eBPF probes: 32 bit applications support

[alexburt]

Hello,
Is there a reason why 32 bit syscalls is not supported by eBPF driver ?
My test program opens /etc/shadow and normally triggers the alert. But there is no alerts when I compile program as ELF 32-bit (gcc -m32).

Looks like 32 bit calls just skipped by eBPF probe (https://github.com/falcosecurity/libs/blob/master/driver/bpf/probe.c):

if (bpf_in_ia32_syscall())
return 0;

Any reason for that ?

[FedeDP]

Hi!
I think that the issue with compat syscalls is that we don't really support them; we'd need to implement its support.
I think that from a security standpoint, we really need that though! I might work on this in my spare time :)

[FedeDP]

/kind feature

[2Bor2C]

We would be interested in this feature as well. This may be a big security gap.

[FedeDP]

Yep we know that; that's unfortunate and we must implement its support. I'll try to target 0.33 for this.
0.32 is coming soon and there is no enough time to implement and test it.

[Andreagit97]

You are right @2Bor2C, we will try to insert it in 0.33

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Andreagit97]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[FedeDP]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Cryptophobia]

@FedeDP any update on this?

/remove-lifecycle stale

[FedeDP]

Nope :( still need to schedule some time for this!

[incertum]

@alexburt Feature is scheduled for Falco 0.36 release and tracked under Falco issue falcosecurity/falco#2472. According to our new roadmap planning we may have 2 libs releases per one Falco release, therefore the feature may land earlier in libs.

[oheifetz]

Hi,
I would like to understand the root cause that the bpf_in_ia32_syscall was put in the first place, failed to understand it from git blame, 32bit ARCHes are supported by eBPF, can you please elaborate regarding this issue?

[incertum]

@oheifetz - @FedeDP has this item in his queue. The work has not yet started. We will keep everyone updated here if this is ok? Thank you for your patience 🙏