tetragon: Use execve_map_get_noinit cgroup related code #984
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
olsajiri
force-pushed
the
execve_map_fixes
branch
from
a93474b
to
ddc16ce
Compare
olsajiri
changed the title
Recent hunt for execve_map leak showed few places that use execve_map_get instead of execve_map_get_noinit. Even though it did not turn out to be the source of the leak, we should use execve_map_get_noinit calls. The execve_map_get is used only by fork sensor to create the stat record. Signed-off-by: Jiri Olsa <jolsa@kernel.org>
olsajiri
force-pushed
the
execve_map_fixes
branch
from
ddc16ce
to
78adfec
Compare
✅ Deploy Preview for tetragon ready!
To edit notification comments on pull requests, go to your Netlify site settings. |
tixxdz
approved these changes
May 15, 2023
There was a problem hiding this comment.
Thank you @olsajiri !
I wonder if we could somehow compute the entries from /proc at startup they are pushed to bpf, so use the all value of execve_map_stats then with execve event, then correlate this with user space process cache
Seems we don't decrement the execve_map_stats counter on process exit ?! anyway not related here
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
hunt for execve_map leak showed few places that use
execve_map_get instead of execve_map_get_noinit.
Even though it did not turn out to be the source of the leak,
we should use execve_map_get_noinit calls.
The execve_map_get is used only by fork sensor to create the
stat record.