Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(driver): update param count of seccomp enter event #1371

Merged
merged 3 commits into from
Sep 27, 2023
Merged

fix(driver): update param count of seccomp enter event #1371

merged 3 commits into from
Sep 27, 2023

Conversation

jasondellaluce
Copy link
Contributor

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

Does this PR require a change in the driver versions?

/version driver-SCHEMA-version-minor

What this PR does / why we need it:

Ports the changes of draios/sysdig#1505.

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

@jasondellaluce
fix(driver): update param count of seccomp enter event
adb2f28 
Co-authored-by: Gerald Combs <[email protected]>

Signed-off-by: Jason Dellaluce <[email protected]>
@jasondellaluce jasondellaluce mentioned this pull request Sep 27, 2023
Closed
Andreagit97
Andreagit97 previously approved these changes Sep 27, 2023
View reviewed changes
Copy link
Member

@Andreagit97 Andreagit97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!
/approve

@poiana poiana added the lgtm label Sep 27, 2023
@poiana
Copy link
Contributor

poiana commented Sep 27, 2023

LGTM label has been added.

Git tree hash: 66ae606e4b1d7aeac3a09fec819a4f7dd660f57c

@Andreagit97
Copy link
Member

/hold

@Andreagit97
Copy link
Member

Opss this is not enough, you have to change the code in the modern probe, see the CI failed test

; PUSH_FIXED_SIZE_TO_RINGBUF(ringbuf, param, sizeof(u64));
118: (bf) r3 = r2
119: (77) r3 >>= 56
120: (73) *(u8 *)(r1 +7) = r3
 R0=inv(id=0) R1_w=mem(id=0,ref_obj_id=4,off=30,imm=0) R2_w=inv(id=8) R3_w=inv(id=0,umax_value=255,var_off=(0x0; 0xff)) R6=ptr_pt_regs(id=0,off=272,imm=0) R7=mem(id=0,ref_obj_id=4,off=0,imm=0) R8=invP2 R9=inv8 R10=fp0 fp-8=mmmmmmmm fp-16=inv2 refs=4
invalid access to memory, mem_size=36 off=37 size=1
R1 min value is outside of the allowed memory range
processed 119 insns (limit 1000000) max_states_per_insn 0 total_states 6 peak_states 6 mark_read 4
-- END PROG LOAD LOG --
libbpf: prog 'seccomp_e': failed to load: -13
libbpf: failed to load object 'bpf_probe'
libbpf: failed to load BPF skeleton 'bpf_probe': -13
libpman: failed to load BPF object (errno: 13 | message: Permission denied)
Unable to open the engine:

@Andreagit97 Andreagit97 self-requested a review September 27, 2023 09:38
FedeDP
FedeDP reviewed Sep 27, 2023
View reviewed changes
driver/event_table.c
@@ -347,7 +347,7 @@ const struct ppm_event_info g_event_info[] = {
[PPME_SYSCALL_SETPGID_X] = {"setpgid", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 1, {{"res", PT_PID, PF_DEC} } },
[PPME_SYSCALL_BPF_E] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_OLD_VERSION, 1, {{"cmd", PT_INT64, PF_DEC} } },
[PPME_SYSCALL_BPF_X] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_OLD_VERSION, 1, {{"res_or_fd", PT_DYN, PF_DEC, bpf_dynamic_param, PPM_BPF_IDX_MAX} } },
[PPME_SYSCALL_SECCOMP_E] = {"seccomp", EC_OTHER | EC_SYSCALL, EF_NONE, 1, {{"op", PT_UINT64, PF_DEC}, {"flags", PT_UINT64, PF_HEX} } },
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

😮‍💨

@Andreagit97 Andreagit97 modified the milestones: 0.14.0, next-driver Sep 27, 2023
FedeDP
FedeDP approved these changes Sep 27, 2023
View reviewed changes
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Sep 27, 2023
@poiana
Copy link
Contributor

poiana commented Sep 27, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, jasondellaluce

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [Andreagit97,FedeDP,jasondellaluce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana
Copy link
Contributor

poiana commented Sep 27, 2023

LGTM label has been added.

Git tree hash: f281660cda6bb06ba259c37d651f675cbd30b9ef

@jasondellaluce
Copy link
Contributor Author

Thanks for adjusting it Andre!

Andreagit97
Andreagit97 approved these changes Sep 27, 2023
View reviewed changes
Copy link
Member

@Andreagit97 Andreagit97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana merged commit 52bcabb into master Sep 27, 2023
29 checks passed
@poiana poiana deleted the jasondellaluce-patch-1 branch September 27, 2023 14:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Andreagit97 Andreagit97 Andreagit97 approved these changes

@FedeDP FedeDP FedeDP approved these changes

@hbrueckner hbrueckner Awaiting requested review from hbrueckner

@incertum incertum Awaiting requested review from incertum

Assignees

@FedeDP FedeDP

@Andreagit97 Andreagit97

Labels
approved area/driver-bpf area/driver-kmod area/driver-modern-bpf dco-signoff: yes kind/bug Something isn't working lgtm release-note-none size/S
Projects
None yet
Milestone
7.0.0+driver
Development

Successfully merging this pull request may close these issues.
4 participants
@jasondellaluce @poiana @Andreagit97 @FedeDP