Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix: fix container edge case in events pipeline #3253

Merged
merged 1 commit into from Jun 21, 2023
Merged

fix: fix container edge case in events pipeline #3253

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
16 changes: 10 additions & 6 deletions pkg/ebpf/events_pipeline.go
View file
Open in desktop
Expand Up @@ -220,7 +220,7 @@ func (t *Tracee) decodeEvents(outerCtx context.Context, sourceChan chan []byte)
PodUID: containerInfo.Pod.UID,
}

flags := parseContextFlags(ctx.Flags)
flags := parseContextFlags(containerData.ID, ctx.Flags)
syscall := ""
if ctx.Syscall != noSyscall {
var err error
Expand Down Expand Up @@ -380,15 +380,19 @@ func (t *Tracee) matchPolicies(event *trace.Event) uint64 {
return bitmap
}

func parseContextFlags(flags uint32) trace.ContextFlags {
func parseContextFlags(containerId string, flags uint32) trace.ContextFlags {
const (
contStartFlag = 1 << iota
IsCompatFlag
)
return trace.ContextFlags{
ContainerStarted: (flags & contStartFlag) != 0,
geyslan marked this conversation as resolved.
Show resolved Hide resolved
IsCompat: (flags & IsCompatFlag) != 0,
}

var cflags trace.ContextFlags
// Handle the edge case where containerStarted flag remains true despite an empty containerId.
// See #3251 for more details.
cflags.ContainerStarted = (containerId != "") && (flags&contStartFlag) != 0
cflags.IsCompat = (flags & IsCompatFlag) != 0

return cflags
}

// Get the syscall name from its ID, taking into account architecture and 32bit/64bit modes
Expand Down