new(bpf-driver): Introduce `bpf_probe_read_user` and `bpf_probe_read_kernel` variants#809

Merged

poiana merged 27 commits intofalcosecurity:masterfrom hbrueckner:s390x-bpf-driver-2022-12-21

Feb 6, 2023

+406-240

Commits on Feb 6, 2023

new(bpf): introduce bpf_probe_read_{kernel,user}* variants
hbrueckner
committed
update(bpf): correct bpf probe reads for kernel/user memory access
hbrueckner
committed
new(bpf): provide _READP(P) variants for kernel/user memory reads
hbrueckner
committed
update(bpf): correct places where _READ(P) reads from user memory
hbrueckner
committed
new(bpf): enable helpers to read from kernel and user space memory
hbrueckner
committed
update(bpf): call helpers with user/kernel memory arguments
hbrueckner
committed
fix(bpf): Fix eBPF compilation on kernels <= 5.5

Molter73
authored and
hbrueckner
committed
update(bpf): add feature gate for bpf_probe_read_{kernel|user}*() variants
hbrueckner
committed
update(bpf): clean-up curly braces

hbrueckner
and
Molter73
committed
update(bpf): Extract helper for read values into the ring

hbrueckner
and
Molter73
committed
update(bpf): add RHEL version check for USE_BPF_PROBE_KERNEL_USER_VARIANTS

hbrueckner
and
Molter73
committed
fix(bpf): Fix 'USE_BPF_PROBE_KERNEL_USER_VARIANTS' feature gate

Molter73
authored and
hbrueckner
committed
fix(bpf): Fix verifier errors

Molter73
authored and
hbrueckner
committed
update(bpf): remove duplicate _READ in bpf_addr_to_kernel
hbrueckner
committed
update(bpf): correct user/kernel bpf read for unix socket path
hbrueckner
committed
update(bpf): update fsconfig bpf probe reads for user/kernel
hbrueckner
committed
update(bpf): read upper_layer from kernel space
hbrueckner
committed
update(bpf): read environ data in mm_struct from user space
hbrueckner
committed
update(bpf): read ipv4/6 addr/port from kernel sk structure
hbrueckner
committed
update(bpf): read socket path from kernel unix_sock
hbrueckner
committed
update(bpf): provide socktuple / qeuelen for successful accept_x
hbrueckner
committed
fix(bpf): correct fsconfigX_failure when pushing empty PT_CHARBUF param
hbrueckner
committed
update(bpf): correct flags param index for clone syscall on s390x
hbrueckner
committed
update(bpf): drop other child events when sched_proc_fork is used
hbrueckner
committed
update(kmod): provide socktuple / qeuelen for successful accept_x
hbrueckner
committed
chore(bpf): remove memset in _READ() macros

hbrueckner
and
FedeDP
committed
update(bpf): initialize variable to make clang-15 happy

hbrueckner
and
Andreagit97
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

new(bpf-driver): Introduce `bpf_probe_read_user` and `bpf_probe_read_kernel` variants#809

Commits on Feb 6, 2023

new(bpf): introduce bpf_probe_read_{kernel,user}* variants

update(bpf): correct bpf probe reads for kernel/user memory access

new(bpf): provide _READP(P) variants for kernel/user memory reads

update(bpf): correct places where _READ(P) reads from user memory

new(bpf): enable helpers to read from kernel and user space memory

update(bpf): call helpers with user/kernel memory arguments

fix(bpf): Fix eBPF compilation on kernels <= 5.5

update(bpf): add feature gate for `bpf_probe_read_{kernel|user}*()` variants

update(bpf): clean-up curly braces

update(bpf): Extract helper for read values into the ring

update(bpf): add RHEL version check for USE_BPF_PROBE_KERNEL_USER_VARIANTS

fix(bpf): Fix 'USE_BPF_PROBE_KERNEL_USER_VARIANTS' feature gate

fix(bpf): Fix verifier errors

update(bpf): remove duplicate _READ in bpf_addr_to_kernel

update(bpf): correct user/kernel bpf read for unix socket path

update(bpf): update fsconfig bpf probe reads for user/kernel

update(bpf): read upper_layer from kernel space

update(bpf): read environ data in mm_struct from user space

update(bpf): read ipv4/6 addr/port from kernel sk structure

update(bpf): read socket path from kernel unix_sock

update(bpf): provide socktuple / qeuelen for successful accept_x

fix(bpf): correct fsconfigX_failure when pushing empty PT_CHARBUF param

update(bpf): correct flags param index for clone syscall on s390x

update(bpf): drop other child events when sched_proc_fork is used

update(kmod): provide socktuple / qeuelen for successful accept_x

chore(bpf): remove `memset` in `_READ()` macros

update(bpf): initialize variable to make clang-15 happy