Support pidfd_open syscall #1187

Rohith-Raju · 2023-07-05T09:43:50Z

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area tests

Does this PR require a change in the driver versions?

What this PR does / why we need it:

This PR adds support for pidfd_open syscall

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Support pidfd_open syscall

Signed-off-by: rohith-raju <rohithraju488@gmail.com>

github-actions · 2023-07-05T09:44:18Z

Please double check driver/API_VERSION file. See versioning.

Signed-off-by: rohith-raju <rohithraju488@gmail.com>

Andreagit97

Thank you for this!

Andreagit97 · 2023-07-17T12:05:20Z

driver/bpf/fillers.h

+	unsigned long flags;
+
+	/* Parameter 1: ret (type: PT_FD) */
+	retval = bpf_syscall_get_retval(data->ctx);


Suggested change

retval = bpf_syscall_get_retval(data->ctx);

long retval = bpf_syscall_get_retval(data->ctx);

Andreagit97 · 2023-07-17T12:10:03Z

driver/bpf/fillers.h

+
+	/* Parameter 1: ret (type: PT_FD) */
+	retval = bpf_syscall_get_retval(data->ctx);
+	res = bpf_push_s64_to_ring(data, retval);


Suggested change

res = bpf_push_s64_to_ring(data, retval);

int res = bpf_push_s64_to_ring(data, retval);

driver/bpf/fillers.h

Andreagit97 · 2023-07-17T12:31:31Z

driver/modern_bpf/definitions/missing_definitions.h

+//////////////////////////
+// pidfd_open flags
+//////////////////////////
+# define PIDFD_NONBLOCK 1U


why do we use 1U here? In the kernel I found

#define PIDFD_NONBLOCK O_NONBLOCK

driver/bpf/fillers.h

test/drivers/test_suites/syscall_exit_suite/pidfd_open_x.cpp

Andreagit97

Almost done :)

driver/bpf/fillers.h

Andreagit97 · 2023-07-18T09:13:25Z

driver/ppm_fillers.c

+{
+	unsigned long val;
+	int res;
+	int retval;


we still need to address this

Signed-off-by: rohith-raju <rohithraju488@gmail.com>

Rohith-Raju · 2023-07-18T11:05:55Z

@Andreagit97 We probably need to add a kernel check since the test is using 5.8. WDYT?
https://app.circleci.com/pipelines/github/falcosecurity/libs/1551/workflows/e87d59c2-1033-4f49-9abd-de04f3d09db1/jobs/4382?invite=true#step-105-11153_6

Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>

Andreagit97 · 2023-07-18T11:28:42Z

@Andreagit97 We probably need to add a kernel check since the test is using 5.8. WDYT? https://app.circleci.com/pipelines/github/falcosecurity/libs/1551/workflows/e87d59c2-1033-4f49-9abd-de04f3d09db1/jobs/4382?invite=true#step-105-11153_6

I moved the flag checks in the failure case, this should solve our issues 🤞

Andreagit97

/approve

poiana · 2023-07-18T12:40:34Z

LGTM label has been added.

Git tree hash: fe01ebc452b0d150696f4ad40c8382682b183259

jasondellaluce

/approve

poiana · 2023-07-18T13:02:10Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, jasondellaluce, Rohith-Raju

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Andreagit97,jasondellaluce]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

FedeDP · 2023-07-28T13:02:24Z

/milestone 5.1.0+driver

update(driver): support for pidfd_open syscall

028a618

Signed-off-by: rohith-raju <rohithraju488@gmail.com>

poiana added release-note do-not-merge/work-in-progress kind/feature New feature or request dco-signoff: yes area/driver-kmod area/driver-bpf area/driver-modern-bpf area/tests area/proposals labels Jul 5, 2023

poiana requested review from hbrueckner and jasondellaluce July 5, 2023 09:43

poiana added the size/XL label Jul 5, 2023

update(driver): Changes to syscall

61e1dc5

Signed-off-by: rohith-raju <rohithraju488@gmail.com>

Rohith-Raju force-pushed the pidfd_open branch 4 times, most recently from 463b4b6 to d732b41 Compare July 9, 2023 06:57

update(test): fix failing tests

0c6ad89

Signed-off-by: rohith-raju <rohithraju488@gmail.com>

Rohith-Raju force-pushed the pidfd_open branch from d732b41 to 0c6ad89 Compare July 9, 2023 15:27

update(test/syscall_exit_suite): added kernal check

42d6c18

Signed-off-by: rohith-raju <rohithraju488@gmail.com>

Rohith-Raju force-pushed the pidfd_open branch from 6cd0c1d to 42d6c18 Compare July 11, 2023 16:15

Rohith-Raju changed the title ~~WIP: Support pidfd_open syscall~~ Support pidfd_open syscall Jul 11, 2023

poiana removed the do-not-merge/work-in-progress label Jul 11, 2023

Andreagit97 modified the milestones: 0.13.0, driver-backlog Jul 17, 2023

Andreagit97 reviewed Jul 17, 2023

View reviewed changes

Andreagit97 mentioned this pull request Jul 17, 2023

[UMBRELLA] Missing syscalls falcosecurity/falco#1998

Open

35 tasks

Rohith-Raju force-pushed the pidfd_open branch from ad70eac to f576e80 Compare July 18, 2023 07:18

Andreagit97 reviewed Jul 18, 2023

View reviewed changes

update(driver): address review requests

bf66008

Signed-off-by: rohith-raju <rohithraju488@gmail.com>

Rohith-Raju force-pushed the pidfd_open branch from f576e80 to bf66008 Compare July 18, 2023 10:07

tests: check flags value in the failure case

3e12a98

Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>

Andreagit97 approved these changes Jul 18, 2023

View reviewed changes

poiana assigned Andreagit97 Jul 18, 2023

poiana added the lgtm label Jul 18, 2023

poiana added the approved label Jul 18, 2023

Andreagit97 modified the milestones: driver-backlog, next-driver Jul 18, 2023

jasondellaluce approved these changes Jul 18, 2023

View reviewed changes

poiana assigned jasondellaluce Jul 18, 2023

poiana merged commit 199e5aa into falcosecurity:master Jul 18, 2023

poiana modified the milestones: next-driver, 5.1.0+driver Jul 28, 2023

Rohith-Raju deleted the pidfd_open branch December 11, 2023 09:19

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support pidfd_open syscall #1187

Support pidfd_open syscall #1187

Rohith-Raju commented Jul 5, 2023 •

edited

Loading

github-actions bot commented Jul 5, 2023 •

edited

Loading

Andreagit97 left a comment

Andreagit97 Jul 17, 2023

Andreagit97 Jul 17, 2023

Andreagit97 Jul 17, 2023

Andreagit97 left a comment

Andreagit97 Jul 18, 2023

Rohith-Raju commented Jul 18, 2023 •

edited

Loading

Andreagit97 commented Jul 18, 2023

Andreagit97 left a comment

poiana commented Jul 18, 2023

jasondellaluce left a comment

poiana commented Jul 18, 2023

FedeDP commented Jul 28, 2023

	retval = bpf_syscall_get_retval(data->ctx);
	long retval = bpf_syscall_get_retval(data->ctx);

	res = bpf_push_s64_to_ring(data, retval);
	int res = bpf_push_s64_to_ring(data, retval);

Support pidfd_open syscall #1187

Support pidfd_open syscall #1187

Conversation

Rohith-Raju commented Jul 5, 2023 • edited Loading

github-actions bot commented Jul 5, 2023 • edited Loading

Andreagit97 left a comment

Choose a reason for hiding this comment

Andreagit97 Jul 17, 2023

Choose a reason for hiding this comment

Andreagit97 Jul 17, 2023

Choose a reason for hiding this comment

Andreagit97 Jul 17, 2023

Choose a reason for hiding this comment

Andreagit97 left a comment

Choose a reason for hiding this comment

Andreagit97 Jul 18, 2023

Choose a reason for hiding this comment

Rohith-Raju commented Jul 18, 2023 • edited Loading

Andreagit97 commented Jul 18, 2023

Andreagit97 left a comment

Choose a reason for hiding this comment

poiana commented Jul 18, 2023

jasondellaluce left a comment

Choose a reason for hiding this comment

poiana commented Jul 18, 2023

FedeDP commented Jul 28, 2023

Rohith-Raju commented Jul 5, 2023 •

edited

Loading

github-actions bot commented Jul 5, 2023 •

edited

Loading

Rohith-Raju commented Jul 18, 2023 •

edited

Loading