feat!: drop setgid enter evts gen, testing and parsing code

As the `setgid` exit events contain all the information needed, drop
`setgid` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `setgid` enter evts gen and parsing

Signed-off-by: Leonardo Di Giovanna <[email protected]>

Author: ekoops

driver/fillers_table.c

@@ -199,7 +199,7 @@ const struct ppm_event_entry g_ppm_events[PPM_EVENT_MAX] = {
         [PPME_SCAPEVENT_E] = {FILLER_REF(sys_scapevent_e)},
         [PPME_SYSCALL_SETUID_E] = {FILLER_DISABLED},
         [PPME_SYSCALL_SETUID_X] = {FILLER_REF(sys_setuid_x)},
-        [PPME_SYSCALL_SETGID_E] = {FILLER_REF(sys_autofill), 1, APT_REG, {{0}}},
+        [PPME_SYSCALL_SETGID_E] = {FILLER_DISABLED},
         [PPME_SYSCALL_SETGID_X] = {FILLER_REF(sys_setgid_x)},
         [PPME_SYSCALL_GETUID_E] = {FILLER_DISABLED},
         [PPME_SYSCALL_GETUID_X] = {FILLER_REF(sys_autofill), 1, APT_REG, {{AF_ID_RETVAL}}},

driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setgid.bpf.c

@@ -8,32 +8,6 @@
 
 #include <helpers/interfaces/fixed_size_event.h>
 
-/*=============================== ENTER EVENT ===========================*/
-
-SEC("tp_btf/sys_enter")
-int BPF_PROG(setgid_e, struct pt_regs *regs, long id) {
-	struct ringbuf_struct ringbuf;
-	if(!ringbuf__reserve_space(&ringbuf, SETGID_E_SIZE, PPME_SYSCALL_SETGID_E)) {
-		return 0;
-	}
-
-	ringbuf__store_event_header(&ringbuf);
-
-	/*=============================== COLLECT PARAMETERS  ===========================*/
-
-	/* Parameter 1: gid (type: PT_GID) */
-	uint32_t gid = (uint32_t)extract__syscall_argument(regs, 0);
-	ringbuf__store_u32(&ringbuf, gid);
-
-	/*=============================== COLLECT PARAMETERS  ===========================*/
-
-	ringbuf__submit_event(&ringbuf);
-
-	return 0;
-}
-
-/*=============================== ENTER EVENT ===========================*/
-
 /*=============================== EXIT EVENT ===========================*/
 
 SEC("tp_btf/sys_exit")

test/drivers/test_suites/syscall_enter_suite/setgid_e.cpp

@@ -927,11 +927,6 @@ TEST_F(sys_call_test, getsetuid_and_gid) {
 			++callnum;
 			EXPECT_EQ("0", e->get_param_value_str("res", false));
 			break;
-		case PPME_SYSCALL_SETGID_E:
-			++callnum;
-			EXPECT_EQ("6566", e->get_param_value_str("gid", false));
-			EXPECT_EQ("<NA>", e->get_param_value_str("gid"));
-			break;
 		case PPME_SYSCALL_SETGID_X:
 			++callnum;
 			EXPECT_EQ("0", e->get_param_value_str("res", false));
@@ -975,7 +970,7 @@ TEST_F(sys_call_test, getsetuid_and_gid) {
 		FAIL() << "Cannot restore initial id state.";
 	}
 
-	EXPECT_EQ(7, callnum);
+	EXPECT_EQ(6, callnum);
 }
 
 #ifdef __x86_64__

test/libsinsp_e2e/sys_call_test.cpp

@@ -165,7 +165,7 @@ event_prog_t event_prog_table[PPM_EVENT_MAX][MAX_FEATURE_CHECKS] = {
         [PPME_SYSCALL_UNLINK_2_X] = {{false, "unlink_x", 0}},
         [PPME_SYSCALL_UNLINKAT_2_E] = {{true, NULL}},
         [PPME_SYSCALL_UNLINKAT_2_X] = {{false, "unlinkat_x", 0}},
-        [PPME_SYSCALL_SETGID_E] = {{false, "setgid_e", 0}},
+        [PPME_SYSCALL_SETGID_E] = {{true, NULL}},
         [PPME_SYSCALL_SETGID_X] = {{false, "setgid_x", 0}},
         [PPME_SYSCALL_SETUID_E] = {{true, NULL}},
         [PPME_SYSCALL_SETUID_X] = {{false, "setuid_x", 0}},

userspace/libpman/src/events_prog_table.c

@@ -874,15 +874,6 @@ int32_t fill_event_setuid_x(scap_sized_buffer scap_buf,
 	                                uid);
 }
 
-// PPME_SYSCALL_SETGID_E
-// Event field validity issues: none
-int32_t fill_event_setgid_e(scap_sized_buffer scap_buf,
-                            size_t* event_size,
-                            char* scap_err,
-                            uint32_t gid) {
-	return scap_event_encode_params(scap_buf, event_size, scap_err, PPME_SYSCALL_SETGID_E, 1, gid);
-}
-
 // PPME_SYSCALL_SETGID_X
 // Event field validity issues: none
 int32_t fill_event_setgid_x(scap_sized_buffer scap_buf,

userspace/libscap/engine/gvisor/fillers.cpp

@@ -291,11 +291,6 @@ int32_t fill_event_setuid_x(scap_sized_buffer scap_buf,
                             int64_t res,
                             uint32_t uid);
 
-int32_t fill_event_setgid_e(scap_sized_buffer scap_buf,
-                            size_t* event_size,
-                            char* scap_err,
-                            uint32_t gid);
-
 int32_t fill_event_setgid_x(scap_sized_buffer scap_buf,
                             size_t* event_size,
                             char* scap_err,

userspace/libscap/engine/gvisor/fillers.h

@@ -1302,13 +1302,6 @@ static parse_result parse_setid(uint32_t id,
 		}
 	} else {
 		switch(gvisor_evt.sysno()) {
-		case __NR_setgid:
-			ret.status = scap_gvisor::fillers::fill_event_setgid_e(scap_buf,
-			                                                       &ret.size,
-			                                                       scap_err,
-			                                                       gvisor_evt.id());
-			break;
-
 		case __NR_setsid:
 			ret.status = scap_gvisor::fillers::fill_event_setsid_e(scap_buf, &ret.size, scap_err);
 			break;

userspace/libscap/engine/gvisor/parsers.cpp

@@ -33,11 +33,6 @@ TEST_F(sinsp_with_test_input, setuid_setgid) {
 	evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_SETUID_X, 2, errno_success, 500);
 	ASSERT_EQ(get_field_as_string(evt, "user.uid"), "500");
 
-	// set a new group ID
-	evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_SETGID_E, 1, 600);
-	// check that upon entry we have the default group ID
-	ASSERT_EQ(get_field_as_string(evt, "group.gid"), "0");
-
 	// check that the group ID is updated if the call is successful
 	evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_SETGID_X, 2, errno_success, 600);
 	ASSERT_EQ(get_field_as_string(evt, "group.gid"), "600");
@@ -47,7 +42,6 @@ TEST_F(sinsp_with_test_input, setuid_setgid) {
 	ASSERT_EQ(get_field_as_string(evt, "user.uid"), "500");
 
 	// same for group ID
-	add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_SETGID_E, 1, 0);
 	evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_SETGID_X, 2, errno_failure, 0);
 	ASSERT_EQ(get_field_as_string(evt, "group.gid"), "600");
 }