tests: fix BPF tests on amazon linux 4.14

Signed-off-by: Andrea Terzolo <[email protected]>
falcosecurity · Dec 8, 2022 · 399fb48 · 399fb48
1 parent 7d68ab1
commit 399fb48
Show file tree

Hide file tree

Showing 4 changed files with 31 additions and 0 deletions.
diff --git a/test/drivers/event_class/event_class.cpp b/test/drivers/event_class/event_class.cpp
@@ -146,6 +146,22 @@ event_test::event_test(int syscall_id, int event_direction):
 	{
 		m_tp_set[SYS_EXIT] = 1;
 		m_event_type = g_syscall_table[syscall_id].exit_event_type;
+		if(is_bpf_engine())
+		{
+			/* The bpf engine retrieves syscall params from sys_enter tracepoints
+			 * in kernel versions < 4.17. Moreover for syscalls that generate a
+			 * child we need a `sched_process_fork` tracepoint to duplicate the
+			 * syscall args for the child exit event!
+			 */
+			m_tp_set[SYS_ENTER] = 1;
+			if(m_event_type == PPME_SYSCALL_CLONE_20_X ||
+			   m_event_type == PPME_SYSCALL_FORK_20_X ||
+			   m_event_type == PPME_SYSCALL_VFORK_20_X ||
+			   m_event_type == PPME_SYSCALL_CLONE3_X)
+			{
+				m_tp_set[SCHED_PROC_FORK] = 1;
+			}
+		}
 	}
 
 	m_current_param = 0;

diff --git a/test/drivers/test_suites/syscall_exit_suite/clone3_x.cpp b/test/drivers/test_suites/syscall_exit_suite/clone3_x.cpp
@@ -189,6 +189,11 @@ TEST(SyscallExit, clone3X_child)
 #else
 	evt_test->assert_event_presence(ret_pid);
 
+	if(HasFatalFailure())
+	{
+		return;
+	}
+
 	evt_test->parse_event();
 
 	evt_test->assert_header();

diff --git a/test/drivers/test_suites/syscall_exit_suite/clone_x.cpp b/test/drivers/test_suites/syscall_exit_suite/clone_x.cpp
@@ -233,6 +233,11 @@ TEST(SyscallExit, cloneX_child)
 #else
 	evt_test->assert_event_presence(ret_pid);
 
+	if(HasFatalFailure())
+	{
+		return;
+	}
+
 	evt_test->parse_event();
 
 	evt_test->assert_header();

diff --git a/test/drivers/test_suites/syscall_exit_suite/fork_x.cpp b/test/drivers/test_suites/syscall_exit_suite/fork_x.cpp
@@ -178,6 +178,11 @@ TEST(SyscallExit, forkX_child)
 #else
 	evt_test->assert_event_presence(ret_pid);
 
+	if(HasFatalFailure())
+	{
+		return;
+	}
+
 	evt_test->parse_event();
 
 	evt_test->assert_header();