fix(proctree): exec event already brings data

Populate Process TaskInfo with data from sched_process_exec event.
Without it, the ProcessTree when set as source=events will contain
entries with no relevant data.

Author: geyslan

pkg/ebpf/processor_proctree.go

@@ -174,10 +174,17 @@ func (t *Tracee) procTreeExecProcessor(event *trace.Event) error {
 		return err
 	}
 
-	execFeed.TimeStamp = uint64(event.Timestamp)
-	execFeed.TaskHash = utils.HashTaskID(uint32(event.HostThreadID), uint64(event.ThreadStartTime))
-	execFeed.ParentHash = 0 // regular pipeline does not have parent hash
-	execFeed.LeaderHash = 0 // regular pipeline does not have leader hash
+	execFeed.TimeStamp = uint64(event.Timestamp)       // already normalized at decode stage
+	execFeed.StartTime = uint64(event.ThreadStartTime) // already normalized at decode stage
+	execFeed.TaskHash = event.ThreadEntityId           // already computed at decode stage
+	execFeed.ParentHash = event.ParentEntityId         // already computed at decode stage
+	execFeed.LeaderHash = event.ProcessEntityId        // already computed at decode stage
+	execFeed.Pid = int32(event.ProcessID)
+	execFeed.Tid = int32(event.ThreadID)
+	execFeed.PPid = int32(event.ParentProcessID)
+	execFeed.HostPid = int32(event.HostProcessID)
+	execFeed.HostTid = int32(event.HostThreadID)
+	execFeed.HostPPid = int32(event.HostParentProcessID)
 
 	return t.processTree.FeedFromExec(execFeed)
 }

pkg/proctree/proctree_feed.go

@@ -204,12 +204,19 @@ func (pt *ProcessTree) FeedFromFork(feed *ForkFeed) error {
 
 type ExecFeed struct {
 	TimeStamp         uint64
+	StartTime         uint64
 	Inode             uint64
 	Ctime             uint64
 	CmdPath           string
 	PathName          string
 	Interp            string
 	StdinPath         string
+	Pid               int32
+	Tid               int32
+	PPid              int32
+	HostPid           int32
+	HostTid           int32
+	HostPPid          int32
 	TaskHash          uint32
 	ParentHash        uint32
 	LeaderHash        uint32
@@ -258,10 +265,26 @@ func (pt *ProcessTree) FeedFromExec(feed *ExecFeed) error {
 	execTimestamp := traceetime.NsSinceEpochToTime(feed.TimeStamp)
 	basename := filepath.Base(feed.CmdPath)
 	comm := string([]byte(basename[:min(len(basename), COMM_LEN)]))
-	process.GetInfo().SetNameAt(
-		comm,
-		execTimestamp,
-	)
+
+	// NOTE: override all the fields of the taskInfoFeed, to avoid any previous data.
+	taskFeed := pt.GetTaskInfoFeedFromPool()
+
+	taskFeed.StartTimeNS = feed.StartTime
+	taskFeed.ExitTimeNS = 0
+	taskFeed.Name = comm
+	taskFeed.NsTid = feed.Tid
+	taskFeed.NsPid = feed.Pid
+	taskFeed.NsPPid = feed.PPid
+	taskFeed.Tid = feed.HostTid
+	taskFeed.Pid = feed.HostPid
+	taskFeed.PPid = feed.HostPPid
+	taskFeed.Uid = math.MaxUint32
+	taskFeed.Gid = math.MaxUint32
+
+	process.GetInfo().SetFeedAt(taskFeed, execTimestamp)
+
+	// Release the feed back to the pool as soon as it is not needed anymore
+	pt.PutTaskInfoFeedInPool(taskFeed)
 
 	// NOTE: override all the fields of the fileInfoFeed, to avoid any previous data.
 	fileInfoFeed := pt.GetFileInfoFeedFromPool()