diff --git a/pkg/sensors/program/map.go b/pkg/sensors/program/map.go index 8159bbf5381..84b49c44df0 100644 --- a/pkg/sensors/program/map.go +++ b/pkg/sensors/program/map.go @@ -104,6 +104,10 @@ type Map struct { Owner bool } +// GlobalMaps keeps a record of all global maps to exclude them from per policy +// memory map accounting. +var GlobalMaps map[string]bool + // Map holds pointer to Program object as a source of its ebpf object // file. We assume all the programs sharing the map have same map // definition, so it's ok to use the first program if there's more. @@ -118,6 +122,16 @@ type Map struct { // ... // p.PinMap["mapX"] = &mapX func mapBuilder(name string, ty MapType, owner bool, lds ...*Program) *Map { + if ty == MapTypeGlobal { + if GlobalMaps == nil { + GlobalMaps = make(map[string]bool) + } + key := name + if len(name) > 15 { + key = name[:15] + } + GlobalMaps[key] = true + } m := &Map{name, "", lds[0], Idle(), nil, MaxEntries{0, false}, MaxEntries{0, false}, ty, owner} for _, ld := range lds { ld.PinMap[name] = m diff --git a/pkg/sensors/sensors.go b/pkg/sensors/sensors.go index 749a90d9c61..8cefb95f17e 100644 --- a/pkg/sensors/sensors.go +++ b/pkg/sensors/sensors.go @@ -101,8 +101,15 @@ func (s Sensor) TotalMemlock() int { var total int for _, info := range uniqueMap { + // we are using info.Name that is truncated to 15 chars to exclude + // global maps, a more resilient implementation could use ID but this + // should be enough. + if program.GlobalMaps[info.Name] { + continue + } total += info.Memlock } + return total }