Skip to content

Commit da77c77

Browse files
ekoopspoiana
ekoops
authored and
poiana
committed
feat: add PPME_SYSCALL_FLOCK_E params to PPME_SYSCALL_FLOCK_X
Add `PPME_SYSCALL_FLOCK_E` parameters to `PPME_SYSCALL_FLOCK_X` event definition and aligns all 3 kernel drivers to it. Add new rules to scap file converter table to convert events in old scap files to the new layout. Add/update flock-related drivers, scap converter and sinsp parser tests to account the new layout. Signed-off-by: Leonardo Di Giovanna <[email protected]>
1 parent 2c18282 commit da77c77

File tree

15 files changed

+188
-20
lines changed

15 files changed

+188
-20
lines changed

‎driver/SCHEMA_VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
3.37.0
1+
3.38.0

‎driver/bpf/fillers.h‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3239,7 +3239,7 @@ FILLER(sys_fchdir_e, true) {
32393239
}
32403240

32413241
FILLER(sys_fchdir_x, true) {
3242-
/* Parameter 1: res (type: PT_ERRNO)*/
3242+
/* Parameter 1: res (type: PT_ERRNO) */
32433243
long retval = bpf_syscall_get_retval(data->ctx);
32443244
int res = bpf_push_s64_to_ring(data, retval);
32453245
CHECK_RES(res);
@@ -5534,15 +5534,31 @@ FILLER(sys_socket_x, true) {
55345534

55355535
FILLER(sys_flock_e, true) {
55365536
/* Parameter 1: fd (type: PT_FD) */
5537-
int32_t fd = (int32_t)bpf_syscall_get_argument(data, 0);
5538-
int res = bpf_push_s64_to_ring(data, (int64_t)fd);
5537+
int64_t fd = (int64_t)(int32_t)bpf_syscall_get_argument(data, 0);
5538+
int res = bpf_push_s64_to_ring(data, fd);
55395539
CHECK_RES(res);
55405540

55415541
/* Parameter 2: operation (type: PT_FLAGS32) */
55425542
int operation = bpf_syscall_get_argument(data, 1);
55435543
return bpf_push_u32_to_ring(data, flock_flags_to_scap(operation));
55445544
}
55455545

5546+
FILLER(sys_flock_x, true) {
5547+
/* Parameter 1: res (type: PT_ERRNO) */
5548+
long retval = bpf_syscall_get_retval(data->ctx);
5549+
int res = bpf_push_s64_to_ring(data, retval);
5550+
CHECK_RES(res);
5551+
5552+
/* Parameter 2: fd (type: PT_FD) */
5553+
int64_t fd = (int64_t)(int32_t)bpf_syscall_get_argument(data, 0);
5554+
res = bpf_push_s64_to_ring(data, fd);
5555+
CHECK_RES(res);
5556+
5557+
/* Parameter 3: operation (type: PT_FLAGS32) */
5558+
int operation = bpf_syscall_get_argument(data, 1);
5559+
return bpf_push_u32_to_ring(data, flock_flags_to_scap(operation));
5560+
}
5561+
55465562
FILLER(sys_ioctl_e, true) {
55475563
/* Parameter 1: fd (type: PT_FD) */
55485564
int32_t fd = (int32_t)bpf_syscall_get_argument(data, 0);

‎driver/event_table.c‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1544,12 +1544,17 @@ const struct ppm_event_info g_event_info[] = {
15441544
{"nstype", PT_FLAGS32, PF_HEX, clone_flags}}},
15451545
[PPME_SYSCALL_FLOCK_E] = {"flock",
15461546
EC_FILE | EC_SYSCALL,
1547-
EF_USES_FD,
1547+
EF_USES_FD | EF_TMP_CONVERTER_MANAGED,
15481548
2,
15491549
{{"fd", PT_FD, PF_NA},
15501550
{"operation", PT_FLAGS32, PF_HEX, flock_flags}}},
1551-
[PPME_SYSCALL_FLOCK_X] =
1552-
{"flock", EC_FILE | EC_SYSCALL, EF_USES_FD, 1, {{"res", PT_ERRNO, PF_DEC}}},
1551+
[PPME_SYSCALL_FLOCK_X] = {"flock",
1552+
EC_FILE | EC_SYSCALL,
1553+
EF_USES_FD | EF_TMP_CONVERTER_MANAGED,
1554+
3,
1555+
{{"res", PT_ERRNO, PF_DEC},
1556+
{"fd", PT_FD, PF_NA},
1557+
{"operation", PT_FLAGS32, PF_HEX, flock_flags}}},
15531558
[PPME_CPU_HOTPLUG_E] = {"cpu_hotplug",
15541559
EC_SYSTEM | EC_METAEVENT,
15551560
EF_SKIPPARSERESET | EF_MODIFIES_STATE,

‎driver/fillers_table.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -229,7 +229,7 @@ const struct ppm_event_entry g_ppm_events[PPM_EVENT_MAX] = {
229229
[PPME_SYSCALL_SETNS_E] = {FILLER_REF(sys_setns_e)},
230230
[PPME_SYSCALL_SETNS_X] = {FILLER_REF(sys_setns_x)},
231231
[PPME_SYSCALL_FLOCK_E] = {FILLER_REF(sys_flock_e)},
232-
[PPME_SYSCALL_FLOCK_X] = {FILLER_REF(sys_autofill), 1, APT_REG, {{AF_ID_RETVAL}}},
232+
[PPME_SYSCALL_FLOCK_X] = {FILLER_REF(sys_flock_x)},
233233
[PPME_CPU_HOTPLUG_E] = {FILLER_REF(cpu_hotplug_e)},
234234
[PPME_SOCKET_ACCEPT_5_E] = {FILLER_REF(sys_empty)},
235235
[PPME_SOCKET_ACCEPT_5_X] = {FILLER_REF(sys_accept_x)},

‎driver/modern_bpf/definitions/events_dimensions.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@
160160
#define SETNS_E_SIZE HEADER_LEN + sizeof(int64_t) + sizeof(uint32_t) + PARAM_LEN * 2
161161
#define SETNS_X_SIZE HEADER_LEN + sizeof(int64_t) * 2 + sizeof(uint32_t) + PARAM_LEN * 3
162162
#define FLOCK_E_SIZE HEADER_LEN + sizeof(int64_t) + sizeof(uint32_t) + PARAM_LEN * 2
163-
#define FLOCK_X_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN
163+
#define FLOCK_X_SIZE HEADER_LEN + sizeof(int64_t) * 2 + sizeof(uint32_t) + PARAM_LEN * 3
164164
#define CPU_HOTPLUG_E_SIZE HEADER_LEN + sizeof(uint32_t) * 2 + PARAM_LEN * 2
165165
#define ACCEPT_E_SIZE HEADER_LEN
166166
#define SEMOP_E_SIZE HEADER_LEN + sizeof(int32_t) + PARAM_LEN

‎driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/flock.bpf.c‎

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ int BPF_PROG(flock_e, struct pt_regs *regs, long id) {
2222
/*=============================== COLLECT PARAMETERS ===========================*/
2323

2424
/* Parameter 1: fd (type: PT_FD) */
25-
int32_t fd = (int32_t)extract__syscall_argument(regs, 0);
26-
ringbuf__store_s64(&ringbuf, (int64_t)fd);
25+
int64_t fd = (int64_t)(int32_t)extract__syscall_argument(regs, 0);
26+
ringbuf__store_s64(&ringbuf, fd);
2727

2828
/* Parameter 2: operation (type: PT_FLAGS32) */
2929
unsigned long operation = extract__syscall_argument(regs, 1);
@@ -51,9 +51,17 @@ int BPF_PROG(flock_x, struct pt_regs *regs, long ret) {
5151

5252
/*=============================== COLLECT PARAMETERS ===========================*/
5353

54-
/* Parameter 1: res (type: PT_ERRNO)*/
54+
/* Parameter 1: res (type: PT_ERRNO) */
5555
ringbuf__store_s64(&ringbuf, ret);
5656

57+
/* Parameter 2: fd (type: PT_FD) */
58+
int64_t fd = (int64_t)(int32_t)extract__syscall_argument(regs, 0);
59+
ringbuf__store_s64(&ringbuf, fd);
60+
61+
/* Parameter 3: operation (type: PT_FLAGS32) */
62+
unsigned long operation = extract__syscall_argument(regs, 1);
63+
ringbuf__store_u32(&ringbuf, flock_flags_to_scap((int)operation));
64+
5765
/*=============================== COLLECT PARAMETERS ===========================*/
5866

5967
ringbuf__submit_event(&ringbuf);

‎driver/ppm_fillers.c‎

Lines changed: 33 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -7366,15 +7366,15 @@ int f_sys_getresuid_and_gid_x(struct event_filler_arguments *args) {
73667366
}
73677367

73687368
int f_sys_flock_e(struct event_filler_arguments *args) {
7369-
unsigned long val = 0;
7370-
int res = 0;
7371-
uint32_t flags = 0;
7372-
int32_t fd = 0;
7369+
unsigned long val;
7370+
int64_t fd;
7371+
int res;
7372+
uint32_t flags;
73737373

73747374
/* Parameter 1: fd (type: PT_FD) */
73757375
syscall_get_arguments_deprecated(args, 0, 1, &val);
7376-
fd = (int32_t)val;
7377-
res = val_to_ring(args, (int64_t)fd, 0, false, 0);
7376+
fd = (int64_t)(int32_t)val;
7377+
res = val_to_ring(args, fd, 0, false, 0);
73787378
CHECK_RES(res);
73797379

73807380
/* Parameter 2: operation (type: PT_FLAGS32) */
@@ -7386,6 +7386,33 @@ int f_sys_flock_e(struct event_filler_arguments *args) {
73867386
return add_sentinel(args);
73877387
}
73887388

7389+
int f_sys_flock_x(struct event_filler_arguments *args) {
7390+
int64_t retval;
7391+
int res;
7392+
unsigned long val;
7393+
int64_t fd;
7394+
uint32_t flags;
7395+
7396+
/* Parameter 1: res (type: PT_ERRNO) */
7397+
retval = (int64_t)syscall_get_return_value(current, args->regs);
7398+
res = val_to_ring(args, retval, 0, false, 0);
7399+
CHECK_RES(res);
7400+
7401+
/* Parameter 2: fd (type: PT_FD) */
7402+
syscall_get_arguments_deprecated(args, 0, 1, &val);
7403+
fd = (int64_t)(int32_t)val;
7404+
res = val_to_ring(args, fd, 0, false, 0);
7405+
CHECK_RES(res);
7406+
7407+
/* Parameter 3: operation (type: PT_FLAGS32) */
7408+
syscall_get_arguments_deprecated(args, 1, 1, &val);
7409+
flags = flock_flags_to_scap((int)val);
7410+
res = val_to_ring(args, flags, 0, false, 0);
7411+
CHECK_RES(res);
7412+
7413+
return add_sentinel(args);
7414+
}
7415+
73897416
int f_sys_ioctl_e(struct event_filler_arguments *args) {
73907417
unsigned long val = 0;
73917418
int res = 0;

‎driver/ppm_fillers.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,6 +111,7 @@ or GPL2.txt for full copies of the license.
111111
FN(sys_setns_x) \
112112
FN(sys_unshare_e) \
113113
FN(sys_flock_e) \
114+
FN(sys_flock_x) \
114115
FN(cpu_hotplug_e) \
115116
FN(sys_semop_x) \
116117
FN(sys_semget_e) \

‎test/drivers/test_suites/syscall_exit_suite/flock_x.cpp‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,14 @@ TEST(SyscallExit, flockX) {
3232
/* Parameter 1: res (type: PT_ERRNO) */
3333
evt_test->assert_numeric_param(1, (int64_t)errno_value);
3434

35+
/* Parameter 2: fd (type: PT_FD) */
36+
evt_test->assert_numeric_param(2, (int64_t)mock_fd);
37+
38+
/* Parameter 3: operation (type: PT_FLAGS32) */
39+
evt_test->assert_numeric_param(3, (uint32_t)PPM_LOCK_EX);
40+
3541
/*=============================== ASSERT PARAMETERS ===========================*/
3642

37-
evt_test->assert_num_params_pushed(1);
43+
evt_test->assert_num_params_pushed(3);
3844
}
3945
#endif

‎test/libscap/test_suites/engines/savefile/converter.cpp‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2638,6 +2638,57 @@ TEST_F(convert_event_test, PPME_SYSCALL_SETNS_1_X_to_3_params_with_enter) {
26382638
create_safe_scap_event(ts, tid, PPME_SYSCALL_SETNS_X, 3, res, fd, flags));
26392639
}
26402640

2641+
////////////////////////////
2642+
// FLOCK
2643+
////////////////////////////
2644+
2645+
TEST_F(convert_event_test, PPME_SYSCALL_FLOCK_E_store) {
2646+
constexpr uint64_t ts = 12;
2647+
constexpr int64_t tid = 25;
2648+
2649+
constexpr int64_t fd = 25;
2650+
constexpr uint32_t operation = 50;
2651+
2652+
const auto evt = create_safe_scap_event(ts, tid, PPME_SYSCALL_FLOCK_E, 2, fd, operation);
2653+
assert_single_conversion_skip(evt);
2654+
assert_event_storage_presence(evt);
2655+
}
2656+
2657+
TEST_F(convert_event_test, PPME_SYSCALL_FLOCK_1_X_to_3_params_no_enter) {
2658+
constexpr uint64_t ts = 12;
2659+
constexpr int64_t tid = 25;
2660+
2661+
constexpr int64_t res = 89;
2662+
2663+
// Defaulted to 0
2664+
constexpr int64_t fd = 0;
2665+
constexpr uint32_t operation = 0;
2666+
2667+
assert_single_conversion_success(
2668+
conversion_result::CONVERSION_COMPLETED,
2669+
create_safe_scap_event(ts, tid, PPME_SYSCALL_FLOCK_X, 1, res),
2670+
create_safe_scap_event(ts, tid, PPME_SYSCALL_FLOCK_X, 3, res, fd, operation));
2671+
}
2672+
2673+
TEST_F(convert_event_test, PPME_SYSCALL_FLOCK_1_X_to_3_params_with_enter) {
2674+
constexpr uint64_t ts = 12;
2675+
constexpr int64_t tid = 25;
2676+
2677+
constexpr int64_t res = 89;
2678+
constexpr int64_t fd = 25;
2679+
constexpr uint32_t operation = 50;
2680+
2681+
// After the first conversion we should have the storage
2682+
const auto evt = create_safe_scap_event(ts, tid, PPME_SYSCALL_FLOCK_E, 2, fd, operation);
2683+
assert_single_conversion_skip(evt);
2684+
assert_event_storage_presence(evt);
2685+
2686+
assert_single_conversion_success(
2687+
conversion_result::CONVERSION_COMPLETED,
2688+
create_safe_scap_event(ts, tid, PPME_SYSCALL_FLOCK_X, 1, res),
2689+
create_safe_scap_event(ts, tid, PPME_SYSCALL_FLOCK_X, 3, res, fd, operation));
2690+
}
2691+
26412692
////////////////////////////
26422693
// FCHDIR
26432694
////////////////////////////

0 commit comments

Comments
 (0)