Skip to content

Commit 398f606

Browse files
terror96poiana
terror96
authored and
poiana
committed
fix(userspace/libsinsp): remove state handling for PPM_SYSCALL_RMDIR
The new driver does not emit `PPM_SYSCALL_RMDIR` events anymore, and there is no longer need to handle the old version of the rmdir event. This update removes the state handling and adds conversion rules for the scap files. Signed-off-by: Tero Kauppinen <[email protected]>
1 parent a8d69fc commit 398f606

File tree

9 files changed

+55
-18
lines changed

9 files changed

+55
-18
lines changed

‎driver/SCHEMA_VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
3.65.0
1+
3.66.0

‎driver/event_table.c‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -608,10 +608,16 @@ const struct ppm_event_info g_event_info[] = {
608608
EF_OLD_VERSION | EF_TMP_CONVERTER_MANAGED,
609609
1,
610610
{{"res", PT_ERRNO, PF_DEC}}},
611-
[PPME_SYSCALL_RMDIR_E] =
612-
{"rmdir", EC_FILE | EC_SYSCALL, EF_OLD_VERSION, 1, {{"path", PT_FSPATH, PF_NA}}},
613-
[PPME_SYSCALL_RMDIR_X] =
614-
{"rmdir", EC_FILE | EC_SYSCALL, EF_OLD_VERSION, 1, {{"res", PT_ERRNO, PF_DEC}}},
611+
[PPME_SYSCALL_RMDIR_E] = {"rmdir",
612+
EC_FILE | EC_SYSCALL,
613+
EF_OLD_VERSION | EF_TMP_CONVERTER_MANAGED,
614+
1,
615+
{{"path", PT_FSPATH, PF_NA}}},
616+
[PPME_SYSCALL_RMDIR_X] = {"rmdir",
617+
EC_FILE | EC_SYSCALL,
618+
EF_OLD_VERSION | EF_TMP_CONVERTER_MANAGED,
619+
1,
620+
{{"res", PT_ERRNO, PF_DEC}}},
615621
[PPME_SYSCALL_OPENAT_E] = {"openat",
616622
EC_FILE | EC_SYSCALL,
617623
EF_CREATES_FD | EF_MODIFIES_STATE | EF_OLD_VERSION,

‎test/libscap/test_suites/engines/savefile/converter.cpp‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3993,6 +3993,42 @@ TEST_F(convert_event_test, PPME_SYSCALL_MKDIR_X_1_to_2_X_3_with_enter) {
39933993
create_safe_scap_event(ts, tid, PPME_SYSCALL_MKDIR_2_X, 3, res, path, mode));
39943994
}
39953995

3996+
////////////////////////////
3997+
// RMDIR
3998+
////////////////////////////
3999+
4000+
TEST_F(convert_event_test, PPME_SYSCALL_RMDIR_X_1_to_2_X_2_no_enter) {
4001+
constexpr uint64_t ts = 12;
4002+
constexpr int64_t tid = 25;
4003+
4004+
constexpr int64_t res = 89;
4005+
4006+
// Set to empty values
4007+
constexpr auto path = empty_value<scap_const_sized_buffer>();
4008+
4009+
const std::set<uint32_t> expected_empty_param_indexes{1};
4010+
4011+
assert_full_conversion(create_safe_scap_event(ts, tid, PPME_SYSCALL_RMDIR_X, 1, res),
4012+
create_safe_scap_event(ts, tid, PPME_SYSCALL_RMDIR_2_X, 2, res, path),
4013+
expected_empty_param_indexes);
4014+
}
4015+
4016+
TEST_F(convert_event_test, PPME_SYSCALL_RMDIR_X_1_to_2_X_2_with_enter) {
4017+
constexpr uint64_t ts = 12;
4018+
constexpr int64_t tid = 25;
4019+
4020+
constexpr int64_t res = 89;
4021+
constexpr char path[] = "/hello";
4022+
4023+
// After the first conversion we should have the storage
4024+
const auto evt = create_safe_scap_event(ts, tid, PPME_SYSCALL_RMDIR_E, 1, path);
4025+
assert_single_conversion_skip(evt);
4026+
assert_event_storage_presence(evt);
4027+
4028+
assert_full_conversion(create_safe_scap_event(ts, tid, PPME_SYSCALL_RMDIR_X, 1, res),
4029+
create_safe_scap_event(ts, tid, PPME_SYSCALL_RMDIR_2_X, 2, res, path));
4030+
}
4031+
39964032
////////////////////////////
39974033
// UNSHARE
39984034
////////////////////////////

‎userspace/libscap/engine/savefile/converter/table.cpp‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -311,6 +311,13 @@ const std::unordered_map<conversion_key, conversion_info> g_conversion_table = {
311311
.instrs({{C_INSTR_FROM_OLD, 0},
312312
{C_INSTR_FROM_ENTER, 0, CIF_FALLBACK_TO_EMPTY},
313313
{C_INSTR_FROM_ENTER, 1, CIF_FALLBACK_TO_EMPTY}})},
314+
/*====================== RMDIR ======================*/
315+
{conversion_key{PPME_SYSCALL_RMDIR_E, 1}, conversion_info().action(C_ACTION_STORE)},
316+
{conversion_key{PPME_SYSCALL_RMDIR_X, 1},
317+
conversion_info()
318+
.desired_type(PPME_SYSCALL_RMDIR_2_X)
319+
.action(C_ACTION_CHANGE_TYPE)
320+
.instrs({{C_INSTR_FROM_OLD, 0}, {C_INSTR_FROM_ENTER, 0, CIF_FALLBACK_TO_EMPTY}})},
314321
/*====================== UNSHARE ======================*/
315322
{conversion_key{PPME_SYSCALL_UNSHARE_E, 1}, conversion_info().action(C_ACTION_STORE)},
316323
{conversion_key{PPME_SYSCALL_UNSHARE_X, 1},

‎userspace/libscap/scap.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ struct scap_vtable;
102102
// and handle the result
103103
//
104104
#define SCAP_MINIMUM_DRIVER_API_VERSION PPM_API_VERSION(8, 0, 0)
105-
#define SCAP_MINIMUM_DRIVER_SCHEMA_VERSION PPM_API_VERSION(3, 65, 0)
105+
#define SCAP_MINIMUM_DRIVER_SCHEMA_VERSION PPM_API_VERSION(3, 66, 0)
106106

107107
//
108108
// This is the dimension we used before introducing the variable buffer size.

‎userspace/libsinsp/event.cpp‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1700,7 +1700,6 @@ void sinsp_evt::save_enter_event_params(sinsp_evt *enter_evt) {
17001700

17011701
std::vector<const char *> *pnames = NULL;
17021702
switch(get_type()) {
1703-
case PPME_SYSCALL_RMDIR_X:
17041703
case PPME_SYSCALL_UNLINK_X:
17051704
pnames = &path_param;
17061705
break;

‎userspace/libsinsp/parsers.cpp‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -103,15 +103,13 @@ void sinsp_parser::process_event(sinsp_evt &evt, sinsp_parser_verdict &verdict)
103103
case PPME_SYSCALL_OPENAT2_E:
104104
case PPME_SYSCALL_LINK_E:
105105
case PPME_SYSCALL_LINKAT_E:
106-
case PPME_SYSCALL_RMDIR_E:
107106
case PPME_SYSCALL_UNLINK_E:
108107
case PPME_SYSCALL_UNLINKAT_E:
109108
case PPME_SYSCALL_EXECVE_18_E:
110109
case PPME_SYSCALL_EXECVE_19_E:
111110
case PPME_SYSCALL_EXECVEAT_E:
112111
store_event(evt);
113112
break;
114-
case PPME_SYSCALL_RMDIR_X:
115113
case PPME_SYSCALL_LINK_X:
116114
case PPME_SYSCALL_LINKAT_X:
117115
case PPME_SYSCALL_UNLINK_X:

‎userspace/libsinsp/sinsp_filtercheck_fspath.cpp‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -159,8 +159,6 @@ void sinsp_filter_check_fspath::create_fspath_checks() {
159159
m_path_checks->emplace(PPME_SYSCALL_MKDIRAT_X, evt_arg_path);
160160
m_success_checks->emplace(PPME_SYSCALL_MKDIRAT_X, evt_arg_res_eq_0);
161161

162-
m_success_checks->emplace(PPME_SYSCALL_RMDIR_X, evt_arg_res_eq_0);
163-
164162
m_path_checks->emplace(PPME_SYSCALL_RMDIR_2_X, evt_arg_path);
165163
m_success_checks->emplace(PPME_SYSCALL_RMDIR_2_X, evt_arg_res_eq_0);
166164

@@ -317,7 +315,6 @@ uint8_t* sinsp_filter_check_fspath::extract_single(sinsp_evt* evt,
317315

318316
// For some event types we need to get the values from the enter event instead.
319317
switch(evt->get_type()) {
320-
case PPME_SYSCALL_RMDIR_X:
321318
case PPME_SYSCALL_UNLINK_X:
322319
enter_param = evt->get_enter_evt_param("path");
323320
if(!enter_param.has_value()) {

‎userspace/libsinsp/test/events_fspath.ut.cpp‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -305,12 +305,6 @@ TEST_F(fspath, mkdirat) {
305305
test_failed_exit(PPME_SYSCALL_MKDIRAT_X, 4, failed_res, evt_dirfd, path, mode);
306306
}
307307

308-
TEST_F(fspath, rmdir) {
309-
test_enter(PPME_SYSCALL_RMDIR_E, 1, path);
310-
test_exit_path(path, path, PPME_SYSCALL_RMDIR_X, 1, res);
311-
test_failed_exit(PPME_SYSCALL_RMDIR_X, 1, failed_res);
312-
}
313-
314308
TEST_F(fspath, rmdir_2) {
315309
test_enter(PPME_SYSCALL_RMDIR_2_E, 0);
316310
test_exit_path(path, path, PPME_SYSCALL_RMDIR_2_X, 2, res, path);

0 commit comments

Comments
 (0)