Missing fd_install events in dup system call

[tpapagian]

With the following configuration:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "copyfd"
spec:
  kprobes:
  - call: "fd_install"
    syscall: false
    args:
    - index: 0
      type: int
    - index: 1
      type: "file"
    selectors:
    - matchPIDs:
      - operator: In
        followForks: true
        values:
        - <ADD_PID_HERE>

and the following program:

#define _GNU_SOURCE 
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <fcntl.h>

#define BUFSIZE 9

#define errExit(msg) \
   do { \
      perror(msg); \
      exit(EXIT_FAILURE); \
   } while (0)

void read_with_fd(int fd)
{
    ssize_t retval;
    char buf[BUFSIZE];

    if (lseek(fd, 0, SEEK_SET) != 0)
        errExit("lseek");

    retval = read(fd, buf, BUFSIZE);
    if (retval != BUFSIZE)
        errExit("read");

    buf[BUFSIZE - 1] = '\0';
    printf("%s\n", buf);
}

int main(int argc, char *argv[])
{
    int fd, fd_dup;
    const char *pathname = "/etc/passwd";

    fd = open(pathname, O_RDONLY);
    if (fd == -1)
        errExit("open");

    read_with_fd(fd);

    fd_dup = dup(fd);
    if (fd_dup == -1)
         errExit("dup");

    read_with_fd(fd_dup);

    close(fd_dup);    
    close(fd);

    return 0;
}

In a 5.13 kernel we receive 2 fd_install events as expected (one for the open and one for the dup system calls). These events are:

{
  "process_kprobe": {
    "process": {
      "exec_id": "OjEyMTU1Njg3NTM2MDoxOTc1",
      "pid": 1975,
      "uid": 1010,
      "cwd": "/home/apapag/tetragon",
      "binary": "/home/apapag/tetragon/contrib/tester-progs/follow-tester",
      "flags": "execve clone",
      "start_time": "2022-06-15T08:02:08.275287599Z",
      "auid": 1010,
      "parent_exec_id": "OjE2MzgwMDAwMDAwOjE1NzY=",
      "refcnt": 1
    },
    "parent": {
      "exec_id": "OjE2MzgwMDAwMDAwOjE1NzY=",
      "pid": 1576,
      "uid": 0,
      "cwd": "/home/apapag/tetragon",
      "binary": "/usr/bin/bash",
      "flags": "procFS auid",
      "start_time": "2022-06-15T08:00:23.098396913Z",
      "auid": 0,
      "parent_exec_id": "OjE2MjYwMDAwMDAwOjE1NzU=",
      "refcnt": 1
    },
    "function_name": "fd_install",
    "args": [
      {
        "int_arg": 3
      },
      {
        "file_arg": {
          "path": "/etc/passwd"
        }
      }
    ],
    "action": "KPROBE_ACTION_POST"
  },
  "time": "2022-06-15T08:02:08.275512060Z"
}
{
  "process_kprobe": {
    "process": {
      "exec_id": "OjEyMTU1Njg3NTM2MDoxOTc1",
      "pid": 1975,
      "uid": 1010,
      "cwd": "/home/apapag/tetragon",
      "binary": "/home/apapag/tetragon/contrib/tester-progs/follow-tester",
      "flags": "execve clone",
      "start_time": "2022-06-15T08:02:08.275287599Z",
      "auid": 1010,
      "parent_exec_id": "OjE2MzgwMDAwMDAwOjE1NzY=",
      "refcnt": 1
    },
    "parent": {
      "exec_id": "OjE2MzgwMDAwMDAwOjE1NzY=",
      "pid": 1576,
      "uid": 0,
      "cwd": "/home/apapag/tetragon",
      "binary": "/usr/bin/bash",
      "flags": "procFS auid",
      "start_time": "2022-06-15T08:00:23.098396913Z",
      "auid": 0,
      "parent_exec_id": "OjE2MjYwMDAwMDAwOjE1NzU=",
      "refcnt": 1
    },
    "function_name": "fd_install",
    "args": [
      {
        "int_arg": 4
      },
      {
        "file_arg": {
          "path": "/etc/passwd"
        }
      }
    ],
    "action": "KPROBE_ACTION_POST"
  },
  "time": "2022-06-15T08:02:08.275547122Z"
}

In 5.10 and 5.4 (at least) we receive only the first event (i.e. dup system call does not generate an fd_install event).