Skip to content

Commit faa51c7

Browse files
kobrinelikobrineli
committed
fix
pin and update map only when option is enabled. check for event_clone flag instead of cleanup process pid Signed-off-by: Kobrin Ilay <[email protected]>
1 parent 9bf2e78 commit faa51c7

File tree

12 files changed

+90
-49
lines changed

12 files changed

+90
-49
lines changed

‎bpf/lib/process.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -366,6 +366,10 @@ struct {
366366
__type(value, struct binary);
367367
} binary_heap_map SEC(".maps");
368368

369+
// Parent binaries map is used for saving actual immediate parents
370+
// for processes to get check them in matchParentBinaries selector.
371+
// If multiple execs are called in same process without fork, the map
372+
// stores process binary itself instead of its parent binary.
369373
struct {
370374
__uint(type, BPF_MAP_TYPE_LRU_HASH);
371375
__uint(max_entries, 1);

‎bpf/process/bpf_execve_event.c‎

Lines changed: 31 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -342,6 +342,36 @@ execve_rate(void *ctx __arg_ctx)
342342
return 0;
343343
}
344344

345+
#ifdef __LARGE_BPF_PROG
346+
volatile const __u8 PARENTS_MAP_ENABLED;
347+
348+
FUNC_INLINE void update_parents_map(struct msg_execve_event *event, struct execve_map_value *curr)
349+
{
350+
if (PARENTS_MAP_ENABLED) {
351+
__u32 zero = 0;
352+
struct binary *bin = map_lookup_elem(&binary_heap_map, &zero);
353+
354+
if (bin) {
355+
// use current binary as parent binary if exec events is not preceded
356+
// by clone, i.e. exec call was invoked in the same process.
357+
if (!(event->process.flags & EVENT_CLONE)) {
358+
memcpy(bin, &curr->bin, sizeof(curr->bin));
359+
map_update_elem(&parent_binaries_map, &curr->key.pid, bin, BPF_ANY);
360+
} else {
361+
struct execve_map_value *parent = event_find_parent();
362+
363+
if (parent)
364+
map_update_elem(&parent_binaries_map, &curr->key.pid, &parent->bin, BPF_ANY);
365+
}
366+
}
367+
}
368+
}
369+
#else
370+
FUNC_INLINE void update_parents_map(struct msg_execve_event *event, struct execve_map_value *curr)
371+
{
372+
}
373+
#endif
374+
345375
/**
346376
* execve_send() sends the collected execve event data.
347377
*
@@ -415,22 +445,7 @@ execve_send(struct exec_ctx_struct *ctx __arg_ctx)
415445
}
416446
#endif
417447

418-
__u32 zero = 0;
419-
struct binary *bin = map_lookup_elem(&binary_heap_map, &zero);
420-
421-
if (bin) {
422-
// use current binary as parent binary if cleanup pid is equal to current pid,
423-
// i.e. exec call was invoked in the same process.
424-
if (curr->key.pid == event->cleanup_key.pid) {
425-
memcpy(bin, &curr->bin, sizeof(curr->bin));
426-
map_update_elem(&parent_binaries_map, &curr->key.pid, bin, BPF_ANY);
427-
} else {
428-
struct execve_map_value *parent = event_find_parent();
429-
430-
if (parent)
431-
map_update_elem(&parent_binaries_map, &curr->key.pid, &parent->bin, BPF_ANY);
432-
}
433-
}
448+
update_parents_map(event, curr);
434449

435450
/* zero out previous paths in ->bin */
436451
binary_reset(&curr->bin);

‎bpf/process/pfilter.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -432,7 +432,7 @@ selector_process_filter(__u32 *f, __u32 index, struct execve_map_value *enter,
432432
struct binary *parent_bin = map_lookup_elem(&parent_binaries_map, &enter->key.pid);
433433

434434
if (parent_bin)
435-
/* matchParentBinaries key is in rage [MAX_SELECTORS; MAX_SELECTORS * 2) */
435+
/* matchParentBinaries key is in range [MAX_SELECTORS; MAX_SELECTORS * 2) */
436436
if (!match_binaries(index + MAX_SELECTORS, enter, parent_bin))
437437
return 0;
438438

‎pkg/selectors/kernel.go‎

Lines changed: 18 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -744,30 +744,36 @@ func writeMatchStrings(k *KernelSelectorState, values []string, ty uint32) error
744744
return nil
745745
}
746746

747-
func writePrefix(k *KernelSelectorState, values []string) (uint32, error) {
747+
func writePrefix(k *KernelSelectorState, values []string, selector string) (uint32, error) {
748748
mid, m := k.newStringPrefixMap()
749749
for _, v := range values {
750750
value, size := ArgSelectorValue(v)
751751
if size > StringPrefixMaxLength {
752-
return 0, fmt.Errorf("value %s invalid: string is longer than %d characters", v, StringPrefixMaxLength)
752+
return 0, fmt.Errorf("%s value %s invalid: string is longer than %d characters", selector, v, StringPrefixMaxLength)
753753
}
754754
val := KernelLPMTrieStringPrefix{prefixLen: size * 8} // prefix is in bits, but size is in bytes
755755
copy(val.data[:], value)
756756
m[val] = struct{}{}
757757
}
758758
return mid, nil
759+
// write the map id into the selector
760+
761+
}
762+
763+
func writePrefixBinaries(k *KernelSelectorState, values []string) (uint32, error) {
764+
return writePrefix(k, values, "MatchBinaries")
759765
}
760766

761767
func writePrefixStrings(k *KernelSelectorState, values []string) error {
762-
mid, err := writePrefix(k, values)
768+
mid, err := writePrefix(k, values, "MatchArgs")
763769
if err != nil {
764770
return err
765771
}
766772
WriteSelectorUint32(&k.data, mid)
767773
return nil
768774
}
769775

770-
func writePostfix(k *KernelSelectorState, values []string, ty uint32) (uint32, error) {
776+
func writePostfix(k *KernelSelectorState, values []string, ty uint32, selector string) (uint32, error) {
771777
mid, m := k.newStringPostfixMap()
772778
for _, v := range values {
773779
var value []byte
@@ -780,7 +786,7 @@ func writePostfix(k *KernelSelectorState, values []string, ty uint32) (uint32, e
780786
// Due to the constraints of the reverse copy in BPF, we will not be able to match a postfix
781787
// longer than 127 characters, so throw an error if the user specified one.
782788
if size >= StringPostfixMaxLength {
783-
return 0, fmt.Errorf("value %s invalid: string is longer than %d characters", v, StringPostfixMaxLength-1)
789+
return 0, fmt.Errorf("%s value %s invalid: string is longer than %d characters", selector, v, StringPostfixMaxLength-1)
784790
}
785791
val := KernelLPMTrieStringPostfix{prefixLen: size * 8} // postfix is in bits, but size is in bytes
786792
// Copy postfix in reverse order, so that it can be used in LPM map
@@ -792,8 +798,12 @@ func writePostfix(k *KernelSelectorState, values []string, ty uint32) (uint32, e
792798
return mid, nil
793799
}
794800

801+
func writePostfixBinaries(k *KernelSelectorState, values []string) (uint32, error) {
802+
return writePostfix(k, values, gt.GenericCharBuffer, "MatchBinaries")
803+
}
804+
795805
func writePostfixStrings(k *KernelSelectorState, values []string, ty uint32) error {
796-
mid, err := writePostfix(k, values, ty)
806+
mid, err := writePostfix(k, values, ty, "MatchArgs")
797807
if err != nil {
798808
return err
799809
}
@@ -1427,15 +1437,15 @@ func ParseMatchBinary(k *KernelSelectorState, b *v1alpha1.BinarySelector, selIdx
14271437
if !config.EnableLargeProgs() {
14281438
return fmt.Errorf("%s error: \"Prefix\" and \"NotPrefix\" operators need large BPF progs (kernel>5.3)", selectorType)
14291439
}
1430-
sel.MapID, err = writePrefix(k, b.Values)
1440+
sel.MapID, err = writePrefixBinaries(k, b.Values)
14311441
if err != nil {
14321442
return fmt.Errorf("failed to write the prefix operator for the %s selector: %w", selectorType, err)
14331443
}
14341444
case SelectorOpPostfix, SelectorOpNotPostfix:
14351445
if !config.EnableLargeProgs() {
14361446
return fmt.Errorf("%s error: \"Postfix\" and \"NotPostfix\" operators need large BPF progs (kernel>5.3)", selectorType)
14371447
}
1438-
sel.MapID, err = writePostfix(k, b.Values, gt.GenericCharBuffer)
1448+
sel.MapID, err = writePostfixBinaries(k, b.Values)
14391449
if err != nil {
14401450
return fmt.Errorf("failed to write the prefix operator for the %s selector: %w", selectorType, err)
14411451
}

‎pkg/sensors/base/base.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -161,6 +161,10 @@ func setupSensor() {
161161
Execve.RewriteConstants["ENV_VARS_ENABLED"] = uint8(1)
162162
}
163163

164+
if option.Config.ParentsMapEnabled {
165+
Execve.RewriteConstants["PARENTS_MAP_ENABLED"] = uint8(1)
166+
}
167+
164168
if option.Config.ParentsMapEnabled {
165169
entries = GetExecveEntries(option.Config.ParentsMapEntries, option.Config.ParentsMapSize)
166170
ParentBinariesMap.SetMaxEntries(entries)

‎pkg/sensors/base/base_linux.go‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,14 +30,18 @@ func GetDefaultMaps() []*program.Map {
3030
ExecveJoinMapStats,
3131
ExecveTailCallsMap,
3232
ExecveMapUpdateData,
33-
ParentBinariesMap,
3433
TCPMonMap,
3534
TetragonConfMap,
3635
StatsMap,
3736
MatchBinariesSetMap,
3837
MatchBinariesGenMap,
3938
ErrMetricsMap,
4039
}
40+
41+
if option.Config.ParentsMapEnabled {
42+
maps = append(maps, ParentBinariesMap)
43+
}
44+
4145
// The BPF ring buffer is available from v5.8, but rather than add another set of
4246
// kernel-version-specific objects, let's set the gate at v5.11 as we already have
4347
// objects for that version number.

‎pkg/sensors/tracing/generickprobe.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -711,7 +711,9 @@ func createGenericKprobeSensor(
711711
maps = append(maps, program.MapUserFrom(base.RingBufEvents))
712712
}
713713

714-
maps = append(maps, program.MapUserFrom(base.ParentBinariesMap))
714+
if option.Config.ParentsMapEnabled {
715+
maps = append(maps, program.MapUserFrom(base.ParentBinariesMap))
716+
}
715717

716718
return &sensors.Sensor{
717719
Name: name,

‎pkg/sensors/tracing/genericlsm.go‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -15,16 +15,17 @@ import (
1515

1616
"github.com/cilium/ebpf"
1717

18+
"github.com/cilium/tetragon/pkg/k8s/apis/cilium.io/v1alpha1"
19+
1820
"github.com/cilium/tetragon/pkg/api/ops"
19-
processapi "github.com/cilium/tetragon/pkg/api/processapi"
21+
"github.com/cilium/tetragon/pkg/api/processapi"
2022
api "github.com/cilium/tetragon/pkg/api/tracingapi"
2123
"github.com/cilium/tetragon/pkg/bpf"
2224
"github.com/cilium/tetragon/pkg/cgtracker"
2325
"github.com/cilium/tetragon/pkg/config"
2426
gt "github.com/cilium/tetragon/pkg/generictypes"
2527
"github.com/cilium/tetragon/pkg/grpc/tracing"
2628
"github.com/cilium/tetragon/pkg/idtable"
27-
"github.com/cilium/tetragon/pkg/k8s/apis/cilium.io/v1alpha1"
2829
"github.com/cilium/tetragon/pkg/kernels"
2930
"github.com/cilium/tetragon/pkg/logger"
3031
"github.com/cilium/tetragon/pkg/logger/logfields"
@@ -378,7 +379,9 @@ func createGenericLsmSensor(
378379
maps = append(maps, program.MapUserFrom(base.RingBufEvents))
379380
}
380381

381-
maps = append(maps, program.MapUserFrom(base.ParentBinariesMap))
382+
if option.Config.ParentsMapEnabled {
383+
maps = append(maps, program.MapUserFrom(base.ParentBinariesMap))
384+
}
382385

383386
return &sensors.Sensor{
384387
Name: name,

‎pkg/sensors/tracing/generictracepoint.go‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -632,7 +632,9 @@ func createGenericTracepointSensor(
632632
maps = append(maps, program.MapUserFrom(base.RingBufEvents))
633633
}
634634

635-
maps = append(maps, program.MapUserFrom(base.ParentBinariesMap))
635+
if option.Config.ParentsMapEnabled {
636+
maps = append(maps, program.MapUserFrom(base.ParentBinariesMap))
637+
}
636638

637639
ret.Progs = progs
638640
ret.Maps = maps

‎pkg/sensors/tracing/genericuprobe.go‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@ import (
2020
"github.com/cilium/tetragon/pkg/asm"
2121
"github.com/cilium/tetragon/pkg/metrics/kprobemetrics"
2222

23+
"github.com/cilium/tetragon/pkg/k8s/apis/cilium.io/v1alpha1"
24+
2325
"github.com/cilium/tetragon/pkg/api/ops"
2426
"github.com/cilium/tetragon/pkg/api/processapi"
2527
api "github.com/cilium/tetragon/pkg/api/tracingapi"
@@ -29,7 +31,6 @@ import (
2931
gt "github.com/cilium/tetragon/pkg/generictypes"
3032
"github.com/cilium/tetragon/pkg/grpc/tracing"
3133
"github.com/cilium/tetragon/pkg/idtable"
32-
"github.com/cilium/tetragon/pkg/k8s/apis/cilium.io/v1alpha1"
3334
"github.com/cilium/tetragon/pkg/logger"
3435
"github.com/cilium/tetragon/pkg/logger/logfields"
3536
"github.com/cilium/tetragon/pkg/observer"
@@ -444,7 +445,9 @@ func createGenericUprobeSensor(
444445
maps = append(maps, program.MapUserFrom(base.RingBufEvents))
445446
}
446447

447-
maps = append(maps, program.MapUserFrom(base.ParentBinariesMap))
448+
if option.Config.ParentsMapEnabled {
449+
maps = append(maps, program.MapUserFrom(base.ParentBinariesMap))
450+
}
448451

449452
return &sensors.Sensor{
450453
Name: name,

0 commit comments

Comments
 (0)