Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cleanup: remove some extra code #2186

Merged
merged 1 commit into from
Dec 6, 2024

Conversation

Andreagit97
Copy link
Member

@Andreagit97 Andreagit97 commented Dec 5, 2024

What type of PR is this?

/kind cleanup

Any specific area of the project related to this PR?

/area libsinsp

Does this PR require a change in the driver versions?

No

What this PR does / why we need it:

if i don't miss something all the syscall exit event should have at least the return value so i don't see why we need the additional manual check on the parameter names

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

if(res < 0) {
evt->set_errorcode(-(int32_t)res);
}
if(evt->has_return_value()) {
Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if i don't miss something all the syscall exit event should have at least the return value so i don't see why we need the additional manual check on the parameter names

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I encountered this code right yesterday and was wondering exactly the same 🤣

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

BTW this logic was broken since there are all these possible values "uid", "gid", "res_or_fd", "euid", "egid"

FedeDP
FedeDP previously approved these changes Dec 6, 2024
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Dec 6, 2024

LGTM label has been added.

Git tree hash: b5d930a73bbd6992bceb57cbce9658d16d2aa4c0

@FedeDP
Copy link
Contributor

FedeDP commented Dec 6, 2024

Uh but tests are failing of course!

Signed-off-by: Andrea Terzolo <[email protected]>
@@ -167,3 +167,26 @@ TEST(event_table, check_usage_of_EC_UNKNOWN_flag) {
}
}
}

TEST(event_table, check_exit_param_names) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't get this test; do we really need to enforce the param name from now on, given your changes?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We should enforce the rule that the first parameter in the exit event is the return value of the syscall. Unfortunately, I've not found a great way to do that so for now we just monitor the parameters' names.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it's a best effort check, if the name matches we are quite confident that the first parameter is a return value

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this already cached the weird case of `PPME_GENERIC_X'

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ah i see, makes sense.
But then we are not using the check on param name at runtime anymore, so this is just to avoid that in the future a new syscall exit event is added whose first param is not a return code.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

exactly, today we are quite confident the rule is valid, this test tries to prevent future issues

Copy link

github-actions bot commented Dec 6, 2024

Perf diff from master - unit tests

     4.88%     -0.89%  [.] gzfile_read
     6.47%     +0.58%  [.] sinsp_evt::get_type
     3.51%     +0.53%  [.] sinsp_thread_manager::find_thread
     1.41%     -0.40%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release
     1.40%     -0.40%  [.] std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct<char const*>
    11.27%     -0.38%  [.] sinsp_parser::reset
     3.99%     -0.35%  [.] sinsp_evt::load_params
     1.25%     -0.32%  [.] std::vector<sinsp_evt_param, std::allocator<sinsp_evt_param> >::emplace_back<sinsp_evt*, unsigned int&, char const*, unsigned long&>
     1.34%     +0.31%  [.] libsinsp::sinsp_suppress::process_event
     0.37%     +0.29%  [.] sinsp_fdtable::find

Heap diff from master - unit tests

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            +0.0001         +0.0001           146           146           146           146
BM_sinsp_split_median                                          +0.0081         +0.0081           146           148           146           148
BM_sinsp_split_stddev                                          +0.4967         +0.4957             2             3             2             3
BM_sinsp_split_cv                                              +0.4966         +0.4956             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.0054         -0.0053            57            57            57            57
BM_sinsp_concatenate_paths_relative_path_median                -0.0049         -0.0048            57            57            57            57
BM_sinsp_concatenate_paths_relative_path_stddev                +0.6790         +0.6806             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_cv                    +0.6880         +0.6896             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0030         -0.0030            24            24            24            24
BM_sinsp_concatenate_paths_empty_path_median                   -0.0032         -0.0032            24            24            24            24
BM_sinsp_concatenate_paths_empty_path_stddev                   +0.7046         +0.7011             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       +0.7096         +0.7061             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  +0.0368         +0.0368            56            58            56            58
BM_sinsp_concatenate_paths_absolute_path_median                +0.0478         +0.0478            56            59            56            59
BM_sinsp_concatenate_paths_absolute_path_stddev                +2.6098         +2.6090             0             1             0             1
BM_sinsp_concatenate_paths_absolute_path_cv                    +2.4818         +2.4810             0             0             0             0
BM_sinsp_split_container_image_mean                            +0.0124         +0.0124           385           390           385           390
BM_sinsp_split_container_image_median                          +0.0114         +0.0114           386           391           386           391
BM_sinsp_split_container_image_stddev                          +0.4712         +0.4732             3             4             3             4
BM_sinsp_split_container_image_cv                              +0.4532         +0.4552             0             0             0             0

Copy link

codecov bot commented Dec 6, 2024

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 75.20%. Comparing base (7f160ac) to head (9845c6e).
Report is 1 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #2186   +/-   ##
=======================================
  Coverage   75.19%   75.20%           
=======================================
  Files         259      259           
  Lines       33899    33890    -9     
  Branches     5799     5801    +2     
=======================================
- Hits        25492    25487    -5     
+ Misses       8407     8403    -4     
Flag Coverage Δ
libsinsp 75.20% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@poiana
Copy link
Contributor

poiana commented Dec 6, 2024

LGTM label has been added.

Git tree hash: 2bd540684cc5cf9789f005658d56e5243aa4aa64

Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Dec 6, 2024

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit c5a3422 into falcosecurity:master Dec 6, 2024
49 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants