update: address some review comments

Signed-off-by: Andrea Terzolo <andrea.terzolo@polito.it> Co-authored-by: Federico Di Pierro <nierro92@gmail.com> Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>
falcosecurity · May 12, 2023 · 8fde485 · 8fde485
1 parent d228c08
commit 8fde485
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 5 deletions.
diff --git a/userspace/libpman/include/libpman.h b/userspace/libpman/include/libpman.h
@@ -25,7 +25,7 @@ extern "C"
 {
 #endif
 
-	/* Forward decleare them */
+	/* Forward declare them */
 	struct scap_stats_v2;
 	struct scap_stats;
 
@@ -296,7 +296,7 @@ extern "C"
 	int pman_get_scap_stats(struct scap_stats* scap_stats_struct);
 
 	/**
-	 * @brief Retutn a `scap_stats_v2` struct filled with statistics.
+	 * @brief Return a `scap_stats_v2` struct filled with statistics.
 	 *
 	 * @param flags holding statistics category flags.
 	 * @param nstats number of stats allocated.

diff --git a/userspace/libscap/engine/bpf/scap_bpf.c b/userspace/libscap/engine/bpf/scap_bpf.c
@@ -1729,6 +1729,9 @@ const struct scap_stats_v2* scap_bpf_get_stats_v2(struct scap_engine_handle engi
 	 * Hopefully someone upstreams such capabilities to libbpf one day :)
 	 * Meanwhile, we can simulate perf comparisons between future LSM hooks and sys enter and exit tracepoints
 	 * via leveraging syscall selection mechanisms `handle->curr_sc_set`.
+	 * 
+	 * Please note that libbpf stats are available only on kernels >= 5.1, they could be backported but
+	 * it's possible that in some of our supported kernels they won't be available.
 	 */
 	if ((flags & PPM_SCAP_STATS_LIBBPF_STATS))
 	{
@@ -1756,12 +1759,13 @@ const struct scap_stats_v2* scap_bpf_get_stats_v2(struct scap_engine_handle engi
 				}
 				stats[offset].type = STATS_VALUE_TYPE_U64;
 				stats[offset].flags = PPM_SCAP_STATS_LIBBPF_STATS;
-				/* This could happen on old kernels where we don't have names inside the info struct
-				 * https://github.com/torvalds/linux/blob/16a8829130ca22666ac6236178a6233208d425c3/tools/lib/bpf/libbpf.c#L4833
+				/* The possibility to specify a name for a BPF program was introduced in kernel 4.15 
+				 * https://github.com/torvalds/linux/commit/cb4d2b3f03d8eed90be3a194e5b54b734ec4bbe9
+				 * So it's possible that in some of our supported kernels `info.name` will be "".
 				 */
 				if(strlen(info.name) == 0)
 				{
-					/* Fallback on the section name */
+					/* Fallback on the elf section name */
 					strlcpy(stats[offset].name, handle->m_attached_progs[bpf_prog].name, STATS_NAME_MAX);
 				}
 				else