fix(filters): handle syscall arg

Handle syscall arg either by its name or its number for the events
SysEnter and SysExit.

E.g.:

  - sys_enter.args.syscall=open
  - sys_enter.args.syscall=2

It uses a handler function to be passed to the filter constructor.

This also adds unit tests for Filter().

pkg/filters/args.go

@@ -2,6 +2,7 @@ package filters
 
 import (
 	"fmt"
+	"strconv"
 	"strings"
 
 	"github.com/aquasecurity/tracee/pkg/errfmt"
@@ -45,6 +46,7 @@ func (filter *ArgFilter) Filter(eventID events.ID, args []trace.Argument) bool {
 	for argName, filter := range filter.filters[eventID] {
 		found := false
 		var argVal interface{}
+
 		for _, arg := range args {
 			if arg.Name == argName {
 				found = true
@@ -55,10 +57,10 @@ func (filter *ArgFilter) Filter(eventID events.ID, args []trace.Argument) bool {
 		if !found {
 			return false
 		}
+
 		// TODO: use type assertion instead of string conversion
-		if argName != "syscall" {
-			argVal = fmt.Sprint(argVal)
-		}
+		argVal = fmt.Sprint(argVal)
+
 		res := filter.Filter(argVal)
 		if !res {
 			return false
@@ -111,10 +113,33 @@ func (filter *ArgFilter) Parse(filterName string, operatorAndValues string, even
 		return InvalidEventArgument(argName)
 	}
 
-	err := filter.parseFilter(id, argName, operatorAndValues, func() Filter {
-		// TODO: map argument type to an appropriate filter constructor
-		return NewStringFilter()
-	})
+	// valueHandler is passed to the filter constructor to allow for special cases
+	// where the argument value needs to be adjusted before filtering
+	valueHandler := func(val string) (string, error) {
+		switch id {
+		case events.SysEnter,
+			events.SysExit:
+			if argName == "syscall" { // handle either syscall name or syscall id
+				_, err := strconv.Atoi(val)
+				if err != nil {
+					// if val is a string, then we need to convert it to a syscall id
+					syscallID, ok := events.Core.GetDefinitionIDByName(val)
+					if !ok {
+						return val, errfmt.Errorf("invalid syscall name: %s", val)
+					}
+					val = strconv.Itoa(int(syscallID))
+				}
+			}
+		}
+
+		return val, nil
+	}
+
+	err := filter.parseFilter(id, argName, operatorAndValues,
+		func() Filter {
+			// TODO: map argument type to an appropriate filter constructor
+			return NewStringFilter(valueHandler)
+		})
 	if err != nil {
 		return errfmt.WrapError(err)
 	}

pkg/filters/args_test.go

@@ -4,9 +4,12 @@ import (
 	"reflect"
 	"testing"
 
+	"github.com/google/go-cmp/cmp"
 	"github.com/stretchr/testify/require"
 
 	"github.com/aquasecurity/tracee/pkg/events"
+	"github.com/aquasecurity/tracee/pkg/filters/sets"
+	"github.com/aquasecurity/tracee/types/trace"
 )
 
 func TestArgsFilterClone(t *testing.T) {
@@ -18,7 +21,19 @@ func TestArgsFilterClone(t *testing.T) {
 
 	copy := filter.Clone().(*ArgFilter)
 
-	if !reflect.DeepEqual(filter, copy) {
+	opt1 := cmp.AllowUnexported(
+		ArgFilter{},
+		StringFilter{},
+		sets.PrefixSet{},
+		sets.SuffixSet{},
+	)
+	opt2 := cmp.FilterPath(func(p cmp.Path) bool {
+		// ignore the valueHandler function
+		// https://cs.opensource.google/go/go/+/refs/tags/go1.22.0:src/reflect/deepequal.go;l=187
+		return p.Last().String() == ".valueHandler"
+	}, cmp.Ignore())
+
+	if !cmp.Equal(filter, copy, opt1, opt2) {
 		t.Errorf("Clone did not produce an identical copy")
 	}
 
@@ -29,3 +44,133 @@ func TestArgsFilterClone(t *testing.T) {
 		t.Errorf("Changes to copied filter affected the original")
 	}
 }
+
+func newArgument(argName, argType string, argValue interface{}) trace.Argument {
+	return trace.Argument{
+		ArgMeta: trace.ArgMeta{
+			Name: argName,
+			Type: argType,
+		},
+		Value: argValue,
+	}
+}
+
+func TestArgsFilter_Filter(t *testing.T) {
+	t.Parallel()
+
+	tt := []struct {
+		name                   string
+		parseFilterName        string
+		parseOperatorAndValues string
+		parseEventNamesToID    map[string]events.ID
+		eventID                events.ID
+		args                   []trace.Argument
+		expected               bool
+	}{
+		{
+			name:                   "Matching argument value as int",
+			parseFilterName:        "read.args.fd",
+			parseOperatorAndValues: "=3",
+			parseEventNamesToID:    events.Core.NamesToIDs(),
+			eventID:                events.Read,
+			args: []trace.Argument{
+				newArgument("fd", "int", 3),
+			},
+			expected: true,
+		},
+		{
+			name:                   "Non-matching argument value as int",
+			parseFilterName:        "read.args.fd",
+			parseOperatorAndValues: "=3",
+			parseEventNamesToID:    events.Core.NamesToIDs(),
+			eventID:                events.Read,
+			args: []trace.Argument{
+				newArgument("fd", "int", 4),
+			},
+			expected: false,
+		},
+		{
+			name:                   "Matching argument value as string",
+			parseFilterName:        "open.args.pathname",
+			parseOperatorAndValues: "=/etc/passwd",
+			parseEventNamesToID:    events.Core.NamesToIDs(),
+			eventID:                events.Open,
+			args: []trace.Argument{
+				newArgument("pathname", "string", "/etc/passwd"),
+			},
+			expected: true,
+		},
+		{
+			name:                   "Non-matching argument value as string",
+			parseFilterName:        "open.args.pathname",
+			parseOperatorAndValues: "=/etc/passwd",
+			parseEventNamesToID:    events.Core.NamesToIDs(),
+			eventID:                events.Open,
+			args: []trace.Argument{
+				newArgument("pathname", "string", "/etc/shadow"),
+			},
+			expected: false,
+		},
+
+		// Test cases for syscall argument value
+		{
+			name:                   "Matching 'syscall' argument value of sys_enter as string",
+			parseFilterName:        "sys_enter.args.syscall",
+			parseOperatorAndValues: "=open", // string value (syscall name)
+			parseEventNamesToID:    events.Core.NamesToIDs(),
+			eventID:                events.SysEnter,
+			args: []trace.Argument{
+				newArgument("syscall", "int", 2),
+			},
+			expected: true,
+		},
+		{
+			name:                   "Matching 'syscall' argument value of sys_exit as string",
+			parseFilterName:        "sys_exit.args.syscall",
+			parseOperatorAndValues: "=3", // int value (syscall id)
+			parseEventNamesToID:    events.Core.NamesToIDs(),
+			eventID:                events.SysExit,
+			args: []trace.Argument{
+				newArgument("syscall", "int", 3),
+			},
+			expected: true,
+		},
+		{
+			name:                   "Matching 'syscall' argument value of hooked_syscall as string",
+			parseFilterName:        "hooked_syscall.args.syscall",
+			parseOperatorAndValues: "=open", // string value (syscall name)
+			parseEventNamesToID:    events.Core.NamesToIDs(),
+			eventID:                events.HookedSyscall,
+			args: []trace.Argument{
+				newArgument("syscall", "string", "open"),
+			},
+			expected: true,
+		},
+		{
+			name:                   "Non-matching 'syscall' argument value of sys_enter as string",
+			parseFilterName:        "sys_exit.args.syscall",
+			parseOperatorAndValues: "=2", // int value (syscall number), fails to match
+			parseEventNamesToID:    events.Core.NamesToIDs(),
+			eventID:                events.SysExit,
+			args: []trace.Argument{
+				newArgument("syscall", "int", 1),
+			},
+			expected: false,
+		},
+	}
+
+	for _, tc := range tt {
+		tc := tc
+
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			filter := NewArgFilter()
+			err := filter.Parse(tc.parseFilterName, tc.parseOperatorAndValues, tc.parseEventNamesToID)
+			require.NoError(t, err)
+
+			result := filter.Filter(tc.eventID, tc.args)
+			require.Equal(t, tc.expected, result)
+		})
+	}
+}

pkg/filters/benchmarks/string_test.go

@@ -95,7 +95,7 @@ func BenchmarkMatchFilter100(b *testing.B) {
 }
 
 func benchmarkStringFilter(b *testing.B, len int) {
-	filter := filters.NewStringFilter()
+	filter := filters.NewStringFilter(nil)
 	err := filter.Parse(fmt.Sprintf("=%s", strings.Join(filterVals, ",")))
 	require.NoError(b, err)
 

pkg/filters/context.go

@@ -84,19 +84,19 @@ func (filter *ContextFilter) Parse(filterName string, operatorAndValues string)
 			uidFilter:                  NewIntFilter(),
 			mntNSFilter:                NewIntFilter(),
 			pidNSFilter:                NewIntFilter(),
-			processNameFilter:          NewStringFilter(),
-			hostNameFilter:             NewStringFilter(),
+			processNameFilter:          NewStringFilter(nil),
+			hostNameFilter:             NewStringFilter(nil),
 			cgroupIDFilter:             NewUIntFilter(),
 			containerFilter:            NewBoolFilter(),
-			containerIDFilter:          NewStringFilter(),
-			containerImageFilter:       NewStringFilter(),
-			containerImageDigestFilter: NewStringFilter(),
-			containerNameFilter:        NewStringFilter(),
-			podNameFilter:              NewStringFilter(),
-			podNSFilter:                NewStringFilter(),
-			podUIDFilter:               NewStringFilter(),
+			containerIDFilter:          NewStringFilter(nil),
+			containerImageFilter:       NewStringFilter(nil),
+			containerImageDigestFilter: NewStringFilter(nil),
+			containerNameFilter:        NewStringFilter(nil),
+			podNameFilter:              NewStringFilter(nil),
+			podNSFilter:                NewStringFilter(nil),
+			podUIDFilter:               NewStringFilter(nil),
 			podSandboxFilter:           NewBoolFilter(),
-			syscallFilter:              NewStringFilter(),
+			syscallFilter:              NewStringFilter(nil),
 		}
 		filter.filters[eventDefID] = eventFilter
 	}

pkg/filters/filters.go

@@ -56,7 +56,7 @@ type Filter interface {
 	utils.Cloner
 
 	Filter(val interface{}) bool
-	Parse(string) error
+	Parse(operatorAndValues string) error
 	Enable()
 	Disable()
 	Enabled() bool

pkg/filters/string.go

@@ -11,27 +11,29 @@ import (
 )
 
 type StringFilter struct {
-	equal       map[string]struct{}
-	notEqual    map[string]struct{}
-	prefixes    sets.PrefixSet
-	suffixes    sets.SuffixSet
-	contains    map[string]struct{}
-	notPrefixes sets.PrefixSet
-	notSuffixes sets.SuffixSet
-	notContains map[string]struct{}
-	enabled     bool
+	valueHandler func(string) (string, error)
+	equal        map[string]struct{}
+	notEqual     map[string]struct{}
+	prefixes     sets.PrefixSet
+	suffixes     sets.SuffixSet
+	contains     map[string]struct{}
+	notPrefixes  sets.PrefixSet
+	notSuffixes  sets.SuffixSet
+	notContains  map[string]struct{}
+	enabled      bool
 }
 
-func NewStringFilter() *StringFilter {
+func NewStringFilter(valueHandler func(string) (string, error)) *StringFilter {
 	return &StringFilter{
-		equal:       map[string]struct{}{},
-		notEqual:    map[string]struct{}{},
-		prefixes:    sets.NewPrefixSet(),
-		suffixes:    sets.NewSuffixSet(),
-		notPrefixes: sets.NewPrefixSet(),
-		notSuffixes: sets.NewSuffixSet(),
-		contains:    map[string]struct{}{},
-		notContains: map[string]struct{}{},
+		valueHandler: valueHandler,
+		equal:        map[string]struct{}{},
+		notEqual:     map[string]struct{}{},
+		prefixes:     sets.NewPrefixSet(),
+		suffixes:     sets.NewSuffixSet(),
+		notPrefixes:  sets.NewPrefixSet(),
+		notSuffixes:  sets.NewSuffixSet(),
+		contains:     map[string]struct{}{},
+		notContains:  map[string]struct{}{},
 	}
 }
 
@@ -110,8 +112,19 @@ func (f *StringFilter) Parse(operatorAndValues string) error {
 
 	values := strings.Split(valuesString, ",")
 
-	for _, val := range values {
-		err := f.add(val, stringToOperator(operatorString))
+	var (
+		val string
+		err error
+	)
+	for _, val = range values {
+		if f.valueHandler != nil {
+			val, err = f.valueHandler(val)
+			if err != nil {
+				return errfmt.WrapError(err)
+			}
+		}
+
+		err = f.add(val, stringToOperator(operatorString))
 		if err != nil {
 			return errfmt.WrapError(err)
 		}
@@ -242,7 +255,7 @@ func (f *StringFilter) Clone() utils.Cloner {
 		return nil
 	}
 
-	n := NewStringFilter()
+	n := NewStringFilter(f.valueHandler)
 
 	maps.Copy(n.equal, f.equal)
 	maps.Copy(n.notEqual, f.notEqual)