Skip to content

feat(libscap/libsinsp): fcntl scap conversion #2533

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
poiana merged 1 commit into from
Jul 9, 2025
Merged

feat(libscap/libsinsp): fcntl scap conversion #2533

poiana merged 1 commit into from
Jul 9, 2025

Conversation

@terror96
Copy link
Contributor

@terror96 terror96 commented Jul 9, 2025 •
edited by ekoops
Loading

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This PR adds new scap file conversion rules handling old PPME_SYSCALL_FCNTL_X layouts. Specifically, this instructs the scap converter to add the missing parameters by taking them from the corresponding enter event: this allowed to remove the user space logic storing the enter event and retrieving it on the exit side.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

@terror96
feat(libscap/libsinsp): fcntl scap conversion
b8d3c9a 
This update adds scap event conversion for the fcntl syscall exit
events and it eliminates the need to store the entry event in
libsinsp.

Signed-off-by: Tero Kauppinen <[email protected]>
@poiana poiana requested review from hbrueckner and leogr July 9, 2025 09:43
@poiana poiana added the size/L label Jul 9, 2025
@github-actions
Copy link

github-actions bot commented Jul 9, 2025

Please double check driver/SCHEMA_VERSION file. See versioning.

/hold

@ekoops
Copy link
Contributor

ekoops commented Jul 9, 2025

/milestone 0.22.0

@poiana poiana added this to the 0.22.0 milestone Jul 9, 2025
@codecov
Copy link

codecov bot commented Jul 9, 2025 •
edited
Loading

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 78.42%. Comparing base (2a5b4c7) to head (b8d3c9a).
Report is 2 commits behind head on master.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master    #2533   +/-   ##
=======================================
  Coverage   78.42%   78.42%           
=======================================
  Files         292      292           
  Lines       31999    32001    +2     
  Branches     4652     4653    +1     
=======================================
+ Hits        25094    25096    +2     
  Misses       6905     6905
Flag Coverage Δ
libsinsp 78.42% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ekoops
Copy link
Contributor

ekoops commented Jul 9, 2025

/unhold -> false positive

@ekoops
Copy link
Contributor

ekoops commented Jul 9, 2025

/hold cancel

ekoops
ekoops approved these changes Jul 9, 2025
View reviewed changes
Copy link
Contributor

@ekoops ekoops left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Jul 9, 2025
@poiana
Copy link
Contributor

poiana commented Jul 9, 2025

LGTM label has been added.

DetailsGit tree hash: 90c2cc435f511ec3eb28dd50658f20dfeeb8e78e

@poiana
Copy link
Contributor

poiana commented Jul 9, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, terror96

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana added the approved label Jul 9, 2025
@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Jul 9, 2025
@poiana poiana merged commit 94b4718 into falcosecurity:master Jul 9, 2025
55 of 58 checks passed
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Jul 9, 2025
@terror96 terror96 deleted the cleanup-libsinsp-fcntl-event-handling branch July 10, 2025 06:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leogr leogr leogr approved these changes

@ekoops ekoops ekoops approved these changes

@hbrueckner hbrueckner Awaiting requested review from hbrueckner

Assignees

@leogr leogr

@ekoops ekoops

Labels

approved area/libscap area/libsinsp area/tests dco-signoff: yes kind/feature New feature or request lgtm release-note-none size/L

Projects

Falco Roadmap
Archived in project

Milestone

0.22.0

Development

Successfully merging this pull request may close these issues.

4 participants

@terror96 @ekoops @poiana @leogr