Skip to content

Commit 427b42f

Browse files
terror96terror96
committed
fix(userspace/libsinsp): remove state handling for PPM_SYSCALL_UNLINK
and PPM_SYSCALL_UNLINKAT The new driver does not emit `PPM_SYSCALL_UNLINK` and `PPM_SYSCALL_UNLINKAT` events anymore, and there is no longer need to handle the old version of the events. This update removes the state handling and adds conversion rules for the scap files. Signed-off-by: Tero Kauppinen <[email protected]>
1 parent 1e35de4 commit 427b42f

File tree

10 files changed

+154
-46
lines changed

10 files changed

+154
-46
lines changed

‎driver/SCHEMA_VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
3.66.0
1+
3.67.0

‎driver/event_table.c‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -648,17 +648,26 @@ const struct ppm_event_info g_event_info[] = {
648648
{"newpath", PT_CHARBUF, PF_NA}}},
649649
[PPME_SYSCALL_LINKAT_X] =
650650
{"linkat", EC_FILE | EC_SYSCALL, EF_OLD_VERSION, 1, {{"res", PT_ERRNO, PF_DEC}}},
651-
[PPME_SYSCALL_UNLINK_E] =
652-
{"unlink", EC_FILE | EC_SYSCALL, EF_OLD_VERSION, 1, {{"path", PT_FSPATH, PF_NA}}},
653-
[PPME_SYSCALL_UNLINK_X] =
654-
{"unlink", EC_FILE | EC_SYSCALL, EF_OLD_VERSION, 1, {{"res", PT_ERRNO, PF_DEC}}},
651+
[PPME_SYSCALL_UNLINK_E] = {"unlink",
652+
EC_FILE | EC_SYSCALL,
653+
EF_OLD_VERSION | EF_TMP_CONVERTER_MANAGED,
654+
1,
655+
{{"path", PT_FSPATH, PF_NA}}},
656+
[PPME_SYSCALL_UNLINK_X] = {"unlink",
657+
EC_FILE | EC_SYSCALL,
658+
EF_OLD_VERSION | EF_TMP_CONVERTER_MANAGED,
659+
1,
660+
{{"res", PT_ERRNO, PF_DEC}}},
655661
[PPME_SYSCALL_UNLINKAT_E] = {"unlinkat",
656662
EC_FILE | EC_SYSCALL,
657-
EF_OLD_VERSION,
663+
EF_OLD_VERSION | EF_TMP_CONVERTER_MANAGED,
658664
2,
659665
{{"dirfd", PT_FD, PF_DEC}, {"name", PT_CHARBUF, PF_NA}}},
660-
[PPME_SYSCALL_UNLINKAT_X] =
661-
{"unlinkat", EC_FILE | EC_SYSCALL, EF_OLD_VERSION, 1, {{"res", PT_ERRNO, PF_DEC}}},
666+
[PPME_SYSCALL_UNLINKAT_X] = {"unlinkat",
667+
EC_FILE | EC_SYSCALL,
668+
EF_OLD_VERSION | EF_TMP_CONVERTER_MANAGED,
669+
1,
670+
{{"res", PT_ERRNO, PF_DEC}}},
662671
[PPME_SYSCALL_PREAD_E] = {"pread",
663672
EC_IO_READ | EC_SYSCALL,
664673
EF_USES_FD | EF_READS_FROM_FD | EF_TMP_CONVERTER_MANAGED,

‎test/libscap/test_suites/engines/savefile/converter.cpp‎

Lines changed: 108 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -153,6 +153,114 @@ TEST_F(convert_event_test, PPME_SYSCALL_READ_X_to_4_params_with_enter) {
153153
size));
154154
}
155155

156+
////////////////////////////
157+
// UNLINK
158+
////////////////////////////
159+
160+
TEST_F(convert_event_test, PPME_SYSCALL_UNLINK_X_1_to_2_X_2_params_no_enter) {
161+
constexpr uint64_t ts = 12;
162+
constexpr int64_t tid = 25;
163+
164+
constexpr int64_t res = 89;
165+
166+
// Set to empty.
167+
constexpr auto path = empty_value<char *>();
168+
169+
SCAP_EMPTY_PARAMS_SET(empty_params_set, 1);
170+
171+
assert_single_conversion_success(
172+
CONVERSION_COMPLETED,
173+
create_safe_scap_event(ts, tid, PPME_SYSCALL_UNLINK_X, 1, res),
174+
create_safe_scap_event_with_empty_params(ts,
175+
tid,
176+
PPME_SYSCALL_UNLINK_2_X,
177+
&empty_params_set,
178+
2,
179+
res,
180+
path));
181+
}
182+
183+
TEST_F(convert_event_test, PPME_SYSCALL_UNLINK_X_1_to_2_X_2_params_with_enter) {
184+
constexpr uint64_t ts = 12;
185+
constexpr int64_t tid = 25;
186+
187+
constexpr int64_t res = 89;
188+
constexpr char path[] = "/etc/ld.so.preload";
189+
190+
// After the first conversion we should have the storage
191+
const auto evt = create_safe_scap_event(ts, tid, PPME_SYSCALL_UNLINK_E, 1, path);
192+
assert_single_conversion_skip(evt);
193+
assert_event_storage_presence(evt);
194+
195+
assert_single_conversion_success(
196+
CONVERSION_COMPLETED,
197+
create_safe_scap_event(ts, tid, PPME_SYSCALL_UNLINK_X, 1, res),
198+
create_safe_scap_event(ts, tid, PPME_SYSCALL_UNLINK_2_X, 2, res, path));
199+
}
200+
201+
////////////////////////////
202+
// UNLINKAT
203+
////////////////////////////
204+
205+
TEST_F(convert_event_test, PPME_SYSCALL_UNLINKAT_X_1_to_2_X_4_params_no_enter) {
206+
constexpr uint64_t ts = 12;
207+
constexpr int64_t tid = 25;
208+
209+
constexpr int64_t res = 89;
210+
211+
// Set to empty.
212+
constexpr auto dirfd = empty_value<int64_t>();
213+
constexpr auto name = empty_value<char *>();
214+
constexpr auto flags = empty_value<uint32_t>();
215+
216+
SCAP_EMPTY_PARAMS_SET(empty_params_set, 1, 2, 3);
217+
218+
assert_single_conversion_success(
219+
CONVERSION_COMPLETED,
220+
create_safe_scap_event(ts, tid, PPME_SYSCALL_UNLINKAT_X, 1, res),
221+
create_safe_scap_event_with_empty_params(ts,
222+
tid,
223+
PPME_SYSCALL_UNLINKAT_2_X,
224+
&empty_params_set,
225+
4,
226+
res,
227+
dirfd,
228+
name,
229+
flags));
230+
}
231+
232+
TEST_F(convert_event_test, PPME_SYSCALL_UNLINKAT_X_1_to_2_X_4_params_with_enter) {
233+
constexpr uint64_t ts = 12;
234+
constexpr int64_t tid = 25;
235+
236+
constexpr int64_t res = 89;
237+
constexpr int64_t dirfd = 25;
238+
constexpr char name[] = "/etc/ld.so.preload";
239+
240+
// Set to empty.
241+
constexpr auto flags = empty_value<uint32_t>();
242+
243+
SCAP_EMPTY_PARAMS_SET(empty_params_set, 3);
244+
245+
// After the first conversion we should have the storage
246+
const auto evt = create_safe_scap_event(ts, tid, PPME_SYSCALL_UNLINKAT_E, 2, dirfd, name);
247+
assert_single_conversion_skip(evt);
248+
assert_event_storage_presence(evt);
249+
250+
assert_single_conversion_success(
251+
CONVERSION_COMPLETED,
252+
create_safe_scap_event(ts, tid, PPME_SYSCALL_UNLINKAT_X, 1, res),
253+
create_safe_scap_event_with_empty_params(ts,
254+
tid,
255+
PPME_SYSCALL_UNLINKAT_2_X,
256+
&empty_params_set,
257+
4,
258+
res,
259+
dirfd,
260+
name,
261+
flags));
262+
}
263+
156264
////////////////////////////
157265
// PREAD
158266
////////////////////////////

‎userspace/libscap/engine/savefile/converter/table.cpp‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,25 @@ const std::unordered_map<conversion_key, conversion_info> g_conversion_table = {
3232
conversion_info()
3333
.action(C_ACTION_ADD_PARAMS)
3434
.instrs({{C_INSTR_FROM_ENTER, 0}, {C_INSTR_FROM_ENTER, 1}})},
35+
/*====================== UNLINK ======================*/
36+
{conversion_key{PPME_SYSCALL_UNLINK_E, 1}, conversion_info().action(C_ACTION_STORE)},
37+
{conversion_key{PPME_SYSCALL_UNLINK_X, 1},
38+
conversion_info()
39+
.desired_type(PPME_SYSCALL_UNLINK_2_X)
40+
.action(C_ACTION_CHANGE_TYPE)
41+
.instrs({{C_INSTR_FROM_OLD, 0}, {C_INSTR_FROM_ENTER, 0, CIF_FALLBACK_TO_EMPTY}})},
42+
/*====================== UNLINKAT ======================*/
43+
{conversion_key{PPME_SYSCALL_UNLINKAT_E, 2}, conversion_info().action(C_ACTION_STORE)},
44+
{conversion_key{PPME_SYSCALL_UNLINKAT_X, 1},
45+
conversion_info()
46+
.desired_type(PPME_SYSCALL_UNLINKAT_2_X)
47+
.action(C_ACTION_CHANGE_TYPE)
48+
.instrs({
49+
{C_INSTR_FROM_OLD, 0},
50+
{C_INSTR_FROM_ENTER, 0, CIF_FALLBACK_TO_EMPTY},
51+
{C_INSTR_FROM_ENTER, 1, CIF_FALLBACK_TO_EMPTY},
52+
{C_INSTR_FROM_EMPTY, 0}, // flags
53+
})},
3554
/*====================== PREAD ======================*/
3655
{conversion_key{PPME_SYSCALL_PREAD_E, 3}, conversion_info().action(C_ACTION_STORE)},
3756
{conversion_key{PPME_SYSCALL_PREAD_X, 2},

‎userspace/libscap/scap.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ struct scap_vtable;
102102
// and handle the result
103103
//
104104
#define SCAP_MINIMUM_DRIVER_API_VERSION PPM_API_VERSION(8, 0, 0)
105-
#define SCAP_MINIMUM_DRIVER_SCHEMA_VERSION PPM_API_VERSION(3, 66, 0)
105+
#define SCAP_MINIMUM_DRIVER_SCHEMA_VERSION PPM_API_VERSION(3, 67, 0)
106106

107107
//
108108
// This is the dimension we used before introducing the variable buffer size.

‎userspace/libsinsp/event.cpp‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1721,21 +1721,15 @@ uint64_t sinsp_evt::get_lastevent_ts() const {
17211721
}
17221722

17231723
void sinsp_evt::save_enter_event_params(sinsp_evt *enter_evt) {
1724-
static std::vector<const char *> path_param = {"path"};
17251724
static std::vector<const char *> oldpath_newpath_param = {"oldpath", "newpath"};
17261725
static std::vector<const char *> name_param = {"name"};
17271726

17281727
std::vector<const char *> *pnames = NULL;
17291728
switch(get_type()) {
1730-
case PPME_SYSCALL_UNLINK_X:
1731-
pnames = &path_param;
1732-
break;
1733-
17341729
case PPME_SYSCALL_LINK_X:
17351730
case PPME_SYSCALL_LINKAT_X:
17361731
pnames = &oldpath_newpath_param;
17371732
break;
1738-
case PPME_SYSCALL_UNLINKAT_X:
17391733
case PPME_SYSCALL_OPENAT_X:
17401734
pnames = &name_param;
17411735
break;

‎userspace/libsinsp/parsers.cpp‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -103,16 +103,12 @@ void sinsp_parser::process_event(sinsp_evt &evt, sinsp_parser_verdict &verdict)
103103
case PPME_SYSCALL_OPENAT2_E:
104104
case PPME_SYSCALL_LINK_E:
105105
case PPME_SYSCALL_LINKAT_E:
106-
case PPME_SYSCALL_UNLINK_E:
107-
case PPME_SYSCALL_UNLINKAT_E:
108106
case PPME_SYSCALL_EXECVE_19_E:
109107
case PPME_SYSCALL_EXECVEAT_E:
110108
store_event(evt);
111109
break;
112110
case PPME_SYSCALL_LINK_X:
113111
case PPME_SYSCALL_LINKAT_X:
114-
case PPME_SYSCALL_UNLINK_X:
115-
case PPME_SYSCALL_UNLINKAT_X:
116112
parse_fspath_related_exit(evt);
117113
break;
118114
case PPME_SYSCALL_READ_X:

‎userspace/libsinsp/sinsp_filtercheck_event.cpp‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -724,7 +724,7 @@ uint8_t* sinsp_filter_check_event::extract_abspath(sinsp_evt* evt, uint32_t* len
724724
dirfdarg = "newdir";
725725
patharg = "newpath";
726726
}
727-
} else if(etype == PPME_SYSCALL_UNLINKAT_E || etype == PPME_SYSCALL_UNLINKAT_2_X) {
727+
} else if(etype == PPME_SYSCALL_UNLINKAT_2_X) {
728728
dirfdarg = "dirfd";
729729
patharg = "name";
730730
} else if(etype == PPME_SYSCALL_MKDIRAT_X) {
@@ -758,9 +758,15 @@ uint8_t* sinsp_filter_check_event::extract_abspath(sinsp_evt* evt, uint32_t* len
758758
return 0;
759759
}
760760

761-
int64_t dirfd = evt->get_param(dirfdargidx)->as<int64_t>();
761+
// Make sure that the parameters are not empty.
762+
const auto dirfd_param = evt->get_param(dirfdargidx);
763+
const auto path_param = evt->get_param(pathargidx);
764+
if(dirfd_param->empty() || path_param->empty()) {
765+
return 0;
766+
}
762767

763-
std::string_view path = evt->get_param(pathargidx)->as<std::string_view>();
768+
const auto dirfd = dirfd_param->as<int64_t>();
769+
const auto path = path_param->as<std::string_view>();
764770

765771
string sdir;
766772

‎userspace/libsinsp/sinsp_filtercheck_fspath.cpp‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -162,10 +162,6 @@ void sinsp_filter_check_fspath::create_fspath_checks() {
162162
m_path_checks->emplace(PPME_SYSCALL_RMDIR_2_X, evt_arg_path);
163163
m_success_checks->emplace(PPME_SYSCALL_RMDIR_2_X, evt_arg_res_eq_0);
164164

165-
m_success_checks->emplace(PPME_SYSCALL_UNLINK_X, evt_arg_res_eq_0);
166-
167-
m_success_checks->emplace(PPME_SYSCALL_UNLINKAT_X, evt_arg_res_eq_0);
168-
169165
m_path_checks->emplace(PPME_SYSCALL_UNLINK_2_X, evt_arg_path);
170166
m_success_checks->emplace(PPME_SYSCALL_UNLINK_2_X, evt_arg_res_eq_0);
171167

@@ -315,14 +311,6 @@ uint8_t* sinsp_filter_check_fspath::extract_single(sinsp_evt* evt,
315311

316312
// For some event types we need to get the values from the enter event instead.
317313
switch(evt->get_type()) {
318-
case PPME_SYSCALL_UNLINK_X:
319-
enter_param = evt->get_enter_evt_param("path");
320-
if(!enter_param.has_value()) {
321-
return NULL;
322-
}
323-
m_tstr = enter_param.value();
324-
break;
325-
case PPME_SYSCALL_UNLINKAT_X:
326314
case PPME_SYSCALL_OPENAT_X:
327315
enter_param = evt->get_enter_evt_param("name");
328316
if(!enter_param.has_value()) {

‎userspace/libsinsp/test/events_fspath.ut.cpp‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -311,18 +311,6 @@ TEST_F(fspath, rmdir_2) {
311311
test_failed_exit(PPME_SYSCALL_RMDIR_2_X, 2, failed_res, path);
312312
}
313313

314-
TEST_F(fspath, unlink) {
315-
test_enter(PPME_SYSCALL_UNLINK_E, 1, path);
316-
test_exit_path(path, path, PPME_SYSCALL_UNLINK_X, 1, res);
317-
test_failed_exit(PPME_SYSCALL_UNLINK_X, 1, failed_res);
318-
}
319-
320-
TEST_F(fspath, unlinkat) {
321-
test_enter(PPME_SYSCALL_UNLINKAT_E, 2, evt_dirfd, name);
322-
test_exit_path(resolved_name, name, PPME_SYSCALL_UNLINKAT_X, 1, res);
323-
test_failed_exit(PPME_SYSCALL_UNLINKAT_X, 1, failed_res);
324-
}
325-
326314
TEST_F(fspath, unlink_2) {
327315
test_enter(PPME_SYSCALL_UNLINK_2_E, 0);
328316
test_exit_path(path, path, PPME_SYSCALL_UNLINK_2_X, 2, res, path);

0 commit comments

Comments
 (0)