Skip to content

Commit

Permalink
[CWS] no docker wrapper with ebpfless (#22192)
Browse files Browse the repository at this point in the history 
[CWS] no docker wrapper with ebpfless
  • Loading branch information
@safchain
safchain authored Jan 19, 2024
1 parent f12a851 commit 1ccaf26
Show file tree
Hide file tree
Showing 2 changed files with 27 additions and 77 deletions.
25 changes: 15 additions & 10 deletions pkg/security/tests/module_tester.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -969,12 +969,17 @@ func newTestModule(t testing.TB, macroDefs []*rules.MacroDefinition, ruleDefs []
if testEnvironment == DockerEnvironment {
cmdWrapper = newStdCmdWrapper()
} else {
wrapper, err := newDockerCmdWrapper(st.Root(), st.Root(), "ubuntu")
if err == nil {
cmdWrapper = newMultiCmdWrapper(wrapper, newStdCmdWrapper())
} else {
// docker not present run only on host
if opts.staticOpts.enableEBPFLess {
// docker not supported by ebpf less
cmdWrapper = newStdCmdWrapper()
} else {
wrapper, err := newDockerCmdWrapper(st.Root(), st.Root(), "ubuntu")
if err == nil {
cmdWrapper = newMultiCmdWrapper(wrapper, newStdCmdWrapper())
} else {
// docker not present run only on host
cmdWrapper = newStdCmdWrapper()
}
}
}

Expand Down Expand Up @@ -1019,7 +1024,7 @@ func newTestModule(t testing.TB, macroDefs []*rules.MacroDefinition, ruleDefs []
}

if ruleDefs != nil && logStatusMetrics {
t.Logf("%s entry stats: %s\n", t.Name(), GetEBPFStatusMetrics(testMod.probe))
t.Logf("%s entry stats: %s", t.Name(), GetEBPFStatusMetrics(testMod.probe))
}
return testMod, nil
} else if testMod != nil {
Expand Down Expand Up @@ -1137,11 +1142,11 @@ func newTestModule(t testing.TB, macroDefs []*rules.MacroDefinition, ruleDefs []
}

if logStatusMetrics {
t.Logf("%s entry stats: %s\n", t.Name(), GetEBPFStatusMetrics(testMod.probe))
t.Logf("%s entry stats: %s", t.Name(), GetEBPFStatusMetrics(testMod.probe))
}

if opts.staticOpts.enableEBPFLess {
t.Logf("EBPFLess mode, waiting for a client to connect\n")
t.Logf("EBPFLess mode, waiting for a client to connect")
err := retry.Do(func() error {
if testMod.probe.PlatformProbe.(*sprobe.EBPFLessProbe).GetClientsCount() > 0 {
return nil
Expand All @@ -1152,7 +1157,7 @@ func newTestModule(t testing.TB, macroDefs []*rules.MacroDefinition, ruleDefs []
return nil, err
}
time.Sleep(time.Second * 2) // sleep another sec to let tests starting before the tracing is ready
t.Logf("client connected\n")
t.Logf("client connected")
}
return testMod, nil
}
Expand Down Expand Up @@ -1819,7 +1824,7 @@ func (tm *testModule) Close() {
tm.statsdClient.Flush()

if logStatusMetrics {
tm.t.Logf("%s exit stats: %s\n", tm.t.Name(), GetEBPFStatusMetrics(tm.probe))
tm.t.Logf("%s exit stats: %s", tm.t.Name(), GetEBPFStatusMetrics(tm.probe))
}

if withProfile {
Expand Down
79 changes: 12 additions & 67 deletions pkg/security/tests/process_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -253,10 +253,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "args-envs", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}

args := []string{"-al", "--password", "secret", "--custom", "secret"}
envs := []string{"LD_LIBRARY_PATH=/tmp/lib", "DD_API_KEY=dd-api-key"}
test.WaitSignal(t, func() error {
Expand Down Expand Up @@ -326,10 +322,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "envp", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}

args := []string{"-al", "http://example.com"}
envs := []string{"ENVP=test"}

Expand Down Expand Up @@ -376,10 +368,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "args-overflow-single", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}

args := []string{"-al"}
envs := []string{"LD_LIBRARY_PATH=/tmp/lib"}

Expand Down Expand Up @@ -424,9 +412,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "args-overflow-list-50", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}
envs := []string{"LD_LIBRARY_PATH=/tmp/lib"}

// force seed to have something we can reproduce
Expand Down Expand Up @@ -477,10 +462,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "args-overflow-list-500", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}

envs := []string{"LD_LIBRARY_PATH=/tmp/lib"}

// force seed to have something we can reproduce
Expand Down Expand Up @@ -539,10 +520,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "envs-overflow-single", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}

args := []string{"-al"}
envs := []string{"LD_LIBRARY_PATH=/tmp/lib"}

Expand Down Expand Up @@ -590,10 +567,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "envs-overflow-list-50", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}

args := []string{"-al"}

// force seed to have something we can reproduce
Expand Down Expand Up @@ -627,7 +600,7 @@ func TestProcessContext(t *testing.T) {
}

envp := (execEnvp.([]string))
if test.opts.staticOpts.enableEBPFLess == true {
if test.opts.staticOpts.enableEBPFLess {
assert.Equal(t, model.MaxArgsEnvsSize, len(envp), "incorrect number of envs: %s", envp)
for i := 0; i != model.MaxArgsEnvsSize; i++ {
assert.Equal(t, envs[i], envp[i], "expected env not found")
Expand All @@ -654,10 +627,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "envs-overflow-list-500", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}

args := []string{"-al"}

// force seed to have something we can reproduce
Expand Down Expand Up @@ -693,7 +662,7 @@ func TestProcessContext(t *testing.T) {
}

envp := (execEnvp.([]string))
if test.opts.staticOpts.enableEBPFLess == true {
if test.opts.staticOpts.enableEBPFLess {
assert.Equal(t, model.MaxArgsEnvsSize, len(envp), "incorrect number of envs: %s", envp)
for i := 0; i != model.MaxArgsEnvsSize; i++ {
expected := envs[i]
Expand Down Expand Up @@ -801,9 +770,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "ancestors", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}
testFile, _, err := test.Path("test-process-ancestors")
if err != nil {
t.Fatal(err)
Expand All @@ -828,10 +794,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "parent", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}

testFile, _, err := test.Path("test-process-parent")
if err != nil {
t.Fatal(err)
Expand All @@ -857,7 +819,7 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "pid1", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if test.opts.staticOpts.enableEBPFLess == true {
if test.opts.staticOpts.enableEBPFLess {
t.Skip("in ebpfless we don't have complete lineage context")
}

Expand All @@ -884,9 +846,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "service-tag", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}
testFile, _, err := test.Path("test-process-context")
if err != nil {
t.Fatal(err)
Expand Down Expand Up @@ -914,9 +873,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "ancestors-args", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}
testFile, _, err := test.Path("test-ancestors-args")
if err != nil {
t.Fatal(err)
Expand All @@ -937,10 +893,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "args-envs-dedup", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}

shell, args, envs := "sh", []string{"-x", "-c", "ls -al test123456; echo"}, []string{"DEDUP=dedup123"}

test.WaitSignal(t, func() error {
Expand Down Expand Up @@ -992,10 +944,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "self-exec", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}

args := []string{"self-exec", "selfexec123", "abc"}
envs := []string{}

Expand All @@ -1010,9 +958,6 @@ func TestProcessContext(t *testing.T) {
})

test.Run(t, "container-id", func(t *testing.T, kind wrapperType, cmdFunc func(cmd string, args []string, envs []string) *exec.Cmd) {
if kind == dockerWrapperType && test.opts.staticOpts.enableEBPFLess == true {
t.Skip("docker tests not supported")
}
testFile, _, err := test.Path("test-container")
if err != nil {
t.Fatal(err)
Expand Down Expand Up @@ -1391,7 +1336,7 @@ func TestProcessMetadata(t *testing.T) {
}, test.validateExecEvent(t, noWrapperType, func(event *model.Event, rule *rules.Rule) {
assert.Equal(t, "exec", event.GetType(), "wrong event type")
assertRights(t, event.Exec.FileEvent.Mode, fileMode)
if test.opts.staticOpts.enableEBPFLess != true {
if !test.opts.staticOpts.enableEBPFLess {
assertNearTime(t, event.Exec.FileEvent.MTime)
assertNearTime(t, event.Exec.FileEvent.CTime)
}
Expand Down Expand Up @@ -1464,7 +1409,7 @@ func TestProcessExecExit(t *testing.T) {
validate(event, nil)

execPid = event.ProcessContext.Pid
if test.opts.staticOpts.enableEBPFLess == true {
if test.opts.staticOpts.enableEBPFLess {
nsID = event.NSID
}

Expand All @@ -1485,7 +1430,7 @@ func TestProcessExecExit(t *testing.T) {

// make sure that the process cache entry of the process was properly deleted from the cache
err = retry.Do(func() error {
if test.opts.staticOpts.enableEBPFLess != true {
if !test.opts.staticOpts.enableEBPFLess {
p, ok := test.probe.PlatformProbe.(*sprobe.EBPFProbe)
if !ok {
t.Skip("not supported")
Expand Down Expand Up @@ -1788,7 +1733,7 @@ func TestProcessExit(t *testing.T) {
cmd.Env = envp
return cmd.Run()
}, func(event *model.Event, rule *rules.Rule) {
if test.opts.staticOpts.enableEBPFLess != true {
if !test.opts.staticOpts.enableEBPFLess {
test.validateExitSchema(t, event)
}
assertTriggeredRule(t, rule, "test_exit_ok")
Expand Down Expand Up @@ -1871,7 +1816,7 @@ func TestProcessExit(t *testing.T) {
cmd.Env = envp
return cmd.Run()
}, func(event *model.Event, rule *rules.Rule) {
if test.opts.staticOpts.enableEBPFLess != true {
if !test.opts.staticOpts.enableEBPFLess {
test.validateExitSchema(t, event)
}
assertTriggeredRule(t, rule, "test_exit_time_1")
Expand All @@ -1891,7 +1836,7 @@ func TestProcessExit(t *testing.T) {
cmd.Env = envp
return cmd.Run()
}, func(event *model.Event, rule *rules.Rule) {
if test.opts.staticOpts.enableEBPFLess != true {
if !test.opts.staticOpts.enableEBPFLess {
test.validateExitSchema(t, event)
}
assertTriggeredRule(t, rule, "test_exit_time_2")
Expand Down Expand Up @@ -1928,7 +1873,7 @@ func TestProcessBusybox(t *testing.T) {
t.Fatal(err)
}
defer test.Close()
if test.opts.staticOpts.enableEBPFLess == true {
if test.opts.staticOpts.enableEBPFLess {
t.Skip("not supported")
}

Expand Down Expand Up @@ -2379,7 +2324,7 @@ func TestProcessFilelessExecution(t *testing.T) {
t.Fatal("shouldn't get an event")
}
} else {
if testModule.opts.staticOpts.enableEBPFLess == true && test.rule.ID == "test_fileless_with_interpreter" {
if testModule.opts.staticOpts.enableEBPFLess && test.rule.ID == "test_fileless_with_interpreter" {
t.Skip("interpreter detection unsupported")
}

Expand Down Expand Up @@ -2417,7 +2362,7 @@ func TestKillAction(t *testing.T) {
t.Fatal(err)
}
defer test.Close()
if test.opts.staticOpts.enableEBPFLess == true {
if test.opts.staticOpts.enableEBPFLess {
t.Skip("kill action not supported")
}

Expand Down

0 comments on commit 1ccaf26

Please sign in to comment.