new(libsinsp,libscap): Support full argument retrieval on both entry and exit for some syscalls #235
Conversation
… and exit for some syscalls Signed-off-by: Luca Guerra <luca@guerra.sh> Co-authored-by: Lorenzo Susini <susinilorenzo1@gmail.com>
poiana
added
release-note
kind/feature
|
Hi @LucaGuerra. Thanks for your PR. I'm waiting for a falcosecurity member to verify that this patch is reasonable to test. If it is, they should reply with Once the patch is verified, the new status will be reflected by the I understand the commands that are listed here. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
Hi! Thanks for this huge PR!! 🚀 |
|
LGTM label has been added. Git tree hash: b8e4cb4b384a1e4e98dfc9aba448d43d73068b57
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: FedeDP, LucaGuerra The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
What type of PR is this?
/kind feature
Any specific area of the project related to this PR?
/area driver-kmod
/area driver-ebpf
/area libscap
/area libsinsp
What this PR does / why we need it:
This PR adds support in the Falco libraries to allow the kernel module to retrieve userspace buffers on both entry and exit events for the following syscalls: connect, open, openat, openat2 and creat. Relevant changes are ported to the kernel module, eBPF probe and udig accordingly.
Currently, the Falco libraries read the arguments, especially userspace buffers, for those system calls at exit time, but there is no guarantee that those buffers will still be available and unchanged since the syscall started.
With this patch, when both entry and exit events are retrieved, libsinsp is then able to deal with the potential differences so that fd.name/fd.sip/etc are correct and rules are processed properly even if any modification to userspace memory happened in the meantime.
Performance Evaluation:
Experiments were performed by comparing performance at f05aaec and with this patch. To do so, we ran https://github.com/falcosecurity/event-generator with options ./event-generator bench "syscall.ReadSensitiveFileUntrusted" against Falco with both versions of the Falco libs.
The selected test (syscall.ReadSensitiveFileUntrusted) exercises the open() family of syscalls which is involved in this patch. On our cloud instances, both versions started dropping events between 19000 and 20000 events per second, with no significant difference between the two.
Which issue(s) this PR fixes:
Fixes #
Special notes for your reviewer:
Does this PR introduce a user-facing change?: