Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[DRAFT] playing around process tree ideas #3363

Closed
wants to merge 2 commits into from
Closed

[DRAFT] playing around process tree ideas #3363

wants to merge 2 commits into from

Commits on Aug 4, 2023

  1. feature(events): process unique identifier murmur hashing 

    By having a hash to represent each ever existent process, we can keep
track of the relationship between processes and its childs using these
identifiers instead of fragile PID/PPID relationship.

The eBPF murmur hashing function is added, despite not being currently
used, because it has been tested together with the userland portion, to
make sure the hashes are exactly the same (so both sides are talking the
same language).

> This code will be used by the process tree implementation in next
> commits.
    @rafaeldtinoco
    rafaeldtinoco committed Aug 4, 2023
    Configuration menu
    Copy the full SHA
    6839ba7 View commit details
    Browse the repository at this point in the history

  2. feature(events): turn SchedProcessXXX control plane enabled 

    - ADD parent_start_time argument to event context (*)

- move functions containing inline asm to the end of their files
- create buffer_memcpy() for map-to-map buffer copy in ebpf

- sched_process_fork:
  - create a signal handler for a SchedProcessFork signal event
  - only SUBMIT the SchedProcessFork event if picked by a policy
  - ALWAYS submit the SchedProcessFork signal event (args only)

- sched_process_exec:
  - create a signal handler for a SchedProcessExec signal event
  - only SUBMIT the SchedProcessExec event if picked by a policy
  - ALWAYS submit the SchedProcessFork signal event (args only)

- sched_process_exit:
  - create a signal handler for a SchedProcessExit signal event
  - only SUBMIT the SchedProcessExit event if picked by a policy
  - ALWAYS submit the SchedProcessExit signal event (args only)
  - The SchedProcessExit signal event has extra 2 arguments added,
    both will be needed for the process tree implementation.

- create a list of essential events coming from the control plane
  package, instead of a function within Tracee type.

- add a 'Control' boolean to EventState to control whether the
  event, and its dependant events, should only be configured
  because of the control plane. This is needed because some
  events are too complex to have duplicated probes (they involve
  having tailCalls and other dependencies), so the same event
  probes are used to submit the regular AND the signal events.

(*) parent_start_time argument to event context:

  The reason to have parent start time argument added is to have an unique
  identifier, using 'host_tid' + 'process start time' (using the murmur3
  hashing function), on each submitted event. This way, the process tree
  is able to identify process parent using the process hash (and each ever
  existing process node entry in the process tree is hashed and unique).

  => The reasoning will be cleared in next commits.

NOTE: There are NO logical changes to eBPF code but to copy the scratch
buffer and submit it into the signal events perfbuffer.
    @rafaeldtinoco
    rafaeldtinoco committed Aug 4, 2023
    Configuration menu
    Copy the full SHA
    4bb81ad View commit details
    Browse the repository at this point in the history