = p.Resolvers.MountResolver.InsertMoved(*m)
 	} else {
 		err = p.Resolvers.MountResolver.Insert(*m)
diff --git a/pkg/security/secl/model/category.go b/pkg/security/secl/model/category.go
@@ -157,6 +157,7 @@ func GetEventTypeCategory(eventType eval.EventType) EventCategory {
 		StatEventType.String(),
 		FileFsmountEventType.String(),
 		FileMoveMountEventType.String(),
+		PivotRootEventType.String(),
 		FileOpenTreeEventType.String(),
 		// windows
 		CreateNewFileEventType.String(),
diff --git a/pkg/security/secl/model/events.go b/pkg/security/secl/model/events.go
@@ -143,6 +143,8 @@ const (
 	TracerMemfdCreateEventType
 	// TracerMemfdSealEventType Tracer memfd seal event
 	TracerMemfdSealEventType
+	// PivotRootEventType is sent when pivot_root completes successfully
+	PivotRootEventType
 	// NopEventType nop event
 	NopEventType
 	// MaxKernelEventType is used internally to get the maximum number of kernel events.
@@ -338,6 +340,8 @@ func (t EventType) String() string {
 		return "tracer_memfd_create"
 	case TracerMemfdSealEventType:
 		return "tracer_memfd_seal"
+	case PivotRootEventType:
+		return "pivot_root"
 	case NopEventType:
 		return "nop"
 	default:
diff --git a/pkg/security/secl/model/model_helpers_unix.go b/pkg/security/secl/model/model_helpers_unix.go
@@ -262,6 +262,7 @@ const (
 	MountOriginOpenTree                     // MountOriginOpenTree mount point created from the open_tree syscall
 	MountOriginListmount                    // MountOriginListmount mount point obtained by calling `listmount`
 	MountOriginMoveMount
+	MountOriginPivotRoot // MountOriginPivotRoot mount point info from the pivot_root syscall
 )
 
 // MountSource source of the mount
@@ -288,7 +289,8 @@ const (
 	MountEventSourceMountSyscall                             // MountEventSourceMountSyscall the source of the mount event is the `mount` syscall
 	MountEventSourceFsmountSyscall                           // MountEventSourceFsmountSyscall the source of the mount event is the `fsmount` syscall
 	MountEventSourceOpenTreeSyscall                          // MountEventSourceOpenTreeSyscall the source of the mount event is the `open_tree` syscall
-	MountEventSourceMoveMountSyscall                         // MountEventSourceOpenTreeSyscall the source of the mount event is the `open_tree` syscall
+	MountEventSourceMoveMountSyscall                         // MountEventSourceMoveMountSyscall the source of the mount event is the `move_mount` syscall
+	MountEventSourcePivotRootSyscall                         // MountEventSourcePivotRootSyscall the source of the mount event is the `pivot_root` syscall
 )
 
 // MountSourceToString returns the string corresponding to a mount source
@@ -306,6 +308,7 @@ var MountOrigins = [...]string{
 	"open_tree",
 	"listmount",
 	"move_mount",
+	"pivot_root",
 }
 
 // MountOriginToString returns the string corresponding to a mount origin
diff --git a/pkg/security/secl/model/unmarshallers_linux.go b/pkg/security/secl/model/unmarshallers_linux.go
@@ -494,6 +494,8 @@ func (e *MountEvent) UnmarshalBinary(data []byte) (int, error) {
 		e.Mount.Origin = MountOriginFsmount
 	case MountEventSourceMoveMountSyscall:
 		e.Mount.Origin = MountOriginMoveMount
+	case MountEventSourcePivotRootSyscall:
+		e.Mount.Origin = MountOriginPivotRoot
 	}
 	e.Origin = e.Mount.Origin
 	return n + 4, nil
diff --git a/pkg/security/secl/schemas/file.schema.json b/pkg/security/secl/schemas/file.schema.json
@@ -49,7 +49,7 @@
         },
         "mount_origin": {
             "type": "string",
-            "enum": ["procfs", "event", "unshare", "fsmount", "open_tree", "listmount"]
+            "enum": ["procfs", "event", "unshare", "fsmount", "open_tree", "listmount", "move_mount", "pivot_root"]
         }
     },
     "required": [
diff --git a/pkg/security/secl/schemas/process.schema.json b/pkg/security/secl/schemas/process.schema.json
@@ -189,7 +189,9 @@
                         "unshare",
                         "fsmount",
                         "open_tree",
-                        "listmount"
+                        "listmount",
+                        "move_mount",
+                        "pivot_root"
                     ]
                 }
             },
diff --git a/pkg/security/seclwin/model/events.go b/pkg/security/seclwin/model/events.go
diff --git a/pkg/security/serializers/serializers_linux.go b/pkg/security/serializers/serializers_linux.go
@@ -1753,7 +1753,7 @@ func NewEventSerializer(event *model.Event, rule *rules.Rule, scrubber *utils.Sc
 		s.SyscallContextSerializer = newSyscallContextSerializer(&event.Utimes.SyscallContext, event, func(ctx *SyscallContextSerializer, args *SyscallArgsSerializer) {
 			ctx.Utimes = args
 		})
-	case model.FileMountEventType:
+	case model.FileMountEventType, model.PivotRootEventType:
 		s.MountEventSerializer = newMountEventSerializer(event)
 		s.EventContextSerializer.Outcome = serializeOutcome(event.Mount.Retval)
 		s.SyscallContextSerializer = newSyscallContextSerializer(&event.Mount.SyscallContext, event, func(ctx *SyscallContextSerializer, args *SyscallArgsSerializer) {
diff --git a/pkg/security/tests/pivot_root_test.go b/pkg/security/tests/pivot_root_test.go

Original file line number	Diff line number	Diff line change
`@@ -29,23 +29,23 @@ static int __attribute__((always_inline)) credentials_predicate(u64 type) {`
`29`	`29`	`}`
`30`	`30`
`31`	`31`	`static int __attribute__((always_inline)) mountpoint_predicate(u64 type) {`
`32`		`- return type == EVENT_MOUNT \|\| type == EVENT_UNSHARE_MNTNS \|\| type == EVENT_OPEN_TREE \|\| type == EVENT_MOVE_MOUNT;`
	`32`	`+ return type == EVENT_MOUNT \|\| type == EVENT_UNSHARE_MNTNS \|\| type == EVENT_OPEN_TREE \|\| type == EVENT_MOVE_MOUNT \|\| type == EVENT_PIVOT_ROOT;`
`33`	`33`	`}`
`34`	`34`
`35`	`35`	`static int __attribute__((always_inline)) mount_or_open_tree(u64 type) {`
`36`	`36`	`return type == EVENT_MOUNT \|\| type == EVENT_OPEN_TREE;`
`37`	`37`	`}`
`38`	`38`
`39`	`39`	`static int __attribute__((always_inline)) unshare_or_move_mount(u64 type) {`
`40`		`- return type == EVENT_UNSHARE_MNTNS \|\| type == EVENT_MOVE_MOUNT;`
	`40`	`+ return type == EVENT_UNSHARE_MNTNS \|\| type == EVENT_MOVE_MOUNT \|\| type == EVENT_PIVOT_ROOT;`
`41`	`41`	`}`
`42`	`42`
`43`	`43`	`static int __attribute__((always_inline)) mount_or_move_mount(u64 type) {`
`44`	`44`	`return type == EVENT_MOUNT \|\| type == EVENT_MOVE_MOUNT;`
`45`	`45`	`}`
`46`	`46`
`47`	`47`	`static int __attribute__((always_inline)) unshare_or_open_tree_or_move_mount(u64 type) {`
`48`		`- return type == EVENT_UNSHARE_MNTNS \|\| type == EVENT_OPEN_TREE \|\| type == EVENT_MOVE_MOUNT;`
	`48`	`+ return type == EVENT_UNSHARE_MNTNS \|\| type == EVENT_OPEN_TREE \|\| type == EVENT_MOVE_MOUNT \|\| type == EVENT_PIVOT_ROOT;`
`49`	`49`	`}`
`50`	`50`
`51`	`51`	`#endif`
Original file line number	Diff line number	Diff line change
`@@ -259,7 +259,7 @@ int __attribute__((always_inline)) dr_mount_stage_two_callback(void *ctx) {`
`259`	`259`	`return 0;`
`260`	`260`	`}`
`261`	`261`
`262`		`- if (syscall->type == EVENT_MOUNT \|\| syscall->type == EVENT_OPEN_TREE \|\| syscall->type == EVENT_MOVE_MOUNT) {`
	`262`	`+ if (syscall->type == EVENT_MOUNT \|\| syscall->type == EVENT_OPEN_TREE \|\| syscall->type == EVENT_MOVE_MOUNT \|\| syscall->type == EVENT_PIVOT_ROOT) {`
`263`	`263`	`struct mount_event_t event = {`
`264`	`264`	`.syscall.retval = 0,`
`265`	`265`	`.syscall_ctx.id = syscall->ctx_id,`
`@@ -284,6 +284,11 @@ int __attribute__((always_inline)) dr_mount_stage_two_callback(void *ctx) {`
`284`	`284`	`event.source = SOURCE_MOVE_MOUNT;`
`285`	`285`	`}`
`286`	`286`	`}`
	`287`	`+ if (syscall->type == EVENT_PIVOT_ROOT) {`
	`288`	`+ event.source = SOURCE_PIVOT_ROOT;`
	`289`	`+ send_event(ctx, EVENT_PIVOT_ROOT, event);`
	`290`	`+ return 0;`
	`291`	`+ }`
`287`	`292`	`if (syscall->type == EVENT_MOVE_MOUNT) {`
`288`	`293`	`send_event(ctx, EVENT_MOVE_MOUNT, event);`
`289`	`294`	`return 0;`
Original file line number	Diff line number	Diff line change
`@@ -226,5 +226,12 @@ func getSysExitTailCallRoutes() []manager.TailCallRoute {`
`226`	`226`	`EBPFFuncName: tailCallTracepointFnc("handle_sys_prctl_exit"),`
`227`	`227`	`},`
`228`	`228`	`},`
	`229`	`+ {`
	`230`	`+ ProgArrayName: "sys_exit_progs",`
	`231`	`+ Key: uint32(model.PivotRootEventType),`
	`232`	`+ ProbeIdentificationPair: manager.ProbeIdentificationPair{`
	`233`	`+ EBPFFuncName: tailCallTracepointFnc("handle_sys_pivot_root_exit"),`
	`234`	`+ },`
	`235`	`+ },`
`229`	`236`	`}`
`230`	`237`	`}`