Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tetragon: Move return filter to kernel #1773

Merged
merged 14 commits into from
Dec 14, 2023
Merged

tetragon: Move return filter to kernel #1773

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
14 commits
Select commit Hold shift + click to select a range
9a0156d
tetragon: Fix detectOverrideHelper/detectSignalHelper cleanup path
olsajiri Dec 8, 2023
8408375
tetragon: Add kprobeSelectors struct
olsajiri Nov 15, 2023
cb6bb7c
tetragon: Add MatchReturnActions to selector
olsajiri Nov 21, 2023
a74b6df
tetragon: Add InitKernelReturnSelectorState function
olsajiri Nov 17, 2023
524d02f
tetragon: Create and load return selector
olsajiri Nov 15, 2023
e8b995e
tetragon: Add test for return selector
olsajiri Nov 15, 2023
b4e099f
tetragon: Add support for filter in return kprobe object
olsajiri Nov 16, 2023
09d8cec
tetragon: Remove user space return filter
olsajiri Nov 17, 2023
d6ab9c2
tetragon: Add return kprobe action field
olsajiri Nov 21, 2023
3e5bc23
tetragon: Add support to store return action
olsajiri Nov 21, 2023
a56f9d6
tetragon: Move TestKprobeSigkill functionality to testSigkill function
olsajiri Dec 4, 2023
2d40cf5
tetragon: Add sigkill return action test
olsajiri Dec 4, 2023
a8bde06
tetragon: Add docs for return actions
olsajiri Dec 4, 2023
8a07d09
tetragon: Add missing signal helper checks to killer tests
olsajiri Dec 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions api/v1/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -792,6 +792,7 @@ https://github.com/opencontainers/runtime-spec/blob/main/config.md#createcontain
| action | [KprobeAction](#tetragon-KprobeAction) | | Action performed when the kprobe matched. |
| stack_trace | [StackTraceEntry](#tetragon-StackTraceEntry) | repeated | Kernel stack trace to the call. |
| policy_name | [string](#string) | | Name of the Tracing Policy that created that kprobe. |
| return_action | [KprobeAction](#tetragon-KprobeAction) | | Action performed when the return kprobe executed. |



Expand Down
14 changes: 14 additions & 0 deletions api/v1/tetragon/codegen/eventchecker/eventchecker.pb.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

362 changes: 188 additions & 174 deletions api/v1/tetragon/tetragon.pb.go
View file
Open in desktop

Large diffs are not rendered by default.

2 changes: 2 additions & 0 deletions api/v1/tetragon/tetragon.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -425,6 +425,8 @@ message ProcessKprobe {
repeated StackTraceEntry stack_trace = 7;
// Name of the Tracing Policy that created that kprobe.
string policy_name = 8;
// Action performed when the return kprobe executed.
KprobeAction return_action = 9;
}

message ProcessTracepoint {
Expand Down
3 changes: 2 additions & 1 deletion bpf/process/bpf_generic_kprobe.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -202,7 +202,8 @@ generic_kprobe_filter_arg(void *ctx)
return filter_read_arg(ctx, (struct bpf_map_def *)&process_call_heap,
(struct bpf_map_def *)&filter_map,
(struct bpf_map_def *)&kprobe_calls,
(struct bpf_map_def *)&config_map);
(struct bpf_map_def *)&config_map,
true);
}

__attribute__((section("kprobe/4"), used)) int
Expand Down
36 changes: 33 additions & 3 deletions bpf/process/bpf_generic_retkprobe.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,11 +25,22 @@ struct {

struct {
__uint(type, BPF_MAP_TYPE_PROG_ARRAY);
__uint(max_entries, 1);
__uint(max_entries, 6);
__uint(key_size, sizeof(__u32));
__uint(value_size, sizeof(__u32));
} retkprobe_calls SEC(".maps");

struct filter_map_value {
unsigned char buf[FILTER_SIZE];
};

struct {
__uint(type, BPF_MAP_TYPE_ARRAY);
__uint(max_entries, 1);
__type(key, int);
__type(value, struct filter_map_value);
} filter_map SEC(".maps");

struct {
__uint(type, BPF_MAP_TYPE_ARRAY);
__uint(max_entries, 1);
Expand Down Expand Up @@ -149,11 +160,30 @@ BPF_KRETPROBE(generic_retkprobe_event, unsigned long ret)
e->func_id = config->func_id;
e->common.size = size;

tail_call(ctx, &retkprobe_calls, 0);
tail_call(ctx, &retkprobe_calls, TAIL_CALL_ARGS);
return 1;
}

__attribute__((section("kprobe/0"), used)) int
__attribute__((section("kprobe/3"), used)) int
BPF_KRETPROBE(generic_retkprobe_filter_arg)
{
return filter_read_arg(ctx, (struct bpf_map_def *)&process_call_heap,
(struct bpf_map_def *)&filter_map,
(struct bpf_map_def *)&retkprobe_calls,
(struct bpf_map_def *)&config_map,
false);
}

__attribute__((section("kprobe/4"), used)) int
BPF_KRETPROBE(generic_retkprobe_actions)
{
return generic_actions(ctx, (struct bpf_map_def *)&process_call_heap,
(struct bpf_map_def *)&filter_map,
(struct bpf_map_def *)&retkprobe_calls,
NULL);
}

__attribute__((section("kprobe/5"), used)) int
BPF_KRETPROBE(generic_retkprobe_output)
{
return generic_output(ctx, (struct bpf_map_def *)&process_call_heap, MSG_OP_GENERIC_KPROBE);
Expand Down
3 changes: 2 additions & 1 deletion bpf/process/bpf_generic_tracepoint.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -237,7 +237,8 @@ generic_tracepoint_arg(void *ctx)
return filter_read_arg(ctx, (struct bpf_map_def *)&tp_heap,
(struct bpf_map_def *)&filter_map,
(struct bpf_map_def *)&tp_calls,
(struct bpf_map_def *)&config_map);
(struct bpf_map_def *)&config_map,
true);
}

__attribute__((section("tracepoint/4"), used)) int
Expand Down
3 changes: 2 additions & 1 deletion bpf/process/bpf_generic_uprobe.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,7 +145,8 @@ generic_uprobe_filter_arg(void *ctx)
return filter_read_arg(ctx, (struct bpf_map_def *)&process_call_heap,
(struct bpf_map_def *)&filter_map,
(struct bpf_map_def *)&uprobe_calls,
(struct bpf_map_def *)&config_map);
(struct bpf_map_def *)&config_map,
true);
}

__attribute__((section("uprobe/4"), used)) int
Expand Down
41 changes: 23 additions & 18 deletions bpf/process/types/basic.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1606,7 +1606,7 @@ generic_process_filter_binary(struct event_config *config)

static inline __attribute__((always_inline)) int
selector_arg_offset(__u8 *f, struct msg_generic_kprobe *e, __u32 selidx,
bool early_binary_filter)
bool early_binary_filter, bool is_entry)
{
struct selector_arg_filters *filters;
struct selector_arg_filter *filter;
Expand All @@ -1622,20 +1622,24 @@ selector_arg_offset(__u8 *f, struct msg_generic_kprobe *e, __u32 selidx,

/* skip the selector size field */
seloff += 4;
/* skip the matchPids section by reading its length */
seloff += *(__u32 *)((__u64)f + (seloff & INDEX_MASK));
/* skip the matchNamespaces section by reading its length*/
seloff += *(__u32 *)((__u64)f + (seloff & INDEX_MASK));
/* skip matchCapabilitiess section by reading its length */
seloff += *(__u32 *)((__u64)f + (seloff & INDEX_MASK));
/* skip the matchNamespaceChanges by reading its length */
seloff += *(__u32 *)((__u64)f + (seloff & INDEX_MASK));
/* skip the matchCapabilityChanges by reading its length */
seloff += *(__u32 *)((__u64)f + (seloff & INDEX_MASK));

// check for match binary actions
if (!early_binary_filter && !match_binaries(selidx))
return 0;
/* skip selectors defined only for entry probe */
if (is_entry) {
/* skip the matchPids section by reading its length */
seloff += *(__u32 *)((__u64)f + (seloff & INDEX_MASK));
/* skip the matchNamespaces section by reading its length*/
seloff += *(__u32 *)((__u64)f + (seloff & INDEX_MASK));
/* skip matchCapabilitiess section by reading its length */
seloff += *(__u32 *)((__u64)f + (seloff & INDEX_MASK));
/* skip the matchNamespaceChanges by reading its length */
seloff += *(__u32 *)((__u64)f + (seloff & INDEX_MASK));
/* skip the matchCapabilityChanges by reading its length */
seloff += *(__u32 *)((__u64)f + (seloff & INDEX_MASK));

// check for match binary actions
if (!early_binary_filter && !match_binaries(selidx))
return 0;
}

/* Making binary selectors fixes size helps on some kernels */
seloff &= INDEX_MASK;
Expand Down Expand Up @@ -1720,7 +1724,7 @@ static inline __attribute__((always_inline)) int filter_args_reject(u64 id)

static inline __attribute__((always_inline)) int
filter_args(struct msg_generic_kprobe *e, int index, void *filter_map,
bool early_binary_filter)
bool early_binary_filter, bool is_entry)
{
__u8 *f;

Expand All @@ -1742,7 +1746,7 @@ filter_args(struct msg_generic_kprobe *e, int index, void *filter_map,
return filter_args_reject(e->func_id);

if (e->sel.active[index]) {
int pass = selector_arg_offset(f, e, index, early_binary_filter);
int pass = selector_arg_offset(f, e, index, early_binary_filter, is_entry);
if (pass)
return pass;
}
Expand Down Expand Up @@ -2213,7 +2217,7 @@ do_actions(void *ctx, struct msg_generic_kprobe *e, struct selector_action *acti
static inline __attribute__((always_inline)) long
filter_read_arg(void *ctx, struct bpf_map_def *heap,
struct bpf_map_def *filter, struct bpf_map_def *tailcalls,
struct bpf_map_def *config_map)
struct bpf_map_def *config_map, bool is_entry)
{
struct msg_generic_kprobe *e;
struct event_config *config;
Expand All @@ -2226,7 +2230,8 @@ filter_read_arg(void *ctx, struct bpf_map_def *heap,
if (!config)
return 0;
index = e->filter_tailcall_index;
pass = filter_args(e, index & MAX_SELECTORS_MASK, filter, config->flags & FLAGS_EARLY_FILTER);
pass = filter_args(e, index & MAX_SELECTORS_MASK, filter,
config->flags & FLAGS_EARLY_FILTER, is_entry);
if (!pass) {
index++;
if (index <= MAX_SELECTORS && e->sel.active[index & MAX_SELECTORS_MASK]) {
Expand Down
Loading
Loading