Skip to content

Conversation

@terror96
Copy link
Contributor

There is no need to store the prlimit entry event, because all required parameters are available in the exit event.

Modify the prlimit exit event handler to retrieve information from the exit event instead of the entry event. Added scap conversion rules for the exit event with 5 parameters.

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This PR removes the need to process enter events for the prlimit syscall by utilizing the corresponding parameters available in the exit event.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

@github-actions
Copy link

Please double check driver/SCHEMA_VERSION file. See versioning.

/hold

There is no need to store the prlimit entry event, because all
required parameters are available in the exit event.

Modify the prlimit exit event handler to retrieve information from
the exit event instead of the entry event. Added scap conversion
rules for the exit event with 5 parameters.

Signed-off-by: Tero Kauppinen <[email protected]>
@terror96 terror96 force-pushed the cleanup-prlimit-event-handling branch from 17a7acf to 6110087 Compare July 16, 2025 07:03
@ekoops
Copy link
Contributor

ekoops commented Jul 16, 2025

/milestone 0.22.0

@poiana poiana added this to the 0.22.0 milestone Jul 16, 2025
@codecov
Copy link

codecov bot commented Jul 16, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 78.05%. Comparing base (92703f2) to head (6110087).
Report is 1 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #2545   +/-   ##
=======================================
  Coverage   78.05%   78.05%           
=======================================
  Files         292      292           
  Lines       32157    32167   +10     
  Branches     4692     4693    +1     
=======================================
+ Hits        25099    25109   +10     
  Misses       7058     7058           
Flag Coverage Δ
libsinsp 78.05% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Contributor

@ekoops ekoops left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Jul 16, 2025

LGTM label has been added.

DetailsGit tree hash: cda8c385e938f6ac5e63c7164b747ea950a4bfbb

@poiana
Copy link
Contributor

poiana commented Jul 16, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, terror96

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@ekoops
Copy link
Contributor

ekoops commented Jul 16, 2025

Not bumping the driver schema version is currently a practice we are following as we will bump it in a single shot once we are done with the #2427 initiative. So we can safely ignore the failing driver-schema check.

@ekoops
Copy link
Contributor

ekoops commented Jul 16, 2025

/hold cancel

@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Jul 16, 2025
@poiana poiana merged commit 878d245 into falcosecurity:master Jul 16, 2025
55 of 57 checks passed
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Jul 16, 2025
@terror96 terror96 deleted the cleanup-prlimit-event-handling branch July 16, 2025 08:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

4 participants