Skip to content

Conversation

@terror96
Copy link
Contributor

@terror96 terror96 commented Jul 21, 2025

The new driver does not emit PPM_SYSCALL_RMDIR events anymore, and there is no longer need to handle the old version of the rmdir event. This update removes the state handling and adds conversion rules for the scap files.

This update also cleans up unused PPME_SYSCALL_MKDIR_X statements.

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This update adds missing conversion rules for old scap events to the new events and eliminates the need to store the entry event information.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

The version number was pumped as for #2480.

Does this PR introduce a user-facing change?:

NONE

terror96 added 2 commits July 21, 2025 11:31
The current implementation does no longer emit PPME_SYSCALL_MKDIR_X
events and these events are also converted to PPME_SYSCALL_MKDIR_2_X
events for older scap files. Remove unused PPME_SYSCALL_MKDIR_X
statements from the codebase.

Added the CIF_FALLBACK_TO_EMPTY flag for parameters copied from
the enter event.

Signed-off-by: Tero Kauppinen <[email protected]>
The new driver does not emit `PPM_SYSCALL_RMDIR` events anymore, and
there is no longer need to handle the old version of the rmdir event.
This update removes the state handling and adds conversion rules for
the scap files.

Signed-off-by: Tero Kauppinen <[email protected]>
@ekoops
Copy link
Contributor

ekoops commented Jul 21, 2025

/milestone 0.22

@poiana
Copy link
Contributor

poiana commented Jul 21, 2025

@ekoops: The provided milestone is not valid for this repository. Milestones in this repository: [0.22.0, TBD, next-driver]

Use /milestone clear to clear the milestone.

Details

In response to this:

/milestone 0.22

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@codecov
Copy link

codecov bot commented Jul 21, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 78.02%. Comparing base (c1cd8e2) to head (d1b4ebb).
Report is 2 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #2549      +/-   ##
==========================================
- Coverage   78.03%   78.02%   -0.01%     
==========================================
  Files         292      292              
  Lines       32153    32142      -11     
  Branches     4704     4704              
==========================================
- Hits        25089    25078      -11     
  Misses       7064     7064              
Flag Coverage Δ
libsinsp 78.02% <ø> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@FedeDP
Copy link
Contributor

FedeDP commented Jul 21, 2025

/milestone 0.22.0

@poiana poiana added this to the 0.22.0 milestone Jul 21, 2025
Copy link
Contributor

@ekoops ekoops left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Jul 21, 2025

LGTM label has been added.

DetailsGit tree hash: 3c41f8c81849d3c2244d2b2f8fa295a3006da5e7

Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Jul 21, 2025
@poiana
Copy link
Contributor

poiana commented Jul 21, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, FedeDP, terror96

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit 398f606 into falcosecurity:master Jul 21, 2025
66 of 68 checks passed
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Jul 21, 2025
@terror96 terror96 deleted the cleanup-ppme-syscall-rmdir branch July 21, 2025 11:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Archived in project

Development

Successfully merging this pull request may close these issues.

4 participants