Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(events): fix process_execute_failed missing symbol for new kernels #3983

Merged
merged 2 commits into from Apr 29, 2024

Conversation

AlonZivony
Copy link
Collaborator

@AlonZivony AlonZivony commented Apr 17, 2024

1. Explain what the PR does

Fix the process_execute_failed event missing probe error for kernel 5.8 forward.
This is a quick fix, as it uses a global value to determine which probes to use.
In the future, it should be determined using the fallback mechanism - #3965.
This is the fast fix for the previous PR #3881.

Fix #3356
Also fix #3727 as this is the last step for it to be fixed.
On the way fix #4008

2. Explain how to test it

3. Other comments

@AlonZivony AlonZivony force-pushed the bugfix/exec-failed-fast-fix branch 2 times, most recently from 23090de to 0774240 Compare April 17, 2024 15:29
@AlonZivony AlonZivony changed the title fix(events): create usermode events for submit fix(events): fix process_execute_failed missing symbol for new kernels Apr 17, 2024
@geyslan
Copy link
Member

geyslan commented Apr 18, 2024

Going over this today. 👍🏼

Copy link
Member

@geyslan geyslan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

pkg/ebpf/probes/probe_group.go Outdated Show resolved Hide resolved
pkg/ebpf/c/tracee.bpf.c Outdated Show resolved Hide resolved
pkg/ebpf/probes/probe_group.go Outdated Show resolved Hide resolved
pkg/ebpf/probes/probes.go Outdated Show resolved Hide resolved
tests/e2e-inst-test.sh Show resolved Hide resolved
Fix an issue that usermode events are only created if they should be
emitted.
The previous probe was missing from different distros and kernels.
The new probes are safer, but only exist starting from v5.8 of the kernel.
@AlonZivony
Copy link
Collaborator Author

@geyslan if you can make sure this PR is getting into the 0.21 version it would be great.

@geyslan
Copy link
Member

geyslan commented Apr 29, 2024

@geyslan if you can make sure this PR is getting into the 0.21 version it would be great.

This one went unnoticed, sorry. We filter by kind/bug label to check if a PR needs to enter before the RC. Probably some issue or this PR did not have the label and this one was left out. But let's fix it.

@geyslan
Copy link
Member

geyslan commented Apr 29, 2024

E2E 1483 green.

@geyslan geyslan merged commit 99bc47e into aquasecurity:main Apr 29, 2024
32 checks passed
@geyslan
Copy link
Member

geyslan commented Apr 29, 2024

Backport: #4011

@AlonZivony AlonZivony deleted the bugfix/exec-failed-fast-fix branch April 30, 2024 08:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment