Skip to content

Commit d6bf28c

Browse files
geyslangeyslan
committed
chore(proctree): mov hash computation to userspace
1 parent a38a2e7 commit d6bf28c

15 files changed

+274
-226
lines changed

‎pkg/ebpf/c/tracee.bpf.c

+45-45
Original file line numberDiff line numberDiff line change
@@ -706,7 +706,7 @@ int tracepoint__sched__sched_process_fork(struct bpf_raw_tracepoint_args *ctx)
706706
save_to_submit_buf(&p.event->args_buf, (void *) &parent_ns_pid, sizeof(int), 3);
707707
save_to_submit_buf(&p.event->args_buf, (void *) &parent_start_time, sizeof(u64), 4);
708708

709-
// Child (might be a lwp or a process, sched_process_fork trace is calle by clone() also).
709+
// Child (might be a lwp or a process, sched_process_fork trace is called by clone() also).
710710
save_to_submit_buf(&p.event->args_buf, (void *) &child_tid, sizeof(int), 5);
711711
save_to_submit_buf(&p.event->args_buf, (void *) &child_ns_tid, sizeof(int), 6);
712712
save_to_submit_buf(&p.event->args_buf, (void *) &child_pid, sizeof(int), 7);
@@ -719,7 +719,7 @@ int tracepoint__sched__sched_process_fork(struct bpf_raw_tracepoint_args *ctx)
719719
// as a parent of the child in the hierarchy), are needed by the userland process tree.
720720
// The userland process tree default source of events is the signal events, but there is
721721
// an option to use regular event for maintaining it as well (and it is needed for some
722-
// situatins). These arguments will always be removed by userland event processors.
722+
// situations). These arguments will always be removed by userland event processors.
723723
struct task_struct *leader = get_leader_task(child);
724724
struct task_struct *parent_process = get_leader_task(get_parent_task(leader));
725725

@@ -7039,26 +7039,31 @@ int sched_process_exec_signal(struct bpf_raw_tracepoint_args *ctx)
70397039
if (unlikely(signal == NULL))
70407040
return 0;
70417041

7042-
// Hashes
7043-
70447042
struct task_struct *task = (struct task_struct *) ctx->args[0];
70457043
if (task == NULL)
70467044
return -1;
70477045
struct task_struct *leader = get_leader_task(task);
70487046
struct task_struct *parent = get_leader_task(get_parent_task(leader));
70497047

7050-
// The hash is always calculated with "task_struct->pid + start_time".
7051-
u32 task_hash = hash_task_id(get_task_host_pid(task), get_task_start_time(task));
7052-
u32 parent_hash = hash_task_id(get_task_host_pid(parent), get_task_start_time(parent));
7053-
u32 leader_hash = hash_task_id(get_task_host_pid(leader), get_task_start_time(leader));
7054-
70557048
// The event timestamp, so process tree info can be changelog'ed.
70567049
u64 timestamp = get_current_time_in_ns();
70577050
save_to_submit_buf(&signal->args_buf, &timestamp, sizeof(u64), 0);
70587051

7059-
save_to_submit_buf(&signal->args_buf, (void *) &task_hash, sizeof(u32), 1);
7060-
save_to_submit_buf(&signal->args_buf, (void *) &parent_hash, sizeof(u32), 2);
7061-
save_to_submit_buf(&signal->args_buf, (void *) &leader_hash, sizeof(u32), 3);
7052+
// Fields required for hash computation (start times and pids)
7053+
7054+
u64 task_start_time = get_task_start_time(task);
7055+
u64 parent_start_time = get_task_start_time(parent);
7056+
u64 leader_start_time = get_task_start_time(leader);
7057+
save_to_submit_buf(&signal->args_buf, &task_start_time, sizeof(task_start_time), 1);
7058+
save_to_submit_buf(&signal->args_buf, &parent_start_time, sizeof(parent_start_time), 2);
7059+
save_to_submit_buf(&signal->args_buf, &leader_start_time, sizeof(leader_start_time), 3);
7060+
7061+
u32 task_pid = get_task_host_pid(task);
7062+
u32 parent_pid = get_task_host_pid(parent);
7063+
u32 leader_pid = get_task_host_pid(leader);
7064+
save_to_submit_buf(&signal->args_buf, &task_pid, sizeof(task_pid), 4);
7065+
save_to_submit_buf(&signal->args_buf, &parent_pid, sizeof(parent_pid), 5);
7066+
save_to_submit_buf(&signal->args_buf, &leader_pid, sizeof(leader_pid), 6);
70627067

70637068
// Exec logic
70647069

@@ -7085,18 +7090,18 @@ int sched_process_exec_signal(struct bpf_raw_tracepoint_args *ctx)
70857090
u64 ctime = get_ctime_nanosec_from_file(file);
70867091
umode_t inode_mode = get_inode_mode_from_file(file);
70877092

7088-
save_str_to_buf(&signal->args_buf, (void *) filename, 4); // executable name
7089-
save_str_to_buf(&signal->args_buf, file_path, 5); // executable path
7090-
save_to_submit_buf(&signal->args_buf, &s_dev, sizeof(dev_t), 6); // device number
7091-
save_to_submit_buf(&signal->args_buf, &inode_nr, sizeof(unsigned long), 7); // inode number
7092-
save_to_submit_buf(&signal->args_buf, &ctime, sizeof(u64), 8); // creation time
7093-
save_to_submit_buf(&signal->args_buf, &inode_mode, sizeof(umode_t), 9); // inode mode
7093+
save_str_to_buf(&signal->args_buf, (void *) filename, 7); // executable name
7094+
save_str_to_buf(&signal->args_buf, file_path, 8); // executable path
7095+
save_to_submit_buf(&signal->args_buf, &s_dev, sizeof(dev_t), 9); // device number
7096+
save_to_submit_buf(&signal->args_buf, &inode_nr, sizeof(unsigned long), 10); // inode number
7097+
save_to_submit_buf(&signal->args_buf, &ctime, sizeof(u64), 11); // creation time
7098+
save_to_submit_buf(&signal->args_buf, &inode_mode, sizeof(umode_t), 12); // inode mode
70947099

7095-
// The proc_info interpreter field is set by "load_elf_phdrs" kprobe program.
7096-
save_str_to_buf(&signal->args_buf, &proc_info->interpreter.pathname, 10); // interpreter path
7097-
save_to_submit_buf(&signal->args_buf, &proc_info->interpreter.id.device, sizeof(dev_t), 11); // interpreter device number
7098-
save_to_submit_buf(&signal->args_buf, &proc_info->interpreter.id.inode, sizeof(u64), 12); // interpreter inode number
7099-
save_to_submit_buf(&signal->args_buf, &proc_info->interpreter.id.ctime, sizeof(u64), 13); // interpreter creation time
7100+
// The proc_info interpreter field is set by "load_elf_phdrs" kprobe program
7101+
save_str_to_buf(&signal->args_buf, &proc_info->interpreter.pathname, 13); // interpreter path
7102+
save_to_submit_buf(&signal->args_buf, &proc_info->interpreter.id.device, sizeof(dev_t), 14); // interpreter device number
7103+
save_to_submit_buf(&signal->args_buf, &proc_info->interpreter.id.inode, sizeof(u64), 15); // interpreter inode number
7104+
save_to_submit_buf(&signal->args_buf, &proc_info->interpreter.id.ctime, sizeof(u64), 16); // interpreter creation time
71007105

71017106
struct mm_struct *mm = get_mm_from_task(task); // bprm->mm is null here, but task->mm is not
71027107

@@ -7112,12 +7117,12 @@ int sched_process_exec_signal(struct bpf_raw_tracepoint_args *ctx)
71127117

71137118
bool invoked_from_kernel = !!(get_task_parent_flags(task) & PF_KTHREAD);
71147119

7115-
save_args_str_arr_to_buf(&signal->args_buf, (void *) arg_start, (void *) arg_end, argc, 14); // argv
7116-
save_str_to_buf(&signal->args_buf, (void *) interp, 15); // interp
7117-
save_to_submit_buf(&signal->args_buf, &stdin_type, sizeof(unsigned short), 16); // stdin type
7118-
save_str_to_buf(&signal->args_buf, stdin_path, 17); // stdin path
7119-
save_to_submit_buf(&signal->args_buf, &invoked_from_kernel, sizeof(bool), 18); // invoked from kernel ?
7120-
7120+
save_args_str_arr_to_buf(&signal->args_buf, (void *) arg_start, (void *) arg_end, argc, 17); // argv
7121+
save_str_to_buf(&signal->args_buf, (void *) interp, 18); // interp
7122+
save_to_submit_buf(&signal->args_buf, &stdin_type, sizeof(unsigned short), 19); // stdin type
7123+
save_str_to_buf(&signal->args_buf, stdin_path, 20); // stdin path
7124+
save_to_submit_buf(&signal->args_buf, &invoked_from_kernel, sizeof(bool), 21); // invoked from kernel ?
7125+
71217126
signal_perf_submit(ctx, signal);
71227127

71237128
return 0;
@@ -7132,28 +7137,23 @@ int sched_process_exit_signal(struct bpf_raw_tracepoint_args *ctx)
71327137
if (unlikely(signal == NULL))
71337138
return 0;
71347139

7135-
// Hashes
7136-
71377140
struct task_struct *task = (struct task_struct *) bpf_get_current_task();
71387141
if (task == NULL)
71397142
return -1;
7140-
struct task_struct *leader = get_leader_task(task);
7141-
struct task_struct *parent = get_leader_task(get_parent_task(leader));
7142-
7143-
// The hash is always calculated with "task_struct->pid + start_time".
7144-
u32 task_hash = hash_task_id(get_task_host_pid(task), get_task_start_time(task));
7145-
u32 parent_hash = hash_task_id(get_task_host_pid(parent), get_task_start_time(parent));
7146-
u32 leader_hash = hash_task_id(get_task_host_pid(leader), get_task_start_time(leader));
71477143

71487144
// The event timestamp, so process tree info can be changelog'ed.
71497145
u64 timestamp = get_current_time_in_ns();
71507146
save_to_submit_buf(&signal->args_buf, &timestamp, sizeof(u64), 0);
71517147

7152-
save_to_submit_buf(&signal->args_buf, (void *) &task_hash, sizeof(u32), 1);
7153-
save_to_submit_buf(&signal->args_buf, (void *) &parent_hash, sizeof(u32), 2);
7154-
save_to_submit_buf(&signal->args_buf, (void *) &leader_hash, sizeof(u32), 3);
7148+
// Fields required for hash computation (start times and pids)
7149+
7150+
u64 task_start_time = get_task_start_time(task);
7151+
save_to_submit_buf(&signal->args_buf, &task_start_time, sizeof(task_start_time), 1);
7152+
7153+
pid_t task_pid = (pid_t) get_task_host_pid(task);
7154+
save_to_submit_buf(&signal->args_buf, &task_pid, sizeof(task_pid), 2);
71557155

7156-
// Exit logic.
7156+
// Exit logic
71577157

71587158
bool group_dead = false;
71597159
struct signal_struct *s = BPF_CORE_READ(task, signal);
@@ -7167,12 +7167,12 @@ int sched_process_exit_signal(struct bpf_raw_tracepoint_args *ctx)
71677167
int exit_code = get_task_exit_code(task);
71687168
int exit_code_real = exit_code >> 8;
71697169

7170-
save_to_submit_buf(&signal->args_buf, (void *) &exit_code_real, sizeof(int), 4);
7170+
save_to_submit_buf(&signal->args_buf, (void *) &exit_code_real, sizeof(int), 3);
71717171
if (task_flags & PF_SIGNALED) {
71727172
int signal_code = exit_code & 0xFF;
7173-
save_to_submit_buf(&signal->args_buf, (void *) &signal_code, sizeof(int), 5);
7173+
save_to_submit_buf(&signal->args_buf, (void *) &signal_code, sizeof(int), 4);
71747174
}
7175-
save_to_submit_buf(&signal->args_buf, (void *) &group_dead, sizeof(bool), 6);
7175+
save_to_submit_buf(&signal->args_buf, (void *) &group_dead, sizeof(bool), 5);
71767176

71777177
signal_perf_submit(ctx, signal);
71787178

‎pkg/ebpf/controlplane/controller.go

+28
Original file line numberDiff line numberDiff line change
@@ -116,10 +116,38 @@ func (ctrl *Controller) processSignal(signal *signal) error {
116116
case events.SignalCgroupRmdir:
117117
return ctrl.processCgroupRmdir(signal.args)
118118
case events.SignalSchedProcessFork:
119+
events.NormalizeTimeArgs(
120+
signal.id,
121+
signal.args,
122+
[]string{
123+
"timestamp",
124+
"parent_process_start_time",
125+
"leader_start_time",
126+
"start_time",
127+
},
128+
)
119129
return ctrl.procTreeForkProcessor(signal.args)
120130
case events.SignalSchedProcessExec:
131+
events.NormalizeTimeArgs(
132+
signal.id,
133+
signal.args,
134+
[]string{
135+
"timestamp",
136+
"task_start_time",
137+
"parent_start_time",
138+
"leader_start_time",
139+
},
140+
)
121141
return ctrl.procTreeExecProcessor(signal.args)
122142
case events.SignalSchedProcessExit:
143+
events.NormalizeTimeArgs(
144+
signal.id,
145+
signal.args,
146+
[]string{
147+
"timestamp",
148+
"task_start_time",
149+
},
150+
)
123151
return ctrl.procTreeExitProcessor(signal.args)
124152
}
125153

‎pkg/ebpf/controlplane/processes.go

+40-30
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,6 @@ package controlplane
22

33
import (
44
"github.com/aquasecurity/tracee/pkg/events/parse"
5-
"github.com/aquasecurity/tracee/pkg/time"
65
"github.com/aquasecurity/tracee/pkg/utils"
76
"github.com/aquasecurity/tracee/types/trace"
87
)
@@ -95,19 +94,11 @@ func (ctrl *Controller) procTreeForkProcessor(args []trace.Argument) error {
9594
return err
9695
}
9796

98-
// Compute hashes using raw kernel start times without normalization.
99-
// The sched_process_fork signal is the only one that doesn't compute the hash in the kernel,
100-
// so it must be handled here.
97+
// Hashes
10198
forkFeed.ParentHash = utils.HashTaskID(uint32(forkFeed.ParentTid), forkFeed.ParentStartTime)
10299
forkFeed.LeaderHash = utils.HashTaskID(uint32(forkFeed.LeaderTid), forkFeed.LeaderStartTime)
103100
forkFeed.ChildHash = utils.HashTaskID(uint32(forkFeed.ChildTid), forkFeed.ChildStartTime)
104101

105-
// Normalize times
106-
forkFeed.TimeStamp = time.BootToEpochNS(forkFeed.TimeStamp)
107-
forkFeed.ParentStartTime = time.BootToEpochNS(forkFeed.ParentStartTime)
108-
forkFeed.LeaderStartTime = time.BootToEpochNS(forkFeed.LeaderStartTime)
109-
forkFeed.ChildStartTime = time.BootToEpochNS(forkFeed.ChildStartTime)
110-
111102
return ctrl.processTree.FeedFromFork(forkFeed)
112103
}
113104

@@ -123,24 +114,40 @@ func (ctrl *Controller) procTreeExecProcessor(args []trace.Argument) error {
123114
defer ctrl.processTree.PutExecFeedInPool(execFeed)
124115

125116
// not available from this signal
126-
execFeed.StartTime = 0
127117
execFeed.Pid = -1
128118
execFeed.Tid = -1
129119
execFeed.PPid = -1
130-
execFeed.HostPid = -1
131-
execFeed.HostTid = -1
132-
execFeed.HostPPid = -1
133120

134-
// Process & Event identification arguments (won't exist for regular events)
121+
// Process & Event identification arguments
135122
execFeed.TimeStamp, err = parse.ArgVal[uint64](args, "timestamp")
136123
if err != nil {
137124
return err
138125
}
139-
execFeed.TimeStamp = time.BootToEpochNS(execFeed.TimeStamp) // normalize time
126+
execFeed.StartTime, err = parse.ArgVal[uint64](args, "task_start_time")
127+
if err != nil {
128+
return err
129+
}
130+
parentStartTime, err := parse.ArgVal[uint64](args, "parent_start_time")
131+
if err != nil {
132+
return err
133+
}
134+
leaderStartTime, err := parse.ArgVal[uint64](args, "leader_start_time")
135+
if err != nil {
136+
return err
137+
}
140138

141-
execFeed.TaskHash, _ = parse.ArgVal[uint32](args, "task_hash")
142-
execFeed.ParentHash, _ = parse.ArgVal[uint32](args, "parent_hash")
143-
execFeed.LeaderHash, _ = parse.ArgVal[uint32](args, "leader_hash")
139+
execFeed.HostTid, err = parse.ArgVal[int32](args, "task_pid")
140+
if err != nil {
141+
return err
142+
}
143+
execFeed.HostPPid, err = parse.ArgVal[int32](args, "parent_pid")
144+
if err != nil {
145+
return err
146+
}
147+
execFeed.HostPid, err = parse.ArgVal[int32](args, "leader_pid")
148+
if err != nil {
149+
return err
150+
}
144151

145152
// Executable
146153
execFeed.CmdPath, err = parse.ArgVal[string](args, "cmdpath")
@@ -194,6 +201,11 @@ func (ctrl *Controller) procTreeExecProcessor(args []trace.Argument) error {
194201
return err
195202
}
196203

204+
// Hashes
205+
execFeed.TaskHash = utils.HashTaskID(uint32(execFeed.HostTid), execFeed.StartTime)
206+
execFeed.ParentHash = utils.HashTaskID(uint32(execFeed.HostPPid), parentStartTime)
207+
execFeed.LeaderHash = utils.HashTaskID(uint32(execFeed.HostPid), leaderStartTime)
208+
197209
return ctrl.processTree.FeedFromExec(execFeed)
198210
}
199211

@@ -212,25 +224,20 @@ func (ctrl *Controller) procTreeExitProcessor(args []trace.Argument) error {
212224
exitFeed := ctrl.processTree.GetExitFeedFromPool()
213225
defer ctrl.processTree.PutExitFeedInPool(exitFeed)
214226

215-
// Process & Event identification arguments (won't exist for regular events)
227+
// Process & Event identification arguments
216228
exitFeed.TimeStamp, err = parse.ArgVal[uint64](args, "timestamp")
217229
if err != nil {
218230
return err
219231
}
220-
exitFeed.TimeStamp = time.BootToEpochNS(exitFeed.TimeStamp) // normalize time
232+
startTime, err := parse.ArgVal[uint64](args, "task_start_time")
233+
if err != nil {
234+
return err
235+
}
221236

222-
exitFeed.TaskHash, err = parse.ArgVal[uint32](args, "task_hash")
237+
taskPid, err := parse.ArgVal[int32](args, "task_pid")
223238
if err != nil {
224239
return err
225240
}
226-
// exitFeed.ParentHash, err = parse.ArgVal[uint32](args, "parent_hash")
227-
// if err != nil {
228-
// return err
229-
// }
230-
// exitFeed.LeaderHash, err = parse.ArgVal[uint32](args, "leader_hash")
231-
// if err != nil {
232-
// return err
233-
// }
234241

235242
// // Exit logic arguments
236243
// exitFeed.ExitCode, err = parse.ArgVal[int32](args, "exit_code")
@@ -246,5 +253,8 @@ func (ctrl *Controller) procTreeExitProcessor(args []trace.Argument) error {
246253
// return err
247254
// }
248255

256+
// Hash
257+
exitFeed.TaskHash = utils.HashTaskID(uint32(taskPid), startTime)
258+
249259
return ctrl.processTree.FeedFromExit(exitFeed)
250260
}

‎pkg/ebpf/events_pipeline.go

+4-4
Original file line numberDiff line numberDiff line change
@@ -273,10 +273,10 @@ func (t *Tracee) decodeEvents(ctx context.Context, sourceChan chan []byte) (<-ch
273273
evt.ContextFlags = flags
274274
evt.Syscall = syscall
275275
evt.Metadata = nil
276-
// compute hashes using kernel start times as-is, to be consistent with signals
277-
evt.ThreadEntityId = utils.HashTaskID(eCtx.HostTid, eCtx.StartTime)
278-
evt.ProcessEntityId = utils.HashTaskID(eCtx.HostPid, eCtx.LeaderStartTime)
279-
evt.ParentEntityId = utils.HashTaskID(eCtx.HostPpid, eCtx.ParentStartTime)
276+
// compute hashes using normalized times
277+
evt.ThreadEntityId = utils.HashTaskID(eCtx.HostTid, uint64(evt.ThreadStartTime))
278+
evt.ProcessEntityId = utils.HashTaskID(eCtx.HostPid, traceetime.BootToEpochNS(eCtx.LeaderStartTime))
279+
evt.ParentEntityId = utils.HashTaskID(eCtx.HostPpid, traceetime.BootToEpochNS(eCtx.ParentStartTime))
280280

281281
// If there aren't any policies that need filtering in userland, tracee **may** skip
282282
// this event, as long as there aren't any derivatives or signatures that depend on it.

‎pkg/ebpf/net_capture.go

+1-1
Original file line numberDiff line numberDiff line change
@@ -97,7 +97,7 @@ func (t *Tracee) processNetCapEvent(event *trace.Event) {
9797

9898
// sanity checks
9999

100-
payloadArg := events.GetArg(event, "payload")
100+
payloadArg := events.GetArg(event.Args, "payload")
101101
if payloadArg == nil {
102102
logger.Debugw("Network capture: no payload packet")
103103
return

‎pkg/ebpf/processor.go

+4-6
Original file line numberDiff line numberDiff line change
@@ -85,23 +85,21 @@ func (t *Tracee) registerEventProcessors() {
8585
// Processors registered when proctree source "events" is enabled.
8686
switch t.config.ProcTree.Source {
8787
case proctree.SourceEvents, proctree.SourceBoth:
88-
t.RegisterEventProcessor(events.SchedProcessFork, t.procTreeForkProcessor)
89-
t.RegisterEventProcessor(events.SchedProcessExec, t.procTreeExecProcessor)
90-
t.RegisterEventProcessor(events.SchedProcessExit, t.procTreeExitProcessor)
91-
9288
// Event Timestamps Normalization
9389
//
9490
// Convert all time-related arguments to nanoseconds since the epoch.
9591
// NOTE: Ensure that all time-related arguments for your event are
9692
// converted here, so subsequent code works with normalized time values.
97-
// Exception: ProcessTree hashes rely on non-normalized timestamps,
98-
// so this conversion must occur AFTER the procTreeXXX processors.
9993
t.RegisterEventProcessor(events.SchedProcessFork, t.normalizeTimeArg(
10094
"start_time",
10195
"parent_start_time",
10296
"parent_process_start_time",
10397
"leader_start_time",
10498
))
99+
100+
t.RegisterEventProcessor(events.SchedProcessFork, t.procTreeForkProcessor)
101+
t.RegisterEventProcessor(events.SchedProcessExec, t.procTreeExecProcessor)
102+
t.RegisterEventProcessor(events.SchedProcessExit, t.procTreeExitProcessor)
105103
}
106104
// Processors enriching process tree with regular pipeline events.
107105
if t.config.ProcTree.Source != proctree.SourceNone {

0 commit comments

Comments
 (0)