[CWS] add additional fentry check for weak duplicated symbols (#31632)

pkg/security/ebpf/kernel/kernel.go

@@ -12,6 +12,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"sync"
 
@@ -375,6 +376,19 @@ func (k *Version) HaveFentrySupportWithStructArgs() bool {
 	return k.commonFentryCheck("audit_set_loginuid")
 }
 
+// HaveFentryNoDuplicatedWeakSymbols returns whether the kernel supports fentry probes with struct arguments
+func (k *Version) HaveFentryNoDuplicatedWeakSymbols() bool {
+	var symbol string
+	switch runtime.GOARCH {
+	case "amd64":
+		symbol = "__ia32_sys_setregid16"
+	default:
+		return true
+	}
+
+	return k.commonFentryCheck(symbol)
+}
+
 // SupportBPFSendSignal returns true if the eBPF function bpf_send_signal is available
 func (k *Version) SupportBPFSendSignal() bool {
 	return k.Code != 0 && k.Code >= Kernel5_3

pkg/security/probe/probe_ebpf.go

@@ -206,6 +206,12 @@ func (p *EBPFProbe) selectFentryMode() {
 		return
 	}
 
+	if !p.kernelVersion.HaveFentryNoDuplicatedWeakSymbols() {
+		p.useFentry = false
+		seclog.Warnf("fentry enabled but not supported with duplicated weak symbols, falling back to kprobe mode")
+		return
+	}
+
 	p.useFentry = true
 }