Skip to content

Conversation

@terror96
Copy link
Contributor

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This PR is part of #2588.

Specifically, this addresses the following system calls:

  • setuid
  • ptrace
  • mkdir
  • mkdirat
  • fchdir

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Not bumping the driver schema version is currently a practice we are following as we will bump it in a single shot once we are done with the #2068 proposal.

Does this PR introduce a user-facing change?:

feat!: drop `setuid` enter events gen, testing and parsing code
feat!: drop `ptrace` enter events gen, testing and parsing code
feat!: drop `mkdir` enter events gen, testing and parsing code
feat!: drop `mkdirat` enter events gen, testing and parsing code
feat!: drop `fchdir` enter events gen, testing and parsing code

@github-actions
Copy link

Please double check driver/SCHEMA_VERSION file. See versioning.

/hold

@ekoops
Copy link
Contributor

ekoops commented Sep 1, 2025

/milestone 0.22.0

@poiana poiana added this to the 0.22.0 milestone Sep 1, 2025
@codecov
Copy link

codecov bot commented Sep 1, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.15%. Comparing base (ecbbadb) to head (90728fe).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #2594      +/-   ##
==========================================
- Coverage   78.16%   78.15%   -0.01%     
==========================================
  Files         298      298              
  Lines       32079    32069      -10     
  Branches     4691     4691              
==========================================
- Hits        25075    25065      -10     
  Misses       7004     7004              
Flag Coverage Δ
libsinsp 78.15% <100.00%> (-0.01%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@leogr
Copy link
Member

leogr commented Sep 1, 2025

Not bumping the driver schema version is currently a practice we are following as we will bump it in a single shot once we are done with the #2068 proposal.
👍

/unhold

@ekoops
Copy link
Contributor

ekoops commented Sep 1, 2025

@ekoops
Copy link
Contributor

ekoops commented Sep 1, 2025

X64 kernel testing matrix

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-4.19 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2-5.10 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2023-6.1 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.0 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.7 🟢 🟢 🟢 🟢 🟢 🟢
centos-3.10 🟢 🟢 🟢 🟡 🟡 🟡
centos-4.18 🟢 🟢 🟢 🟢 🟢 🟢
centos-5.14 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.17 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.8 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-3.10 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-4.14 🟢 🟢 🟢 🟢 🟢 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-5.4 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-4.15 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-5.8 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

ARM64 kernel testing matrix

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-4.14 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

@ekoops
Copy link
Contributor

ekoops commented Sep 1, 2025

Zig build CI error is not related to this PR, and the issue was mitigated here: #2597

Copy link
Contributor

@ekoops ekoops left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Sep 1, 2025

LGTM label has been added.

DetailsGit tree hash: da50c9ae91e3f90f9469f197b66d819eada952bd

leogr
leogr previously approved these changes Sep 1, 2025
@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Sep 1, 2025
@ekoops
Copy link
Contributor

ekoops commented Sep 1, 2025

/override "CI Build / build-libs-linux-amd64 😁 (zig) (pull_request)"

1 similar comment
@leogr
Copy link
Member

leogr commented Sep 1, 2025

/override "CI Build / build-libs-linux-amd64 😁 (zig) (pull_request)"

@terror96 terror96 force-pushed the drop-syscall-enter-events-1 branch from 216b713 to fe622bf Compare September 2, 2025 06:46
@poiana poiana removed the lgtm label Sep 2, 2025
@poiana poiana requested review from ekoops and leogr September 2, 2025 06:46
@ekoops ekoops changed the title feat!: drop some syscalls enter events gen, testing and parsing code (part 3) feat!: drop some syscalls enter events gen, testing and parsing code (part 4) Sep 2, 2025
Copy link
Contributor

@ekoops ekoops left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey @terror96 , thank you for your great contribution! I just added a minor comment.

As the `setuid` exit events contain all the information needed, drop
`setuid` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `setuid` enter events generation and parsing

Signed-off-by: Tero Kauppinen <[email protected]>
As the `ptrace` exit events contain all the information needed, drop
`ptrace` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `ptrace` enter events generation and parsing

Signed-off-by: Tero Kauppinen <[email protected]>
…sing code

As the `mkdir_2` and `mkdirat` exit events contain all the information
needed, drop `mkdir_2` and `mkdirat` enter events generation from all
drivers, and all related testing and parsing code.

BREAKING CHANGE: drop `mkdir_2` and `mkdirat` enter events generation
and parsing

Signed-off-by: Tero Kauppinen <[email protected]>
As the `fchdir` exit events contain all the information needed, drop
`fchdir` enter events generation from all drivers, and all related
testing and parsing code.

BREAKING CHANGE: drop `fchdir` enter events generation and parsing

Signed-off-by: Tero Kauppinen <[email protected]>
@terror96 terror96 force-pushed the drop-syscall-enter-events-1 branch from eab1fe4 to 90728fe Compare September 2, 2025 13:54
Copy link
Contributor

@ekoops ekoops left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Sep 2, 2025
@poiana
Copy link
Contributor

poiana commented Sep 2, 2025

LGTM label has been added.

DetailsGit tree hash: 2f49ccbe73c395b4172af1090ce12532d7999bcd

@poiana
Copy link
Contributor

poiana commented Sep 2, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, terror96

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit 65c7f7f into falcosecurity:master Sep 2, 2025
53 of 57 checks passed
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Sep 2, 2025
@terror96 terror96 deleted the drop-syscall-enter-events-1 branch September 3, 2025 06:46
@leogr leogr modified the milestones: 0.22.0, 9.0.0+driver Oct 16, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

4 participants