Merge pull request #598 from grantseltzer/improve-selftest

fix: Make self test for ringbuffer verify the data sent from kernel space
aquasecurity · Mar 11, 2021 · 436c11d · 436c11d
2 parents 559ff36 + 8ab0254
commit 436c11d
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 17 deletions.
diff --git a/libbpfgo/selftest/ringbuffers/main.go b/libbpfgo/selftest/ringbuffers/main.go
@@ -5,6 +5,8 @@ import "C"
 import (
 	bpf "github.com/aquasecurity/tracee/libbpfgo"
 	"os"
+	"fmt"
+	"encoding/binary"
 )
 
 func main() {
@@ -37,15 +39,18 @@ func main() {
 	numberOfEventsReceived := 0
 
 recvLoop:
-	for {
-		_ = <-eventsChannel
+	for  {
+		b := <-eventsChannel
+		if binary.LittleEndian.Uint32(b) != 2021 {
+			fmt.Fprintf(os.Stderr, "invalid data retrieved\n")
+			os.Exit(-1)
+		}
 		numberOfEventsReceived++
 		if numberOfEventsReceived > 5 {
 			break recvLoop
 		}
 	}
 
-
 	// Test that it won't cause a panic or block if Stop or Close called multiple times
 	rb.Stop()
 	rb.Stop()

diff --git a/libbpfgo/selftest/ringbuffers/self.bpf.c b/libbpfgo/selftest/ringbuffers/self.bpf.c
@@ -7,13 +7,6 @@
 #define asm_inline asm
 #endif
 
-char LICENSE[] SEC("license") = "GPL";
-
-struct process_info {
-    int pid;
-    char comm[100];
-};
-
 struct {
     __uint(type, BPF_MAP_TYPE_RINGBUF);
     __uint(max_entries, 1 << 24);
@@ -24,19 +17,16 @@ long ringbuffer_flags = 0;
 SEC("kprobe/sys_mmap")
 int kprobe__sys_mmap(struct pt_regs *ctx)
 {
-    __u64 id = bpf_get_current_pid_tgid();
-    __u32 tgid = id >> 32;
-    struct process_info *process;
+    int *process;
 
     // Reserve space on the ringbuffer for the sample
-    process = bpf_ringbuf_reserve(&events, sizeof(struct process_info), ringbuffer_flags);
+    process = bpf_ringbuf_reserve(&events, sizeof(int), ringbuffer_flags);
     if (!process) {
         return 0;
     }
 
-    process->pid = tgid;
-    bpf_get_current_comm(&process->comm, 100);
+    *process = 2021;
 
     bpf_ringbuf_submit(process, ringbuffer_flags);
     return 0;
-}
+}