update(parsers): Support userspace parsers for memfd_create syscall.

[Rohith-Raju]

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area libscap

/area tests

Does this PR require a change in the driver versions?

What this PR does / why we need it:

Since memfd_create creates an anonymous file it would be useful to extract the filename.
Also see #1127 (comment)

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

update(parsers): Support userspace parsers for memfd_create syscall

[github-actions]

Please double check driver/SCHEMA_VERSION file. See versioning.

[FedeDP]

I like this!
Thank you very much :)
/milestone 0.12.0

[incertum]

@Rohith-Raju thank you! Just requesting one additional comment else looks good already would say, but I can take a second look later again.

Saving the second reviewer some time since I already tested this earlier here #1066 (review):

Results:

sudo ./libsinsp/examples/sinsp-example -b driver/bpf/probe.o -f "(evt.type in (memfd_create) and evt.args contains libstest)" -j -o "*%evt.dir %evt.type %proc.cmdline %evt.args %fd.name %proc.exepath %fd.num %fd.typechar %fd.type"


{"evt.args":"fd=3(<m>libstest) name=libstest flags=1(MFD_CLOEXEC) ","evt.dir":"<","evt.type":"memfd_create","fd.name":"libstest","fd.num":3,"fd.type":"memfd","fd.typechar":"m","proc.cmdline":"python memfd.py","proc.exepath":"/usr/bin/python"}

and

sudo ./libsinsp/examples/sinsp-example -b driver/bpf/probe.o -f "(evt.type in (execve, execveat))" -j -o "*%evt.dir %evt.type %proc.cmdline %evt.arg.flags %fd.name %proc.exepath"


{"evt.arg.flags":"EXE_WRITABLE|EXE_FROM_MEMFD","evt.dir":"<","evt.type":"execve","fd.name":null,"proc.cmdline":"3 -l /proc/363337/fd/","proc.exepath":"/proc/363337/fd/3"}

[ exploit-test]$ python memfd.py 
/proc/363337/fd/3
total 0
lrwx------ 1 m m 64 Jun 23 21:11 0 -> /dev/pts/11
lrwx------ 1 m m 64 Jun 23 21:11 1 -> /dev/pts/11
lrwx------ 1 m m 64 Jun 23 21:11 2 -> /dev/pts/11
lrwx------ 1 m m 64 Jun 23 21:11 3 -> '/memfd:libstest (deleted)'
total 0
lrwx------ 1 m m 64 Jun 23 21:11 0 -> /dev/pts/11
lrwx------ 1 m m 64 Jun 23 21:11 1 -> /dev/pts/11
lrwx------ 1 m m 64 Jun 23 21:11 2 -> /dev/pts/11
lrwx------ 1 m m 64 Jun 23 21:11 3 -> '/memfd:libstest (deleted)'

[FedeDP]

/approve

[poiana]

LGTM label has been added.

Git tree hash: 7efc64574c1272b20f7b79bded0b0336f0c53d53

[incertum]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, incertum, Rohith-Raju

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [FedeDP,incertum]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment