[Tracking] Extend syscall exit events with syscall enter events parameters

[ekoops]

This is a tracking issue for all tasks related to extending the syscall exit events with the parameter coming from the corresponding syscall enter events. The consensus on this work has been reached with the approval of the proposal in #2068.

The following list is organized by syscall. If a contributor wants to work on a specific system call, should express the will here, in order to coordinate the work with other contributors.

---

• syscall - nothing to do (generic syscall)
• open - nothing to do
• close - feat!: add PPME_SYSCALL_CLOSE_E fd param to PPME_SYSCALL_CLOSE_X #2475
• read - new(driver): update exit events PPME_SYSCALL_READ_X and PPME_SYSCALL_PREAD_X with enter params #2176
• write - new(driver): update exit events PPME_SYSCALL_WRITE_X and PPME_SYSCALL_PWRITE_X with enter params #2187
• brk - feat: add PPME_SYSCALL_BRK_4_E params to PPME_SYSCALL_BRK_4_X #2473
• execve - nothing to do (see comment)
• clone - nothing to do
• procexit - nothing to do (tracepoint event)
• socket - new(driver): update exit events PPME_SOCKET_SOCKET_X with enter params #2206
• bind - new(driver): update exit events PPME_SOCKET_BIND_X with enter params #2205
• connect - feat: add PPME_SYSCALL_CONNECT_E params to PPME_SYSCALL_CONNECT_X #2529
• listen - new: extend LISTEN_X #2208
• accept - new: make ACCEPT_{E,X} and ACCEPT_5_E converter-managed #2211
• send - new: extend SEND_X and SENDTO_X with enter events parameters #2221
• sendto - new: extend SEND_X and SENDTO_X with enter events parameters #2221
• recv - feat: add RECV_E and tuple params and to RECV_X #2419
• recvfrom - feat: add RECVFROM_E params to RECVFROM_X #2422
• shutdown - feat: add PPME_SOCKET_SHUTDOWN_E params to PPME_SOCKET_SHUTDOWN_X #2426
• getsockname - nothing to do
• getpeername - nothing to do
• socketpair - feat: add SOCKETPAIR_E params to SOCKETPAIR_X #2430
• setsockopt - nothing to do
• getsockopt - nothing to do
• sendmsg - feat: add PPME_SOCKET_SENDMSG_E params to PPME_SOCKET_SENDMSG_X #2436
• sendmmsg - nothing to do
• recvmsg - feat: add PPME_SOCKET_RECVMSG_E params to PPME_SOCKET_RECVMSG_X #2443
• recvmmsg - nothing to do
• creat - nothing to do
• pipe - nothing to do
• eventfd - feat: add PPME_SYSCALL_EVENTFD_E params to PPME_SYSCALL_EVENTFD_X #2445
• futex - feat: add PPME_SYSCALL_FUTEX_E params to PPME_SYSCALL_FUTEX_X #2449
• stat - nothing to do
• lstat - nothing to do
• fstat - feat: add PPME_SYSCALL_FSTAT_E params to PPME_SYSCALL_FSTAT_X #2466
• stat64 - nothing to do
• lstat64 - nothing to do
• fstat64 - nothing to do (see comment)
• epoll_wait - feat: add EPOLLWAIT_E params to EPOLLWAIT_X #2454
• poll - feat: add PPME_SYSCALL_POLL_E params to PPME_SYSCALL_POLL_X #2455
• select - nothing to do
• lseek - feat: add PPME_SYSCALL_LSEEK_E params to PPME_SYSCALL_LSEEK_X #2522
• llseek - feat: add PPME_SYSCALL_LLSEEK_E params to PPME_SYSCALL_LLSEEK_X #2461
• ioctl - feat: add PPME_SYSCALL_IOCTL_3_E params to PPME_SYSCALL_IOCTL_3_X #2464
• getcwd - nothing to do
• chdir - refactor(userspace/libsinsp/parsers): clean chdir handling logic #2444
• fchdir - new(driver): update exit events PPME_SYSCALL_FCHDIR_X with enter params #2453
• mkdir - new(driver): update exit events PPME_SYSCALL_MKDIR_2_X with enter params #2446
• rmdir - nothing to do
• openat - nothing to do
• link - nothing to do
• linkat - nothing to do
• unlink - nothing to do
• unlinkat - nothing to do
• pread - new(driver): update exit events PPME_SYSCALL_READ_X and PPME_SYSCALL_PREAD_X with enter params #2176
• pwrite - new(driver): update exit events PPME_SYSCALL_WRITE_X and PPME_SYSCALL_PWRITE_X with enter params #2187
• readv - feat: extend PPME_SYSCALL_{P}READV_X with enter parameters #2519
• writev - feat: add PPME_SYSCALL_WRITEV_E params to PPME_SYSCALL_WRITEV_X #2523
• preadv - feat: extend PPME_SYSCALL_{P}READV_X with enter parameters #2519
• pwritev - feat: add PPME_SYSCALL_PWRITEV_E params to PPME_SYSCALL_PWRITEV_X #2524
• dup - nothing to do (see comment)
• signalfd - feat: extend PPME_SYSCALL_SIGNALFD_X with enter parameters #2510
• kill - feat: extend PPME_SYSCALL_{KILL,TKILL,TGKILL}_X with enter params #2507
• tkill - feat: extend PPME_SYSCALL_{KILL,TKILL,TGKILL}_X with enter params #2507
• tgkill - feat: extend PPME_SYSCALL_{KILL,TKILL,TGKILL}_X with enter params #2507
• nanosleep - feat: extend PPME_SYSCALL_NANOSLEEP_X with enter parameters #2512
• timerfd_create - feat: extend PPME_SYSCALL_TIMERFD_CREATE_X with enter parameters #2513
• inotify_init - feat: extend PPME_SYSCALL_INOTIFY_INIT_X with enter parameters #2514
• getrlimit - feat: add GETRLIMIT_E params to GETRLIMIT_X and align setrlimit_x #2476
• setrlimit - feat: add GETRLIMIT_E params to GETRLIMIT_X and align setrlimit_x #2476
• prlimit - nothing to do
• switch - nothing to do (tracepoint event)
• drop - nothing to do (internal meta event)
• fcntl - nothing to do
• mmap - feat: add PPME_SYSCALL_MMAP_E params to PPME_SYSCALL_MMAP_X #2484
• mmap2 - feat: add PPME_SYSCALL_MMAP2_E params to PPME_SYSCALL_MMAP2_X #2485
• munmap - feat: add PPME_SYSCALL_MUNMAP_E params to PPME_SYSCALL_MUNMAP_X #2486
• splice - feat: add PPME_SYSCALL_SPLICE_E params to PPME_SYSCALL_SPLICE_X #2516
• ptrace - new(driver): update exit events PPME_SYSCALL_PTRACE_X with enter params #2417
• rename - nothing to do
• renameat - nothing to do
• symlink - nothing to do
• symlinkat - nothing to do
• fork - nothing to do
• vfork - nothing to do
• sendfile - feat: extend PPME_SYSCALL_SENDFILE_X with enter parameters #2505
• quotactl - feat: extend PPME_SYSCALL_QUOTACTL_X with enter parameters #2506
• setresuid - new(driver): update exit events PPME_SYSCALL_SETRESUID_X with enter params #2482
• setresgid - new(driver): update exit events PPME_SYSCALL_SETRESGID_X with enter params #2474
• scapevent - nothing to do (internal meta event)
• setuid - new(driver): update exit events PPME_SYSCALL_SETUID_X with enter params #2414
• setgid - new(driver): update exit events PPME_SYSCALL_SETGID_X with enter params #2469
• getuid - nothing to do
• geteuid - nothing to do
• getgid - nothing to do
• getegid - nothing to do
• getresuid - nothing to do
• getresgid - nothing to do
• container - nothing to do (internal meta event)
• signaldeliver - nothing to do (tracepoint event)
• procinfo - nothing to do (internal meta event)
• getdents - feat: extend PPME_SYSCALL_GETDENTS{64}_X defs with enter params #2487
• getdents64 - feat: extend PPME_SYSCALL_GETDENTS{64}_X defs with enter params #2487
• setns - new(driver): update exit events PPME_SYSCALL_SETNS_X with enter params #2456
• flock - feat: add PPME_SYSCALL_FLOCK_E params to PPME_SYSCALL_FLOCK_X #2488
• cpu_hotplug - nothing to do
• semop - feat: add PPME_SYSCALL_SEMOP_E params to PPME_SYSCALL_SEMOP_X #2489
• semctl - feat: extend SEMCTL_X and SEMGET_X with enter parameters #2490
• ppoll - feat: add PPME_SYSCALL_PPOLL_E params to PPME_SYSCALL_PPOLL_X #2491
• mount - feat: add PPME_SYSCALL_MOUNT_E params to PPME_SYSCALL_MOUNT_X #2492
• umount - nothing to do
• k8s - nothing to do (internal meta event)
• semget - feat: extend SEMCTL_X and SEMGET_X with enter parameters #2490
• access - feat: add PPME_SYSCALL_ACCESS_E params to PPME_SYSCALL_ACCESS_X #2493
• chroot - nothing to do
• tracer - nothing to do
• mesos - nothing to do (internal meta event)
• setsid - nothing to do
• notification - nothing to do (internal meta event)
• unshare - feat: add PPME_SYSCALL_UNSHARE_E params to PPME_SYSCALL_UNSHARE_X #2494
• infra - nothing to do (internal meta event)
• page_fault - nothing to do (tracepoint event)
• setpgid - new(driver): update exit events PPME_SYSCALL_SETPGID_X with enter params #2460
• bpf - nothing to do
• seccomp - feat: add PPME_SYSCALL_SECCOMP_E params to PPME_SYSCALL_SECCOMP_X #2495
• mkdirat - nothing to do
• fchmodat - nothing to do
• chmod - nothing to do
• fchmod - nothing to do
• renameat2 - nothing to do
• userfaultfd - nothing to do
• pluginevent - nothing to do (plugin event)
• openat2 - nothing to do
• mprotect - feat: extend PPME_SYSCALL_MPROTECT_X with enter parameters #2496
• execveat - nothing to do (see comment)
• copy_file_range - feat: extend PPME_SYSCALL_COPY_FILE_RANGE_X with enter parameters #2517
• clone3 - nothing to do
• open_by_handle_at - nothing to do
• io_uring_setup - nothing to do
• io_uring_enter - nothing to do
• io_uring_register - nothing to do
• mlock - nothing to do
• munlock - nothing to do
• mlockall - nothing to do
• munlockall - nothing to do
• capset - nothing to do
• useradded - nothing to do
• userdeleted - nothing to do
• groupadded - nothing to do
• groupdeleted - nothing to do
• dup2 - nothing to do (see comment)
• dup3 - nothing to do (see comment)
• mlock2 - nothing to do
• fsconfig - nothing to do
• epoll_create - feat: extend PPME_SYSCALL_EPOLL_CREATE{1}_X with enter parameters #2498
• epoll_create1 - feat: extend PPME_SYSCALL_EPOLL_CREATE{1}_X with enter parameters #2498
• chown - nothing to do
• lchown - nothing to do
• fchown - nothing to do
• fchownat - nothing to do
• accept4 - feat: extend PPME_SOCKET_ACCEPT4_6_X with enter parameters #2508
• umount2 - feat: add PPME_SYSCALL_UMOUNT2_E params to PPME_SYSCALL_UMOUNT2_X #2500
• pipe2 - nothing to do
• inotify_init1 - nothing to do
• eventfd2 - feat: extend PPME_SYSCALL_EVENTFD2_X with enter parameters #2501
• signalfd4 - feat: extend PPME_SYSCALL_SIGNALFD4_X with enter parameters #2503
• prctl - nothing to do
• asyncevent - nothing to do
• memfd_create - nothing to do
• pidfd_getfd - nothing to do
• pidfd_open - nothing to do
• init_module - nothing to do
• finit_module - nothing to do
• mknod - nothing to do
• mknodat - nothing to do
• newfstatat - nothing to do
• process_vm_readv - nothing to do
• process_vm_writev - nothing to do
• delete_module - nothing to do
• setreuid - nothing to do
• setregid - nothing to do

[FedeDP]

/milestone 0.22.0
Thanks for opening this issue @ekoops ! I agree we needed a single place to coordinate ;)

[terror96]

/milestone 0.22.0 Thanks for opening this issue @ekoops ! I agree we needed a single place to coordinate ;)

Thanks indeed for the initiative. While biking to work I was thinking that we would be needing something like this. What else would one do while biking than think about work? ;)

[terror96]

A follow-up question: there are also some syscalls where there is nothing to do such as DUP_1, DUP2, DUP3 because the exit event already contains oldfd and there are others where the entry event does not have parameters such as MUNLOCK. Do you think there would be any need to mark these call as okay in order to keep also track which events/syscalls need still work and which not?

[ekoops]

Yes we can definitely keep track of those syscall events on this issue. Also, I'll reorder the events in the list to match the declaration order in https://github.com/falcosecurity/libs/blob/master/driver/event_table.c . If you notice any event that doesn't need any extra work, please comment here and I'm gonna add it to the list.

[ekoops]

I assigned sendmsg to myself.

[ekoops]

I assigned recvmsg to myself.

[ekoops]

I assigned eventfd to myself.

[terror96]

Here are some additional findings:

For my eye, dup_1, dup2 and dup3 do not need work, because the "oldfd" is part of the exit event parameters. Or?

Chdir entry event does not have parameters, but libs/userspace/libsinsp/parsers.cpp::process_event() calls still store_event() for it. However, I guess no changes required?

link, linkat and rmdir (versions _2) have no entry event parameters, done?

unlink and unlink2 (versions _2) do not have entry parameters. No changes required?

I guess, events like procexit_1_x (where event_table.c says "NA") never happen?

[terror96]

I can take mkdir next, but I still want to get the 2nd PR merged before starting in order to get too much confused about merging conflicts...

[ekoops]

Hey @terror96 . The events you mentioned seem not to have any work directly related to exit events extension but still they may require the savefile's engine converter table to be updated in order to manage old event types and/or definitions (his is also the case for creat); however, I don't think that this is a priority for now, so we can consider delaying those work to the next iteration, and skip them for now.

Regarding chdir we still need to remove that call to store_event(), but no other change is required. I'm gonna assign it to myself and do in the next couple of days.

I'm assigning mkdir to you, and I'll help speed up the reviewing process for your ptrace work.