Skip to content

Conversation

@ekoops
Copy link
Contributor

@ekoops ekoops commented Jun 27, 2025

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This PR is part of #2427.

It:

  • adds PPME_SYSCALL_INOTIFY_INIT_E parameters to PPME_SYSCALL_INOTIFY_INIT_X event definition and aligns all 3 kernel drivers to it
  • adds new rules to scap file converter table to convert events in old scap files to the new layout
  • adds/updates inotify_init-related drivers, scap converter and sinsp parser tests to account the new layout.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

/milestone 0.22.0

Does this PR introduce a user-facing change?:

NONE

Add `PPME_SYSCALL_INOTIFY_INIT_E` parameters to
`PPME_SYSCALL_INOTIFY_INIT_X` event definition and align all 3 kernel
drivers to it.

Add new rules to scap file converter table to convert events in old
scap files to the new layout.

Add/update inotify_init-related drivers, scap converter and sinsp
parser tests to account the new layout.

Signed-off-by: Leonardo Di Giovanna <[email protected]>
@codecov
Copy link

codecov bot commented Jun 27, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 78.40%. Comparing base (04ca7f1) to head (af4063e).
Report is 1 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #2514      +/-   ##
==========================================
+ Coverage   78.39%   78.40%   +0.01%     
==========================================
  Files         284      285       +1     
  Lines       31740    31763      +23     
  Branches     4643     4643              
==========================================
+ Hits        24881    24904      +23     
  Misses       6859     6859              
Flag Coverage Δ
libsinsp 78.40% <100.00%> (+0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Jun 27, 2025

LGTM label has been added.

DetailsGit tree hash: c7c9b1561425fa9b136ac128e6d396be19c40e1d

@poiana
Copy link
Contributor

poiana commented Jun 27, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@github-actions
Copy link

github-actions bot commented Jun 27, 2025

X64 kernel testing matrix

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-4.19 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2-5.10 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2023-6.1 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.0 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.7 🟢 🟢 🟢 🟢 🟢 🟢
centos-3.10 🟢 🟢 🟢 🟡 🟡 🟡
centos-4.18 🟢 🟢 🟢 🟢 🟢 🟢
centos-5.14 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.17 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.8 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-3.10 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-4.14 🟢 🟢 🟢 🟢 🟢 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-5.4 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-4.15 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-5.8 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

ARM64 kernel testing matrix

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-4.14 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

@github-actions
Copy link

Perf diff from master - unit tests

   100.00%    -99.66%  [.] 0x0000000000077e90

Heap diff from master - unit tests

peak heap memory consumption: -26.90K
peak RSS (including heaptrack overhead): 0B
total memory leaked: -665.19K

Heap diff from master - scap file

peak heap memory consumption: -3.79K
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0165         -0.0164           149           147           149           147
BM_sinsp_split_median                                          -0.0210         -0.0209           150           147           150           147
BM_sinsp_split_stddev                                          +0.0508         +0.0512             2             2             2             2
BM_sinsp_split_cv                                              +0.0684         +0.0687             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  -0.0430         -0.0430            64            61            64            61
BM_sinsp_concatenate_paths_relative_path_median                -0.0402         -0.0401            64            61            64            61
BM_sinsp_concatenate_paths_relative_path_stddev                -0.8555         -0.8556             1             0             1             0
BM_sinsp_concatenate_paths_relative_path_cv                    -0.8490         -0.8491             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     +0.0205         +0.0206            24            25            24            25
BM_sinsp_concatenate_paths_empty_path_median                   +0.0199         +0.0200            24            25            24            25
BM_sinsp_concatenate_paths_empty_path_stddev                   +1.5617         +1.5730             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       +1.5101         +1.5209             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  +0.0372         +0.0373            61            63            61            63
BM_sinsp_concatenate_paths_absolute_path_median                +0.0482         +0.0483            61            64            61            64
BM_sinsp_concatenate_paths_absolute_path_stddev                +0.4785         +0.4788             1             1             1             1
BM_sinsp_concatenate_paths_absolute_path_cv                    +0.4254         +0.4256             0             0             0             0

@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Jun 27, 2025
@poiana poiana merged commit 269bf4f into master Jun 27, 2025
76 of 93 checks passed
@poiana poiana deleted the ekoops/convert-inotify-init branch June 27, 2025 11:27
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Jun 27, 2025
@leogr leogr modified the milestones: 0.22.0, 9.0.0+driver Oct 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

6 participants