chore: add event_config alignment check

[Forsworns]

Take the issue #108 . Have tested locally.

---

BTW, the alignment-checker reminds me that

C and Go structs alignment check failed: execvemap.ExecveValue(48) size does not match execve_map_value(112)

Is this expected? I found that they are defined as

// bpf/lib/process.h
struct execve_map_value {
	struct msg_execve_key key;
	struct msg_execve_key pkey;
	__u32 flags;
	__u32 nspid;
	__u32 binary;
	__u32 pad;
	struct msg_ns ns;
	struct msg_capabilities caps;
} __attribute__((packed)) __attribute__((aligned(8)));

and

// pkg/sensors/exec/execvemap/execve.go
type ExecveValue struct {
	Process processapi.MsgExecveKey
	Parent  processapi.MsgExecveKey
	Flags   uint32
	Nspid   uint32
	Buffer  uint64
}

Apparently, they are not the same...
And another related ExecveValueL struct in pkg/sensors/exec/execvemap/execve.go seems deprectated.

[tpapagian]

Thanks @Forsworns! Can you please rebase and drop the second commit (i.e. "Merge branch 'cilium:main' into alignchecker_event_config").

[tpapagian]

Additionally, in EventConfig struct you may also add align directives similar to:

tetragon/pkg/api/processapi/processapi.go

Lines 136 to 140 in 77e32bf

	type MsgExitEvent struct {
	Common MsgCommon `align:"common"`
	ProcessKey MsgExecveKey `align:"current"`
	Info MsgExitInfo `align:"info"`
	}

Using this, the alignchecker does not only check the size of the struct but also the fields inside.

[tpapagian]

Regarding the check between execvemap.ExecveValue and execve_map_value, I believe that these may not be the same. execve_map_value is not shared with the user-space. So we can remove that check.

[Forsworns]

these may not be the same. execve_map_value is not shared with the user-space.

In fact, they are shared. In pkg/sensors/exec/procevents/proc_reader.go, writeExecveMap will open write to the execve_map at the ebpf side. It collects the information all of the running processes when Tetragon is initialized.

See

tetragon/pkg/sensors/exec/procevents/proc_reader.go

Line 245 in 77e32bf

func GetRunningProcs(write, push bool) []Procs {

and

tetragon/pkg/sensors/exec/procevents/proc_reader.go

Line 179 in 77e32bf

func writeExecveMap(procs []Procs) {

Maybe it's better to append the missing items to ExecveValue.

[tpapagian]

these may not be the same. execve_map_value is not shared with the user-space.

In fact, they are shared. In pkg/sensors/exec/procevents/proc_reader.go, writeExecveMap will open write to the execve_map at the ebpf side. It collects the information all of the running processes when Tetragon is initialized.

See

tetragon/pkg/sensors/exec/procevents/proc_reader.go

Line 245 in 77e32bf

func GetRunningProcs(write, push bool) []Procs {

and

tetragon/pkg/sensors/exec/procevents/proc_reader.go

Line 179 in 77e32bf

func writeExecveMap(procs []Procs) {

Maybe it's better to append the missing items to ExecveValue.

I agree, maybe it is not enough to add new fields there, but we should also initialise them properly. I propose to keep that to a separate PR, so feel free to create a new one to solve this. Thanks!

[tpapagian]

Created #205 to keep track of execve_map_value issue.

[tpapagian]

Regarding the CI failure maybe you should also add "Signed-off-by" on the PR message (except from the commits where you already did it).

[tpapagian]

Thanks

[jrfastab]

Thanks @Forsworns nice set of work.