Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[CWS] Resolve cgroup context when snapshotting traced_cgroups map #33673

Merged
merged 1 commit into from
Feb 7, 2025
Merged

[CWS] Resolve cgroup context when snapshotting traced_cgroups map #33673

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions pkg/security/ebpf/c/include/structs/activity_dump.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ struct activity_dump_config {
u16 events_rate;
u16 padding;
u32 paused;
u32 cgroup_flags;
};

#endif
4 changes: 3 additions & 1 deletion pkg/security/secl/model/marshallers_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,7 +161,7 @@ func (e *Process) MarshalPidCache(data []byte, bootTime time.Time) (int, error)

// MarshalBinary marshals a binary representation of itself
func (adlc *ActivityDumpLoadConfig) MarshalBinary() ([]byte, error) {
raw := make([]byte, 48)
raw := make([]byte, 56)

var eventMask uint64
for _, evt := range adlc.TracedEventTypes {
Expand All @@ -175,6 +175,8 @@ func (adlc *ActivityDumpLoadConfig) MarshalBinary() ([]byte, error) {
binary.NativeEndian.PutUint16(raw[40:42], adlc.Rate)
binary.NativeEndian.PutUint16(raw[42:44], 0)
binary.NativeEndian.PutUint32(raw[44:48], adlc.Paused)
binary.NativeEndian.PutUint32(raw[48:52], uint32(adlc.CGroupFlags))
binary.NativeEndian.PutUint32(raw[52:56], 0) // padding

return raw, nil
}
Expand Down
1 change: 1 addition & 0 deletions pkg/security/secl/model/model_unix.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -697,6 +697,7 @@ type ActivityDumpLoadConfig struct {
EndTimestampRaw uint64
Rate uint16 // max number of events per sec
Paused uint32
CGroupFlags containerutils.CGroupFlags
}

// NetworkDeviceContext represents the network device context of a network event
Expand Down
6 changes: 4 additions & 2 deletions pkg/security/secl/model/unmarshallers_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1016,7 +1016,7 @@ func (e *CgroupWriteEvent) UnmarshalBinary(data []byte) (int, error) {

// EventUnmarshalBinary unmarshals a binary representation of itself
func (adlc *ActivityDumpLoadConfig) EventUnmarshalBinary(data []byte) (int, error) {
if len(data) < 48 {
if len(data) < 56 {
return 0, ErrNotEnoughData
}

Expand All @@ -1033,7 +1033,9 @@ func (adlc *ActivityDumpLoadConfig) EventUnmarshalBinary(data []byte) (int, erro
adlc.Rate = binary.NativeEndian.Uint16(data[40:42])
// 2 bytes of padding
adlc.Paused = binary.NativeEndian.Uint32(data[44:48])
return 48, nil
adlc.CGroupFlags = containerutils.CGroupFlags(binary.NativeEndian.Uint32(data[48:52]))
// +4 bytes of padding
return 56, nil
}

// UnmarshalBinary unmarshals a binary representation of itself
Expand Down
7 changes: 5 additions & 2 deletions pkg/security/security_profile/dump/activity_dump.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,11 +128,12 @@ type SyscallPolicy struct {
}

// NewActivityDumpLoadConfig returns a new instance of ActivityDumpLoadConfig
func NewActivityDumpLoadConfig(evt []model.EventType, timeout time.Duration, waitListTimeout time.Duration, rate uint16, start time.Time, resolver *stime.Resolver) *model.ActivityDumpLoadConfig {
func NewActivityDumpLoadConfig(evt []model.EventType, timeout time.Duration, waitListTimeout time.Duration, rate uint16, start time.Time, flags containerutils.CGroupFlags, resolver *stime.Resolver) *model.ActivityDumpLoadConfig {
adlc := &model.ActivityDumpLoadConfig{
TracedEventTypes: evt,
Timeout: timeout,
Rate: uint16(rate),
CGroupFlags: flags,
}
if resolver != nil {
adlc.StartTimestampRaw = uint64(resolver.ComputeMonotonicTimestamp(start))
Expand All @@ -158,7 +159,7 @@ func NewEmptyActivityDump(pathsReducer *activity_tree.PathsReducer) *ActivityDum
type WithDumpOption func(ad *ActivityDump)

// NewActivityDump returns a new instance of an ActivityDump
func NewActivityDump(adm *ActivityDumpManager, options ...WithDumpOption) *ActivityDump {
func NewActivityDump(adm *ActivityDumpManager, cgroupFlags containerutils.CGroupFlags, options ...WithDumpOption) *ActivityDump {
ad := NewEmptyActivityDump(adm.pathsReducer)
now := time.Now()
ad.Metadata = mtdt.Metadata{
Expand All @@ -183,6 +184,7 @@ func NewActivityDump(adm *ActivityDumpManager, options ...WithDumpOption) *Activ
adm.config.RuntimeSecurity.ActivityDumpCgroupWaitListTimeout,
adm.config.RuntimeSecurity.ActivityDumpRateLimiter,
now,
cgroupFlags,
adm.resolvers.TimeResolver,
)
ad.LoadConfigCookie = utils.NewCookie()
Expand Down Expand Up @@ -238,6 +240,7 @@ func NewActivityDumpFromMessage(msg *api.ActivityDumpMessage) (*ActivityDump, er
0,
0,
startTime,
0,
nil,
)
ad.DNSNames = utils.NewStringKeys(msg.GetDNSNames())
Expand Down
8 changes: 6 additions & 2 deletions pkg/security/security_profile/dump/load_controller.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,6 +71,7 @@ func (lc *ActivityDumpLoadController) getDefaultLoadConfigs() (map[containerutil
0,
lc.adm.config.RuntimeSecurity.ActivityDumpRateLimiter,
time.Now(),
0, // cgroup flags will be set per cgroup manager
lc.adm.resolvers.TimeResolver,
)
defaults.WaitListTimestampRaw = uint64(lc.adm.config.RuntimeSecurity.ActivityDumpCgroupWaitListTimeout)
Expand All @@ -88,7 +89,9 @@ func (lc *ActivityDumpLoadController) getDefaultLoadConfigs() (map[containerutil
if !found {
return nil, fmt.Errorf("unsupported cgroup manager '%s'", cgroupManager)
}
defaultConfigs[cgroupManager] = defaults
cgroupManagerLoadConfig := *defaults
cgroupManagerLoadConfig.CGroupFlags = containerutils.CGroupFlags(cgroupManager)
defaultConfigs[cgroupManager] = &cgroupManagerLoadConfig
}
lc.activityDumpLoadConfig = defaultConfigs
return defaultConfigs, nil
Expand All @@ -113,7 +116,7 @@ func (lc *ActivityDumpLoadController) PushDefaultCurrentConfigs() error {
// NextPartialDump returns a new dump with the same parameters as the current one, or with reduced load config parameters
// when applicable
func (lc *ActivityDumpLoadController) NextPartialDump(ad *ActivityDump) *ActivityDump {
newDump := NewActivityDump(ad.adm)
newDump := NewActivityDump(ad.adm, ad.LoadConfig.CGroupFlags)
newDump.Metadata.ContainerID = ad.Metadata.ContainerID
newDump.Metadata.CGroupContext = ad.Metadata.CGroupContext
newDump.Metadata.DifferentiateArgs = ad.Metadata.DifferentiateArgs
Expand Down Expand Up @@ -141,6 +144,7 @@ func (lc *ActivityDumpLoadController) NextPartialDump(ad *ActivityDump) *Activit
copy(newDump.LoadConfig.TracedEventTypes, ad.LoadConfig.TracedEventTypes)
newDump.LoadConfig.Rate = ad.LoadConfig.Rate
newDump.LoadConfigCookie = ad.LoadConfigCookie
newDump.LoadConfig.CGroupFlags = ad.LoadConfig.CGroupFlags

if timeToThreshold < lc.minDumpTimeout {
if err := lc.reduceDumpRate(ad, newDump); err != nil {
Expand Down
14 changes: 11 additions & 3 deletions pkg/security/security_profile/dump/manager.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -411,7 +411,7 @@ func (adm *ActivityDumpManager) insertActivityDump(newDump *ActivityDump) error

// handleDefaultDumpRequest starts dumping a new workload with the provided load configuration and the default dump configuration
func (adm *ActivityDumpManager) startDumpWithConfig(containerID containerutils.ContainerID, cgroupContext model.CGroupContext, cookie uint64, loadConfig model.ActivityDumpLoadConfig) error {
newDump := NewActivityDump(adm, func(ad *ActivityDump) {
newDump := NewActivityDump(adm, loadConfig.CGroupFlags, func(ad *ActivityDump) {
ad.Metadata.ContainerID = containerID
ad.Metadata.CGroupContext = cgroupContext
ad.SetLoadConfig(cookie, loadConfig)
Expand Down Expand Up @@ -576,7 +576,7 @@ func (adm *ActivityDumpManager) DumpActivity(params *api.ActivityDumpParams) (*a
params.Storage.LocalStorageDirectory = adm.config.RuntimeSecurity.ActivityDumpLocalStorageDirectory
}

newDump := NewActivityDump(adm, func(ad *ActivityDump) {
newDump := NewActivityDump(adm, 0, func(ad *ActivityDump) {
ad.Metadata.ContainerID = containerutils.ContainerID(params.GetContainerID())
ad.Metadata.CGroupContext.CGroupID = containerutils.CGroupID(params.GetCGroupID())

Expand Down Expand Up @@ -771,7 +771,7 @@ func (pces *processCacheEntrySearcher) SearchTracedProcessCacheEntry(entry *mode
func (adm *ActivityDumpManager) TranscodingRequest(params *api.TranscodingRequestParams) (*api.TranscodingRequestMessage, error) {
adm.Lock()
defer adm.Unlock()
ad := NewActivityDump(adm)
ad := NewActivityDump(adm, 0)

// open and parse input file
if err := ad.Decode(params.GetActivityDumpFile()); err != nil {
Expand Down Expand Up @@ -860,6 +860,14 @@ func (adm *ActivityDumpManager) SnapshotTracedCgroups() {
continue
}

cgroupContext, err := adm.resolvers.ResolveCGroupContext(cgroupFile, event.Config.CGroupFlags)
if err != nil {
seclog.Warnf("couldn't resolve cgroup context for (%v): %v", cgroupFile, err)
continue
}

event.CGroupContext = *cgroupContext

adm.HandleCGroupTracingEvent(&event)
}

Expand Down
2 changes: 1 addition & 1 deletion pkg/security/tests/module_tester_linux.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1215,7 +1215,7 @@ func (tm *testModule) DecodeActivityDump(path string) (*dump.ActivityDump, error
return nil, errors.New("No activity dump manager")
}

ad := dump.NewActivityDump(adm)
ad := dump.NewActivityDump(adm, 0)
if ad == nil {
return nil, errors.New("Creation of new activity dump fails")
}
Expand Down
Loading