feature(proctree): Introduce a process tree

cmd/tracee-ebpf/main.go

@@ -91,6 +91,12 @@ func main() {
 				Value:   cli.NewStringSlice("none"),
 				Usage:   "control event caching queues. run '--cache help' for more info.",
 			},
+			&cli.StringSliceFlag{
+				Name:    "proctree",
+				Aliases: []string{"t"},
+				Value:   cli.NewStringSlice("none"),
+				Usage:   "process tree options. run '--proctree help' for more info.",
+			},
 			&cli.StringSliceFlag{
 				Name:  "crs",
 				Usage: "define connected container runtimes. run '--crs help' for more info.",

cmd/tracee/cmd/root.go

@@ -223,6 +223,17 @@ func initCmd() error {
 		return errfmt.WrapError(err)
 	}
 
+	rootCmd.Flags().StringArrayP(
+		"proctree",
+		"t",
+		[]string{"none"},
+		"[process|thread]\t\t\tControl process tree options",
+	)
+	err = viper.BindPFlag("proctree", rootCmd.Flags().Lookup("proctree"))
+	if err != nil {
+		return errfmt.WrapError(err)
+	}
+
 	// Server flags
 
 	rootCmd.Flags().Bool(

examples/config/global_config.json

@@ -3,6 +3,9 @@
     "cache": [
         "none"
     ],
+    "proctree": [
+        "none"
+    ],
     "capabilities": [],
     "containers": false,
     "crs": [],

examples/config/global_config.yaml

@@ -1,6 +1,8 @@
 blob-perf-buffer-size: 1024
 cache:
     - none
+proctree:
+    - none
 capabilities: []
 containers: false
 crs: []

pkg/changelog/changelog.go

@@ -0,0 +1,159 @@
+package changelog
+
+import (
+	"time"
+
+	"github.com/aquasecurity/tracee/pkg/logger"
+)
+
+type comparable interface {
+	~int | ~float64 | ~string
+}
+
+type item[T comparable] struct {
+	timestamp time.Time // timestamp of the change
+	value     T         // value of the change
+}
+
+// The changelog package provides a changelog data structure. It is a list of changes, each with a
+// timestamp. The changelog can be queried for the value at a given time.
+
+// ATTENTION: You should use Changelog within a struct and provide methods to access it,
+// coordinating access through your struct mutexes. DO NOT EXPOSE the changelog object directly to
+// the outside world as it is not thread-safe.
+
+type Changelog[T comparable] struct {
+	changes    []item[T]              // list of changes
+	timestamps map[time.Time]struct{} // set of timestamps (used to avoid duplicates)
+}
+
+// NewChangelog creates a new changelog.
+func NewChangelog[T comparable]() *Changelog[T] {
+	return &Changelog[T]{
+		changes:    []item[T]{},
+		timestamps: map[time.Time]struct{}{},
+	}
+}
+
+// Getters
+
+// GetCurrent: Observation on single element changelog.
+//
+// If there's one element in the changelog, after the loop, left would be set to 1 if the single
+// timestamp is before the targetTime, and 0 if it's equal or after.
+//
+// BEFORE: If the single timestamp is before the targetTime, when we return
+// clv.changes[left-1].value, returns clv.changes[0].value, which is the expected behavior.
+//
+// AFTER: If the single timestamp is equal to, or after the targetTime, the current logic would
+// return a "zero" value because of the condition if left == 0.
+//
+// We need to find the last change that occurred before or exactly at the targetTime. The binary
+// search loop finds the position where a new entry with the targetTime timestamp would be inserted
+// to maintain chronological order:
+//
+// This position is stored in "left".
+//
+// So, to get the last entry that occurred before the targetTime, we need to access the previous
+// position, which is left-1.
+//
+// GetCurrent returns the latest value of the changelog.
+func (clv *Changelog[T]) GetCurrent() T {
+	if len(clv.changes) == 0 {
+		return returnZero[T]()
+	}
+
+	return clv.changes[len(clv.changes)-1].value
+}
+
+// Get returns the value of the changelog at the given time.
+func (clv *Changelog[T]) Get(targetTime time.Time) T {
+	if len(clv.changes) == 0 {
+		return returnZero[T]()
+	}
+
+	idx := clv.findIndex(targetTime)
+	if idx == 0 {
+		var zero T
+		return zero
+	}
+
+	return clv.changes[idx-1].value
+}
+
+// GetAll returns all the values of the changelog.
+func (clv *Changelog[T]) GetAll() []T {
+	values := make([]T, len(clv.changes))
+	for i, entry := range clv.changes {
+		values[i] = entry.value
+	}
+	return values
+}
+
+// Setters
+
+// SetCurrent sets the latest value of the changelog.
+func (clv *Changelog[T]) SetCurrent(value T) {
+	clv.setAt(value, time.Now())
+}
+
+// Set sets the value of the changelog at the given time.
+func (clv *Changelog[T]) Set(value T, targetTime time.Time) {
+	clv.setAt(value, targetTime)
+}
+
+// private
+
+// setAt sets the value of the changelog at the given time.
+func (clv *Changelog[T]) setAt(value T, targetTime time.Time) {
+	// If the timestamp is already set, update that value only.
+	_, ok := clv.timestamps[targetTime]
+	if ok {
+		index := clv.findIndex(targetTime)
+		if !clv.changes[index].timestamp.Equal(targetTime) { // sanity check only (time exists already)
+			logger.Debugw("changelog internal error: timestamp mismatch")
+			return
+		}
+		if clv.changes[index].value != value {
+			logger.Debugw("changelog error: value mismatch for same timestamp")
+		}
+		clv.changes[index].value = value
+		return
+	}
+
+	entry := item[T]{
+		timestamp: targetTime,
+		value:     value,
+	}
+
+	// Insert the new entry in the changelog, keeping the list sorted by timestamp.
+	idx := clv.findIndex(entry.timestamp)
+	clv.changes = append(clv.changes, item[T]{})
+	copy(clv.changes[idx+1:], clv.changes[idx:])
+	clv.changes[idx] = entry
+
+	// Mark the timestamp as set.
+	clv.timestamps[targetTime] = struct{}{}
+}
+
+// findIndex returns the index of the first item in the changelog that is after the given time.
+func (clv *Changelog[T]) findIndex(target time.Time) int {
+	left, right := 0, len(clv.changes)
+
+	for left < right {
+		middle := (left + right) / 2
+		if clv.changes[middle].timestamp.Before(target) {
+			left = middle + 1
+		} else {
+			right = middle
+		}
+	}
+
+	return left
+}
+
+// returnZero returns the zero value of the type T.
+func returnZero[T any]() T {
+	var zero T
+	return zero
+}

pkg/changelog/changelog_test.go

@@ -0,0 +1,82 @@
+package changelog
+
+import (
+	"reflect"
+	"testing"
+	"time"
+)
+
+func TestChangelog(t *testing.T) {
+	cl := NewChangelog[int]()
+
+	// Test GetCurrent on an empty changelog
+	if cl.GetCurrent() != 0 {
+		t.Errorf("GetCurrent on empty changelog should return 0")
+	}
+
+	// Test SetCurrent and GetCurrent
+	cl.SetCurrent(42)
+	if cl.GetCurrent() != 42 {
+		t.Errorf("GetCurrent after SetCurrent should return 42")
+	}
+
+	// Test Get on an empty changelog
+
+	cl = NewChangelog[int]()
+
+	if cl.Get(time.Now()) != 0 {
+		t.Errorf("Get on empty changelog should return 0")
+	}
+
+	// Test 1 second interval among changes
+
+	cl = NewChangelog[int]()
+
+	cl.SetCurrent(1)
+	time.Sleep(2 * time.Second)
+	cl.SetCurrent(2)
+	time.Sleep(2 * time.Second)
+	cl.SetCurrent(3)
+
+	now := time.Now()
+
+	if cl.Get(now.Add(-4*time.Second)) != 1 {
+		t.Errorf("Get on changelog should return 1")
+	}
+	if cl.Get(now.Add(-2*time.Second)) != 2 {
+		t.Errorf("Get on changelog should return 2")
+	}
+	if cl.Get(now) != 3 {
+		t.Errorf("Get on changelog should return 3")
+	}
+
+	// Test 100 milliseconds interval among changes
+	// NOTE: If this test becomes flaky we can change/remove it.
+
+	cl = NewChangelog[int]()
+
+	cl.SetCurrent(1)
+	time.Sleep(100 * time.Millisecond)
+	cl.SetCurrent(2)
+	time.Sleep(100 * time.Millisecond)
+	cl.SetCurrent(3)
+
+	now = time.Now()
+
+	if cl.Get(now.Add(-200*time.Millisecond)) != 1 {
+		t.Errorf("Get on changelog should return 1")
+	}
+	if cl.Get(now.Add(-100*time.Millisecond)) != 2 {
+		t.Errorf("Get on changelog should return 2")
+	}
+	if cl.Get(now) != 3 {
+		t.Errorf("Get on changelog should return 3")
+	}
+
+	// Test getting all values at once
+
+	expected := []int{1, 2, 3}
+	if !reflect.DeepEqual(cl.GetAll(), expected) {
+		t.Errorf("GetAll should return %v, but got %v", expected, cl.GetAll())
+	}
+}

pkg/cmd/cobra/cobra.go

@@ -101,6 +101,14 @@ func GetTraceeRunner(c *cobra.Command, version string) (cmd.Runner, error) {
 		logger.Debugw("Cache", "type", cfg.Cache.String())
 	}
 
+	// Process Tree command line flags
+
+	procTree, err := flags.PrepareProcTree(viper.GetStringSlice("proctree"))
+	if err != nil {
+		return runner, err
+	}
+	cfg.ProcTree = procTree
+
 	// Capture command line flags - via cobra flag
 
 	captureFlags, err := c.Flags().GetStringArray("capture")

pkg/cmd/flags/help.go

@@ -13,6 +13,7 @@ func PrintAndExitIfHelp(ctx *cli.Context) {
 	keys := []string{
 		"crs",
 		"cache",
+		"proctree",
 		"capture",
 		"scope",
 		"events",
@@ -51,6 +52,8 @@ func GetHelpString(key string) string {
 		return containersHelp()
 	case "cache":
 		return cacheHelp()
+	case "proctree":
+		return procTreeHelp()
 	case "capture":
 		return captureHelp()
 	case "scope", "events":