bpf: fix missed linux_binprm_type in selector_arg_offset function

[anfedotoff]

It's seems to me, that case linux_binprm_type: in selector_arg_offset function is missing. security_bprm_check.yaml from examples doesn't work.

[netlify]

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	adff394
🔍 Latest deploy log	https://app.netlify.com/sites/tetragon/deploys/6685126cbe908a000879af4d
😎 Deploy Preview	https://deploy-preview-2623--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[kevsecurity]

LGTM

[kkourt]

There is a test failure, which seems related:

FAIL: TestLinuxBinprmExtractPath (1.12s)

[kevsecurity]

Need to work out why the ARM test is failing.

[anfedotoff]

Yes, I'll look at failing tests.

[kevsecurity]

Yes, I'll look at failing tests.

It might be that the tests themselves are broken.

[mtardy]

Yep it seems test itself is broken:

tetragon/pkg/sensors/tracing/kprobe_test.go

Lines 6029 to 6031 in e44f7df

	MatchArgs: []v1alpha1.ArgSelector{
	{
	Operator: "In",

It should be "Equal", "In" does not exist for matchArgs.

It bypasses validation since it doesn't pass YAML unmarshalling.

I just tried changing the exec command and the test passes all the time, it needs a fix! I'm writing something.

[mtardy]

@anfedotoff I have a patch for the test that actually fails without your patch and succeeds with your patch (which should have been what happened previously), is it okay if I push to your branch?

[mtardy]

@anfedotoff I have a patch for the test that actually fails without your patch and succeeds with your patch (which should have been what happened previously), is it okay if I push to your branch?

I created #2624 so that I can run the tests from there. We can merge like this with your commit authored to you. Or I can merge the fix of the test and then we fix your patch, however you prefer.

[anfedotoff]

@anfedotoff I have a patch for the test that actually fails without your patch and succeeds with your patch (which should have been what happened previously), is it okay if I push to your branch?

Thanks, yes, sure!

[anfedotoff]

@anfedotoff I have a patch for the test that actually fails without your patch and succeeds with your patch (which should have been what happened previously), is it okay if I push to your branch?

I created #2624 so that I can run the tests from there. We can merge like this with your commit authored to you. Or I can merge the fix of the test and then we fix your patch, however you prefer.

I think, the easiest way is to merge your PR with my commit and your test fix.

[mtardy]

@anfedotoff I have a patch for the test that actually fails without your patch and succeeds with your patch (which should have been what happened previously), is it okay if I push to your branch?

I created #2624 so that I can run the tests from there. We can merge like this with your commit authored to you. Or I can merge the fix of the test and then we fix your patch, however you prefer.

I think, the easiest way is to merge your PR with my commit and your test fix.

Ok we can do that, then given your patch, my test failed on 4.19 since it doesn't have large progs. If it's expected we should just skip this test!

[anfedotoff]

@anfedotoff I have a patch for the test that actually fails without your patch and succeeds with your patch (which should have been what happened previously), is it okay if I push to your branch?

I created #2624 so that I can run the tests from there. We can merge like this with your commit authored to you. Or I can merge the fix of the test and then we fix your patch, however you prefer.

I think, the easiest way is to merge your PR with my commit and your test fix.

Ok we can do that, then given your patch, my test failed on 4.19 since it doesn't have large progs. If it's expected we should just skip this test!

Yes, I think it is expected. We use large progs to copy args of this type, if I'm not mistaken.

[kevsecurity]

Hmm, why's it failing some tests on bpf-next?

[anfedotoff]

Hmm, why's it failing some tests on bpf-next?

It seems to me, that changes it the PR don't influence on this test. I rebased this branch on current main, let's look at the tests.

[mtardy]

Thanks! I think the fix is complete now :)