update(modern_bpf): add a missing parameter in signalfd syscalls

Signed-off-by: Andrea Terzolo <[email protected]> Co-authored-by: Hendrik Brueckner <[email protected]>
falcosecurity · Aug 4, 2022 · de3dee2 · de3dee2
1 parent beb519c
commit de3dee2
Show file tree

Hide file tree

Showing 5 changed files with 14 additions and 9 deletions.
diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/signalfd.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/signalfd.bpf.c
@@ -35,6 +35,10 @@ int BPF_PROG(signalfd_e,
 	ringbuf__store_u32(&ringbuf, 0);
 
 	/* Parameter 3: flags (type: PT_FLAGS8) */
+	/// TODO: this are not flags, but it is a sizemask,
+	/// please see here for more deatails:
+	/// https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/fs/signalfd.c#n302
+	/// We need to create 2 separate events for `signalfd` and `signalfd4`.
 	/* Like in the old probe we send `0`. */
 	ringbuf__store_u8(&ringbuf, 0);
 
@@ -74,5 +78,4 @@ int BPF_PROG(signalfd_x,
 	return 0;
 }
 
-
 /*=============================== EXIT EVENT ===========================*/
diff --git a/test/modern_bpf/test_suites/syscall_enter_suite/signalfd4_e.cpp b/test/modern_bpf/test_suites/syscall_enter_suite/signalfd4_e.cpp
@@ -21,8 +21,9 @@ TEST(SyscallEnter, signalfd4E)
 	/* `mask` and `flags` are not catched BPF side. */
 	int32_t mock_fd = -1;
 	sigset_t mask = {0};
+	size_t sizemask = 0;
 	int flags = 7;
-	assert_syscall_state(SYSCALL_FAILURE, "signalfd4", syscall(__NR_signalfd4, mock_fd, &mask, flags));
+	assert_syscall_state(SYSCALL_FAILURE, "signalfd4", syscall(__NR_signalfd4, mock_fd, &mask, sizemask, flags));
 
 	/*=============================== TRIGGER SYSCALL ===========================*/
 

diff --git a/test/modern_bpf/test_suites/syscall_enter_suite/signalfd_e.cpp b/test/modern_bpf/test_suites/syscall_enter_suite/signalfd_e.cpp
@@ -12,11 +12,11 @@ TEST(SyscallEnter, signalfdE)
 
 	/*=============================== TRIGGER SYSCALL ===========================*/
 
-	/* `mask` and `flags` are not caught BPF side. */
+	/* `mask` is not caught BPF side. */
 	int32_t mock_fd = -1;
 	sigset_t mask = {0};
-	int flags = 7;
-	assert_syscall_state(SYSCALL_FAILURE, "signalfd", syscall(__NR_signalfd, mock_fd, &mask, flags));
+	size_t sizemask = 0;
+	assert_syscall_state(SYSCALL_FAILURE, "signalfd", syscall(__NR_signalfd, mock_fd, &mask, sizemask));
 
 	/*=============================== TRIGGER SYSCALL ===========================*/
 

diff --git a/test/modern_bpf/test_suites/syscall_exit_suite/signalfd4_x.cpp b/test/modern_bpf/test_suites/syscall_exit_suite/signalfd4_x.cpp
@@ -21,8 +21,9 @@ TEST(SyscallExit, signalfd4X)
 	/* `mask` and `flags` are not catched BPF side. */
 	int32_t mock_fd = -1;
 	sigset_t mask = {0};
+	size_t sizemask = 0;
 	int flags = 7;
-	assert_syscall_state(SYSCALL_FAILURE, "signalfd4", syscall(__NR_signalfd4, mock_fd, &mask, flags));
+	assert_syscall_state(SYSCALL_FAILURE, "signalfd4", syscall(__NR_signalfd4, mock_fd, &mask, sizemask, flags));
 	int64_t errno_value = -errno;
 
 	/*=============================== TRIGGER SYSCALL ===========================*/

diff --git a/test/modern_bpf/test_suites/syscall_exit_suite/signalfd_x.cpp b/test/modern_bpf/test_suites/syscall_exit_suite/signalfd_x.cpp
@@ -12,11 +12,11 @@ TEST(SyscallExit, signalfdX)
 
 	/*=============================== TRIGGER SYSCALL ===========================*/
 
-	/* `mask` and `flags` are not caught BPF side. */
+	/* `mask` is not caught BPF side. */
 	int32_t mock_fd = -1;
 	sigset_t mask = {0};
-	int flags = 7;
-	assert_syscall_state(SYSCALL_FAILURE, "signalfd", syscall(__NR_signalfd, mock_fd, &mask, flags));
+	size_t sizemask = 0;
+	assert_syscall_state(SYSCALL_FAILURE, "signalfd", syscall(__NR_signalfd, mock_fd, &mask, sizemask));
 	int64_t errno_value = -errno;
 
 	/*=============================== TRIGGER SYSCALL ===========================*/