Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Initial userspace instrumentation implementation #1195

Merged
merged 8 commits into from
Jul 15, 2020
Merged

Initial userspace instrumentation implementation #1195

Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
6f153d7
feat(cli): adding -u to flip inspector method calls
ldegio Mar 15, 2020
0e15e8d
feat(build): fixing MD5 of tpp for udig/pdig build
krisnova May 6, 2020
f75b5d4
feat(cli): adding -u to the usage text
krisnova May 6, 2020
7b38f78
update(userspace/falco): edits to the falco CLI
krisnova Jul 13, 2020
358ca11
update(userspace/falco): userspace instrumentation help line
leodido Jul 14, 2020
4f431b4
chore: onetbb dependency is back
leodido Jul 14, 2020
9c44e4d
fix(userspace/falco): try to insert kernel module driver conditionally
leodido Jul 14, 2020
20c7b71
fix(userspace): rethrow inspector open exceptions
fntlnz Jul 15, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 30 additions & 7 deletions userspace/falco/falco.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -158,6 +158,8 @@ static void usage()
" This causes every single line emitted by falco to be flushed,\n"
" which generates higher CPU usage but is useful when piping those outputs\n"
" into another process or into a script.\n"
" -u, --userspace Parse events from userspace.\n"
" To be used in conjunction with the ptrace(2) based driver (pdig).\n"
" -V, --validate <rules_file> Read the contents of the specified rules(s) file and exit.\n"
" Can be specified multiple times to validate multiple files.\n"
" -v Verbose output.\n"
Expand Down Expand Up @@ -443,6 +445,7 @@ int falco_init(int argc, char **argv)
set<string> disable_sources;
bool disable_syscall = false;
bool disable_k8s_audit = false;
bool userspace = false;

// Used for writing trace files
int duration_seconds = 0;
Expand Down Expand Up @@ -482,6 +485,7 @@ int falco_init(int argc, char **argv)
{"stats-interval", required_argument, 0},
{"support", no_argument, 0},
{"unbuffered", no_argument, 0, 'U'},
{"userspace", no_argument, 0, 'u'},
{"validate", required_argument, 0, 'V'},
{"version", no_argument, 0, 0},
{"writefile", required_argument, 0, 'w'},
Expand All @@ -500,7 +504,7 @@ int falco_init(int argc, char **argv)
// Parse the args
//
while((op = getopt_long(argc, argv,
"hc:AbdD:e:F:ik:K:Ll:m:M:No:P:p:r:S:s:T:t:UvV:w:",
"hc:AbdD:e:F:ik:K:Ll:m:M:No:P:p:r:S:s:T:t:UuvV:w:",
long_options, &long_index)) != -1)
{
switch(op)
Expand Down Expand Up @@ -607,6 +611,9 @@ int falco_init(int argc, char **argv)
buffered_outputs = false;
buffered_cmdline = true;
break;
case 'u':
userspace = true;
break;
case 'v':
verbose = true;
break;
Expand Down Expand Up @@ -1091,7 +1098,17 @@ int falco_init(int argc, char **argv)
}
else
{
open_t open_cb = [](sinsp* inspector) {
open_t open_cb = [&userspace](sinsp* inspector)
{
if(userspace)
{
// open_udig() is the underlying method used in the capture code to parse userspace events from the kernel.
//
// Falco uses a ptrace(2) based userspace implementation.
// Regardless of the implementation, the underlying method remains the same.
inspector->open_udig();
return;
}
inspector->open();
};
open_t open_nodriver_cb = [](sinsp* inspector) {
Expand All @@ -1116,11 +1133,17 @@ int falco_init(int argc, char **argv)
}
catch(sinsp_exception &e)
{
if(system("modprobe " PROBE_NAME " > /dev/null 2> /dev/null"))
// If syscall input source is enabled and not through userspace instrumentation
if (!disable_syscall && !userspace)
{
falco_logger::log(LOG_ERR, "Unable to load the driver. Exiting.\n");
// Try to insert the Falco kernel module
if(system("modprobe " PROBE_NAME " > /dev/null 2> /dev/null"))
{
falco_logger::log(LOG_ERR, "Unable to load the driver. Exiting.\n");
}
open_f(inspector);
}
open_f(inspector);
rethrow_exception(current_exception());
}
}

Expand All @@ -1139,7 +1162,7 @@ int falco_init(int argc, char **argv)
duration = ((double)clock()) / CLOCKS_PER_SEC;

//
// run k8s, if required
// Run k8s, if required
//
if(k8s_api)
{
Expand Down Expand Up @@ -1178,7 +1201,7 @@ int falco_init(int argc, char **argv)
}

//
// run mesos, if required
// Run mesos, if required
//
if(mesos_api)
{
Expand Down