wip

Signed-off-by: Roberto Scolaro <[email protected]>
falcosecurity · Feb 1, 2024 · aa17a4b · aa17a4b
1 parent 7ee511f
commit aa17a4b
Show file tree

Hide file tree

Showing 12 changed files with 21 additions and 49 deletions.
diff --git a/userspace/libsinsp/CMakeLists.txt b/userspace/libsinsp/CMakeLists.txt
@@ -17,10 +17,8 @@
 
 option(USE_BUNDLED_DEPS "Enable bundled dependencies instead of using the system ones" ON)
 
+add_definitions(-DHAS_CAPTURE)
 if(NOT MSVC)
-	if(CMAKE_SYSTEM_NAME MATCHES "Linux")
-		add_definitions(-DHAS_CAPTURE)
-	endif()
 	add_definitions(-DHAVE_PWD_H)
 	add_definitions(-DHAVE_GRP_H)
 	if(MUSL_OPTIMIZED_BUILD)

diff --git a/userspace/libsinsp/container.cpp b/userspace/libsinsp/container.cpp
@@ -19,9 +19,7 @@ limitations under the License.
 #include <algorithm>
 
 #if !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
-#ifdef HAS_CAPTURE
 #include <libsinsp/container_engine/cri.h>
-#endif // HAS_CAPTURE
 #ifndef _WIN32
 #include <libsinsp/container_engine/docker/docker_linux.h>
 #include <libsinsp/container_engine/docker/podman.h>
@@ -584,7 +582,6 @@ void sinsp_container_manager::create_engines()
 		m_container_engine_by_type[CT_DOCKER] = docker_engine;
 	}
 
-#if defined(HAS_CAPTURE)
 	if (m_container_engine_mask &
 	   ((1 << CT_CRI) |
 	    (1 << CT_CRIO) |
@@ -596,7 +593,6 @@ void sinsp_container_manager::create_engines()
 		m_container_engine_by_type[CT_CRIO] = cri_engine;
 		m_container_engine_by_type[CT_CONTAINERD] = cri_engine;
 	}
-#endif
 	if (m_container_engine_mask & (1 << CT_LXC))
 	{
 		auto lxc_engine = std::make_shared<container_engine::lxc>(*this);
@@ -660,7 +656,7 @@ void sinsp_container_manager::cleanup()
 
 void sinsp_container_manager::set_docker_socket_path(std::string socket_path)
 {
-#if !defined(MINIMAL_BUILD) && defined(HAS_CAPTURE) && !defined(_WIN32) && !defined(__EMSCRIPTEN__)
+#if !defined(MINIMAL_BUILD) && !defined(_WIN32) && !defined(__EMSCRIPTEN__)
 	libsinsp::container_engine::docker_linux::set_docker_sock(std::move(socket_path));
 #endif
 }
@@ -674,35 +670,35 @@ void sinsp_container_manager::set_query_docker_image_info(bool query_image_info)
 
 void sinsp_container_manager::set_cri_extra_queries(bool extra_queries)
 {
-#if !defined(MINIMAL_BUILD) && defined(HAS_CAPTURE) && !defined(__EMSCRIPTEN__)
+#if !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
 	libsinsp::container_engine::cri::set_extra_queries(extra_queries);
 #endif
 }
 
 void sinsp_container_manager::set_cri_socket_path(const std::string &path)
 {
-#if !defined(MINIMAL_BUILD) && defined(HAS_CAPTURE) && !defined(__EMSCRIPTEN__)
+#if !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
 	libsinsp::container_engine::cri::set_cri_socket_path(path);
 #endif
 }
 
 void sinsp_container_manager::add_cri_socket_path(const std::string &path)
 {
-#if !defined(MINIMAL_BUILD) && defined(HAS_CAPTURE) && !defined(__EMSCRIPTEN__)
+#if !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
 	libsinsp::container_engine::cri::add_cri_socket_path(path);
 #endif
 }
 
 void sinsp_container_manager::set_cri_timeout(int64_t timeout_ms)
 {
-#if !defined(MINIMAL_BUILD) && defined(HAS_CAPTURE) && !defined(__EMSCRIPTEN__)
+#if !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
 	libsinsp::container_engine::cri::set_cri_timeout(timeout_ms);
 #endif
 }
 
 void sinsp_container_manager::set_cri_async(bool async)
 {
-#if !defined(MINIMAL_BUILD) && defined(HAS_CAPTURE) && !defined(__EMSCRIPTEN__)
+#if !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
 	libsinsp::container_engine::cri::set_async(async);
 #endif
 }

diff --git a/userspace/libsinsp/container.h b/userspace/libsinsp/container.h
@@ -27,7 +27,7 @@ limitations under the License.
 #include <libsinsp/event.h>
 #include <libsinsp/container_info.h>
 
-#if !defined(_WIN32) && defined(HAS_CAPTURE) && !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
+#if !defined(_WIN32) && !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
 #include <curl/curl.h>
 #include <curl/easy.h>
 #include <curl/multi.h>

diff --git a/userspace/libsinsp/container_engine/docker/base.cpp b/userspace/libsinsp/container_engine/docker/base.cpp
@@ -37,7 +37,6 @@ docker_base::resolve_impl(sinsp_threadinfo *tinfo, const docker_lookup_request&
 			return true;
 		}
 
-#ifdef HAS_CAPTURE
 		if(cache->should_lookup(request.container_id, request.container_type))
 		{
 			libsinsp_logger()->format(sinsp_logger::SEV_DEBUG,
@@ -48,7 +47,6 @@ docker_base::resolve_impl(sinsp_threadinfo *tinfo, const docker_lookup_request&
 			cache->set_lookup_status(request.container_id, request.container_type, sinsp_container_lookup::state::STARTED);
 			parse_docker(request, cache);
 		}
-#endif
 		return false;
 	}
 

diff --git a/userspace/libsinsp/container_engine/rkt.cpp b/userspace/libsinsp/container_engine/rkt.cpp
@@ -72,12 +72,10 @@ bool rkt::match(container_cache_interface *cache, sinsp_threadinfo *tinfo, sinsp
 				// an entry in /var/lib/rkt. In capture mode only the former will be used.
 				// In live mode former will be used only if we already hit that container
 				bool is_rkt_pod_id_valid = cache->container_exists(rkt_podid + ":" + rkt_appname); // if it's already on our table
-#ifdef HAS_CAPTURE
 				if(!is_rkt_pod_id_valid && query_os_for_missing_info)
 				{
 					is_rkt_pod_id_valid = (access(image_manifest_path, F_OK) == 0);
 				}
-#endif
 				if(is_rkt_pod_id_valid)
 				{
 					container_info.m_type = CT_RKT;

diff --git a/userspace/libsinsp/dns_manager.cpp b/userspace/libsinsp/dns_manager.cpp
@@ -20,7 +20,7 @@ limitations under the License.
 
 void sinsp_dns_resolver::refresh(uint64_t erase_timeout, uint64_t base_refresh_timeout, uint64_t max_refresh_timeout, std::future<void> f_exit)
 {
-#if defined(HAS_CAPTURE) && !defined(_WIN32) && !defined(__EMSCRIPTEN__)
+#if !defined(_WIN32) && !defined(__EMSCRIPTEN__)
 	sinsp_dns_manager &manager = sinsp_dns_manager::get();
 	while(true)
 	{
@@ -80,7 +80,7 @@ void sinsp_dns_resolver::refresh(uint64_t erase_timeout, uint64_t base_refresh_t
 #endif
 }
 
-#if defined(HAS_CAPTURE) && !defined(_WIN32) && !defined(__EMSCRIPTEN__)
+#if !defined(_WIN32) && !defined(__EMSCRIPTEN__)
 inline sinsp_dns_manager::dns_info sinsp_dns_manager::resolve(const std::string &name, uint64_t ts)
 {
 	dns_info dinfo;
@@ -115,7 +115,7 @@ inline sinsp_dns_manager::dns_info sinsp_dns_manager::resolve(const std::string
 
 bool sinsp_dns_manager::match(const char *name, int af, void *addr, uint64_t ts)
 {
-#if defined(HAS_CAPTURE) && !defined(_WIN32) && !defined(__EMSCRIPTEN__)
+#if !defined(_WIN32) && !defined(__EMSCRIPTEN__)
 	if(!m_resolver)
 	{
 		m_resolver = std::make_unique<std::thread>(sinsp_dns_resolver::refresh, m_erase_timeout, m_base_refresh_timeout, m_max_refresh_timeout, m_exit_signal.get_future());
@@ -156,7 +156,7 @@ std::string sinsp_dns_manager::name_of(int af, void *addr, uint64_t ts)
 {
 	std::string ret;
 
-#if defined(HAS_CAPTURE) && !defined(_WIN32) && !defined(__EMSCRIPTEN__)
+#if !defined(_WIN32) && !defined(__EMSCRIPTEN__)
 	if(!m_cache.empty())
 	{
 		m_erase_mutex.lock();

diff --git a/userspace/libsinsp/dns_manager.h b/userspace/libsinsp/dns_manager.h
@@ -28,7 +28,7 @@ limitations under the License.
 #include <chrono>
 #include <future>
 #include <mutex>
-#if defined(HAS_CAPTURE) && !defined(__EMSCRIPTEN__)
+#if !defined(__EMSCRIPTEN__)
 #include "tbb/concurrent_unordered_map.h"
 #endif
 #include <libsinsp/sinsp.h>
@@ -69,7 +69,7 @@ class sinsp_dns_manager
 
 	size_t size() const
 	{
-#if defined(HAS_CAPTURE) && !defined(_WIN32) && !defined(__EMSCRIPTEN__)
+#if !defined(_WIN32) && !defined(__EMSCRIPTEN__)
 		return m_cache.size();
 #else
 		return 0;
@@ -91,7 +91,7 @@ class sinsp_dns_manager
 	sinsp_dns_manager(sinsp_dns_manager const&) = delete;
 	void operator=(sinsp_dns_manager const&) = delete;
 
-#if defined(HAS_CAPTURE) && !defined(_WIN32) && !defined(__EMSCRIPTEN__)
+#if !defined(_WIN32) && !defined(__EMSCRIPTEN__)
 	struct dns_info
 	{
 		bool operator==(const dns_info &other) const

diff --git a/userspace/libsinsp/fdinfo.cpp b/userspace/libsinsp/fdinfo.cpp
@@ -407,7 +407,6 @@ void sinsp_fdtable::reset_cache()
 
 void sinsp_fdtable::lookup_device(sinsp_fdinfo* fdi, uint64_t fd)
 {
-#ifdef HAS_CAPTURE
 #ifndef _WIN32
 	if(m_inspector == nullptr || m_inspector->is_offline() ||
 	   (m_inspector->is_plugin() && !m_inspector->is_syscall_plugin()))
@@ -423,5 +422,4 @@ void sinsp_fdtable::lookup_device(sinsp_fdinfo* fdi, uint64_t fd)
 		fdi->m_mount_id = 0; // don't try again
 	}
 #endif // _WIN32
-#endif // HAS_CAPTURE
 }
diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp
@@ -85,7 +85,6 @@ void sinsp_parser::process_event(sinsp_evt *evt)
 	//
 	// When debug mode is not enabled, filter out events about itself
 	//
-#if defined(HAS_CAPTURE)
 	if(is_live && !m_inspector->is_debug_enabled())
 	{
 		if(evt->get_tid() == m_inspector->m_self_pid &&
@@ -102,7 +101,6 @@ void sinsp_parser::process_event(sinsp_evt *evt)
 			return;
 		}
 	}
-#endif
 
 	//
 	// Filtering
@@ -4437,7 +4435,7 @@ void sinsp_parser::parse_getcwd_exit(sinsp_evt *evt)
 				// following chdir(). If it does, it's almost sure there was an event drop.
 				// In that case, we use this value to update the thread cwd.
 				//
-#if defined(HAS_CAPTURE) && !defined(_WIN32)
+#if !defined(_WIN32)
 #ifdef _DEBUG
 				int target_res;
 				char target_name[1024];

diff --git a/userspace/libsinsp/sinsp.cpp b/userspace/libsinsp/sinsp.cpp
@@ -42,7 +42,7 @@ limitations under the License.
 #include <libscap/strl.h>
 #include <libscap/scap-int.h>
 
-#if defined(HAS_CAPTURE) && !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
+#if !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
 #include <curl/curl.h>
 #endif
 
@@ -76,7 +76,7 @@ sinsp::sinsp(bool static_container, const std::string &static_id, const std::str
 	m_inited(false)
 {
 	++instance_count;
-#if !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__) && defined(HAS_CAPTURE)
+#if !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
 	// used by container_manager
 	curl_global_init(CURL_GLOBAL_DEFAULT);
 #endif
@@ -115,9 +115,7 @@ sinsp::sinsp(bool static_container, const std::string &static_id, const std::str
 	// Unless the cmd line arg "-pc" or "-pcontainer" is supplied this is false
 	m_print_container_data = false;
 
-#if defined(HAS_CAPTURE)
 	m_self_pid = getpid();
-#endif
 
 	m_proc_scan_timeout_ms = SCAP_PROC_SCAN_TIMEOUT_NONE;
 	m_proc_scan_log_interval_ms = SCAP_PROC_SCAN_LOG_NONE;
@@ -158,7 +156,7 @@ sinsp::~sinsp()
 
 	m_container_manager.cleanup();
 
-#if defined(HAS_CAPTURE) && !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
+#if !defined(MINIMAL_BUILD) && !defined(__EMSCRIPTEN__)
 	curl_global_cleanup();
 	if (--instance_count == 0)
 	{
@@ -312,14 +310,12 @@ void sinsp::init()
 		set_statsd_port(m_statsd_port);
 	}
 
-#if defined(HAS_CAPTURE)
 	if(is_live())
 	{
 		int32_t res = scap_getpid_global(get_scap_platform(), &m_self_pid);
 		ASSERT(res == SCAP_SUCCESS || res == SCAP_NOT_SUPPORTED);
 		(void)res;
 	}
-#endif
 	m_inited = true;
 }
 
@@ -1028,7 +1024,7 @@ void sinsp::import_user_list()
 
 void sinsp::refresh_ifaddr_list()
 {
-#if defined(HAS_CAPTURE) && !defined(_WIN32)
+#if !defined(_WIN32)
 	if(is_live() || is_syscall_plugin())
 	{
 		scap_refresh_iflist(get_scap_platform());

diff --git a/userspace/libsinsp/test/dns_manager.ut.cpp b/userspace/libsinsp/test/dns_manager.ut.cpp
@@ -16,7 +16,7 @@ limitations under the License.
 
 */
 
-#if defined(HAS_CAPTURE) && !defined(_WIN32) && !defined(__EMSCRIPTEN__)
+#if !defined(_WIN32) && !defined(__EMSCRIPTEN__)
 #include <dns_manager.h>
 #include <gtest/gtest.h>
 

diff --git a/userspace/libsinsp/threadinfo.cpp b/userspace/libsinsp/threadinfo.cpp
@@ -1154,7 +1154,6 @@ std::string sinsp_threadinfo::get_path_for_dir_fd(int64_t dir_fd)
 	if (!dir_fdinfo || dir_fdinfo->m_name.empty())
 	{
 #ifndef _WIN32 // we will have to implement this for Windows
-#ifdef HAS_CAPTURE
 		// Sad day; we don't have the directory in the tinfo's fd cache.
 		// Must manually look it up so we can resolve filenames correctly.
 		char proc_path[PATH_MAX];
@@ -1180,11 +1179,6 @@ std::string sinsp_threadinfo::get_path_for_dir_fd(int64_t dir_fd)
 		rel_path_base.append("/");
 		libsinsp_logger()->log(std::string("Translating to ") + rel_path_base);
 		return rel_path_base;
-#else
-		libsinsp_logger()->log("Can't translate working directory outside of live capture.",
-		             sinsp_logger::SEV_INFO);
-		return "";
-#endif
 #endif // _WIN32
 	}
 	return dir_fdinfo->m_name;
@@ -1490,9 +1484,7 @@ bool sinsp_thread_manager::add_thread(sinsp_threadinfo *threadinfo, bool from_sc
 
 	/* We have no more space */
 	if(m_threadtable.size() >= m_max_thread_table_size
-#if defined(HAS_CAPTURE)
 	   && threadinfo->m_pid != m_inspector->m_self_pid
-#endif
 	)
 	{
 		if (m_inspector != nullptr && m_inspector->m_sinsp_stats_v2)
@@ -2037,9 +2029,7 @@ threadinfo_map_t::ptr_t sinsp_thread_manager::get_thread_ref(int64_t tid, bool q
 
     if(!sinsp_proc && query_os_if_not_found &&
        (m_threadtable.size() < m_max_thread_table_size
-#if defined(HAS_CAPTURE)
 	|| tid == m_inspector->m_self_pid
-#endif
 	))
     {
         // Certain code paths can lead to this point from scap_open() (incomplete example: