tetragon: Add support to store return action

Signed-off-by: Jiri Olsa <[email protected]>
cilium · Nov 29, 2023 · eb1552a · eb1552a
1 parent d7068ac
commit eb1552a
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 0 deletions.
diff --git a/pkg/grpc/tracing/tracing.go b/pkg/grpc/tracing/tracing.go
@@ -302,6 +302,7 @@ func GetProcessKprobe(event *MsgGenericKprobeUnix) *tetragon.ProcessKprobe {
 		Args:         tetragonArgs,
 		Return:       tetragonReturnArg,
 		Action:       kprobeAction(event.Action),
+		ReturnAction: kprobeAction(event.ReturnAction),
 		StackTrace:   stackTrace,
 		PolicyName:   event.PolicyName,
 	}
@@ -470,6 +471,7 @@ type MsgGenericKprobeUnix struct {
 	Capabilities processapi.MsgCapabilities
 	Id           uint64
 	Action       uint64
+	ReturnAction uint64
 	Tid          uint32
 	FuncName     string
 	Args         []tracingapi.MsgGenericKprobeArg

diff --git a/pkg/sensors/tracing/generickprobe.go b/pkg/sensors/tracing/generickprobe.go
@@ -1656,6 +1656,7 @@ func retprobeMerge(prev pendingEvent, curr pendingEvent) *tracing.MsgGenericKpro
 			enterEv.Args = append(enterEv.Args, retArg)
 		}
 	}
+	enterEv.ReturnAction = retEv.Action
 	return enterEv
 }
-Original file line number
+Diff line change
@@ Expand Up @@
     			enterEv.Args = append(enterEv.Args, retArg)
     		}
     	}
+    	enterEv.ReturnAction = retEv.Action
     	return enterEv
     }
@@ Expand Down @@