Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

matchBinaries improvements #686

Merged
merged 8 commits into from
Feb 24, 2023
Merged

matchBinaries improvements #686

merged 8 commits into from
Feb 24, 2023
+306 −133

Commits on Feb 24, 2023

  1. matchBinaries fixes 

    There are some issues regarding matchBinaries. In this patch we still
support up to 4 values in matchBinaries. Increasing this will be a
followup.

For matchBinaries, we use names_map that has binary names to id
translations. During exec events we check if the binary name exists in
this map and if that is true we keep that id in the execve_map_value
struct.

Now we write in the matchBinaries selectors the value 1 everywhere. To
fix that we introduce a single global variable that get a new unique ID
for each binary specified.

We cannot use a separate names_map for each kprobe as they should also
be shared with the execve kprobe. We keep a single names_map for all
kprobes.

Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
    @tpapagian
    tpapagian committed Feb 24, 2023
    Configuration menu
    Copy the full SHA
    1ca4828 View commit details
    Browse the repository at this point in the history

  2. Increase the number of values in matchBinaries 

    Before that we had a limit to 4 values in the matchBinaries selector.
This patch uses a map per kprobe (sel_names_map) to remove this
limitation. The current limit is 256 values (the size of the map) and
should be enough for all cases.

As a follow-up we can also clear entries from the (shared) names_map
when we remove kprobes. For now we also increase the size of that map to
256 entries. This means that we can define up to 256 unique binary names
among all matchBinaries selectors.

Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
    @tpapagian
    tpapagian committed Feb 24, 2023
    Configuration menu
    Copy the full SHA
    87f94db View commit details
    Browse the repository at this point in the history

  3. Add NotIn operator for matchBinaries 

    For now we only supported In operator in matchBinaries. This patch
adds support for the NotIn operator.

Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
    @tpapagian
    tpapagian committed Feb 24, 2023
    Configuration menu
    Copy the full SHA
    84e71d2 View commit details
    Browse the repository at this point in the history

  4. Fix names_map update in generic tracepoints 

    After loading a tracepoint program we should update names_map with new
enties in a similar way to kprobes.

Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
    @tpapagian
    tpapagian committed Feb 24, 2023
    Configuration menu
    Copy the full SHA
    ceec3cc View commit details
    Browse the repository at this point in the history

  5. Add tests for matchBinaries 

    Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
    @tpapagian
    tpapagian committed Feb 24, 2023
    Configuration menu
    Copy the full SHA
    b5d2ef4 View commit details
    Browse the repository at this point in the history

  6. matchBinaries: Do not match the parent binary 

    Now, if the process binary does not match these that we have in
matchBinaries selector, it will also check the parent binary name.

This is not the desired behaviour and this patch removed that.

Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
    @tpapagian
    tpapagian committed Feb 24, 2023
    Configuration menu
    Copy the full SHA
    eb1a47c View commit details
    Browse the repository at this point in the history

  7. matchBinaries: Skip binary check for long binary names 

    In the case where the binary name is > 255 characters we simply skip the
test. In order to support that we have to filter using data events that
can be a follow-up.

Generally, 255 characters for binary names should be enough in most
cases.

Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
    @tpapagian
    tpapagian committed Feb 24, 2023
    Configuration menu
    Copy the full SHA
    4586261 View commit details
    Browse the repository at this point in the history

  8. Convert max binary size to a define 

    Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>
    @tpapagian
    tpapagian committed Feb 24, 2023
    Configuration menu
    Copy the full SHA
    2fc6811 View commit details
    Browse the repository at this point in the history