new: Support for memfd_create syscall by Rohith-Raju · Pull Request #1127 · falcosecurity/libs

Rohith-Raju · 2023-05-31T05:22:49Z

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area driver-kmod
/area driver-bpf
/area driver-modern-bpf
/area libscap
/area tests

Does this PR require a change in the driver versions?
/version driver-SCHEMA-version-minor

What this PR does / why we need it:

This PR adds support to memfd_create syscall

[UMBRELLA] Missing syscalls falco#1998

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

new: support for memfd_syscall

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

poiana · 2023-05-31T05:22:58Z

Welcome @Rohith-Raju! It looks like this is your first PR to falcosecurity/libs 🎉

github-actions · 2023-05-31T05:23:10Z

Please double check driver/SCHEMA_VERSION file. See versioning.

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

FedeDP · 2023-05-31T07:06:25Z

Thank you for this PR! Since we are in feature freeze for the next libs tag (for Falco 0.35), i will put this in the next milestone.
/milestone next-driver

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

Andreagit97

Left a first pass of comments, amazing job, thank you!

jasondellaluce · 2023-06-12T14:18:55Z

TODO for ourselves: either here or in another PR we should update parsers.cpp to account for this new syscall and extract+update the fd name & flags.

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

Rohith-Raju · 2023-06-14T07:08:33Z

@Andreagit97 @hbrueckner @jasondellaluce, SyscallExit.memfd_createX_success fails only for moderbpf. Double checked memfd_create.bpf.c file. Am i missing something ?
https://app.circleci.com/pipelines/github/falcosecurity/libs/1229/workflows/c92b34f7-5f53-4f0b-a002-fda7b72aaa0d/jobs/3412?invite=true#step-105-188

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

Andreagit97 · 2023-06-14T14:51:28Z

ok so probably we need 2 fixes:

we need #include <uapi/linux/memfd.h> but with an ifdef so:

#ifdef __NR_io_memfd_create
#include <uapi/linux/memfd.h>
#endif

This one new: Support for memfd_create syscall #1127 (comment)

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

Rohith-Raju · 2023-06-14T15:44:44Z

ok so probably we need 2 fixes:

we need #include <uapi/linux/memfd.h> but with an ifdef so:
#ifdef __NR_io_memfd_create
#include <uapi/linux/memfd.h>
#endif

@Andreagit97 I tried doing this, same weird problem mentioned above, either way, let me give it a try!!
#1127 (comment)

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

Rohith-Raju · 2023-06-14T16:55:07Z

@Andreagit97 So here is what's happening:

we need #include <uapi/linux/memfd.h> but with an ifdef so:
#ifdef __NR_io_memfd_create
#include <uapi/linux/memfd.h>
#endif

If we do this our tests will fail (current patch) : https://app.circleci.com/pipelines/github/falcosecurity/libs/1233/workflows/80868ad6-6b6e-4e2c-b09d-c27379843619/jobs/3425?invite=true#step-105-221

if we just include <uapi/linux/memfd.h> without the macros

#include <uapi/linux/memfd.h>

Our tests won't fail anymore. But the build-drivers workflow will fail.
https://github.com/falcosecurity/libs/actions/runs/5269263474/jobs/9527576287#step:3:105

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

Andreagit97

with this patch all should work fine, i'm just trying it locally to understand why we need the uapi prefix

Andreagit97 · 2023-06-15T09:26:32Z

uhh I got it, the actual header in /usr/include/linux/memfd.h is shadowed by /usr/src/linux-hwe-5.19-headers-5.19.0-43/include/linux/memfd.h (on my distro of course) and the second header file doesn't include any flag definition, ok so we can use <uapi/linux/memfd.h>!
After the ifdef fix we should be ready to go 🎉

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

FedeDP

/approve

poiana · 2023-06-15T10:27:12Z

LGTM label has been added.

Details

Git tree hash: c67e33b791d5b97c5332f450316265c96c161656

Andreagit97

/approve

poiana · 2023-06-15T10:33:09Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, Rohith-Raju

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [Andreagit97,FedeDP]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

FedeDP · 2023-07-28T13:01:34Z

/milestone 5.1.0+driver

Introduce memfd_create syscall

39e352b

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

poiana added area/tests release-note dco-signoff: yes labels May 31, 2023

poiana added the size/L label May 31, 2023

poiana requested review from LucaGuerra and hbrueckner May 31, 2023 05:23

updated driver syscall readme

93d51b9

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

poiana added size/XL and removed size/L labels May 31, 2023

poiana added this to the next-driver milestone May 31, 2023

Correct failing tests

3c9f40a

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

Andreagit97 modified the milestones: next-driver, driver-backlog Jun 7, 2023

Andreagit97 reviewed Jun 12, 2023

View reviewed changes

Andreagit97 modified the milestones: driver-backlog, next-driver Jun 12, 2023

hbrueckner reviewed Jun 12, 2023

View reviewed changes

Comment thread driver/bpf/fillers.h Outdated

changes as per review requests

09e1c5f

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

Rohith-Raju requested review from Andreagit97 and hbrueckner June 14, 2023 07:09

Rohith-Raju commented Jun 14, 2023

View reviewed changes

Comment thread driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/memfd_create.bpf.c

Andreagit97 reviewed Jun 14, 2023

View reviewed changes

Comment thread driver/ppm_flag_helpers.h Outdated

Comment thread driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/memfd_create.bpf.c

Andreagit97 mentioned this pull request Jun 14, 2023

[UMBRELLA] Missing syscalls falcosecurity/falco#1998

Closed

35 tasks

added missing definations for modern bpf

2616189

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

changed memfd header to use user-api

334fa61

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

Andreagit97 reviewed Jun 14, 2023

View reviewed changes

Comment thread driver/event_table.c Outdated

Andreagit97 mentioned this pull request Jun 14, 2023

Feat: Support for pidfd_getfd syscall #1145

Merged

changes as per review request

b1a0156

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

Rohith-Raju changed the title ~~Feat: Support for memfd_create syscall~~ New: Support for memfd_create syscall Jun 14, 2023

Rohith-Raju changed the title ~~New: Support for memfd_create syscall~~ new: Support for memfd_create syscall Jun 14, 2023

Rohith-Raju requested a review from Andreagit97 June 14, 2023 15:47

Rohith-Raju added 2 commits June 14, 2023 16:13

address review request changes

2add3cf

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

address review requests

f97b67d

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

event-table changes

54cb7bf

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

Andreagit97 reviewed Jun 15, 2023

View reviewed changes

Comment thread driver/ppm_flag_helpers.h Outdated

Address review requests

4c0554d

Signed-off-by: Rohith Raju <rohithraju488@gmail.com>

FedeDP approved these changes Jun 15, 2023

View reviewed changes

poiana assigned FedeDP Jun 15, 2023

poiana added the lgtm label Jun 15, 2023

poiana added the approved label Jun 15, 2023

Andreagit97 approved these changes Jun 15, 2023

View reviewed changes

poiana assigned Andreagit97 Jun 15, 2023

poiana merged commit 3c39e79 into falcosecurity:master Jun 15, 2023

Rohith-Raju mentioned this pull request Jun 23, 2023

update(parsers): Support userspace parsers for memfd_create syscall. #1162

Merged

poiana modified the milestones: next-driver, 5.1.0+driver Jul 28, 2023

Rohith-Raju deleted the memfd-create branch July 31, 2023 06:31

Uh oh!

Conversation

Rohith-Raju commented May 31, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

poiana commented May 31, 2023

Uh oh!

github-actions Bot commented May 31, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

FedeDP commented May 31, 2023

Uh oh!

Andreagit97 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jasondellaluce commented Jun 12, 2023

Uh oh!

Uh oh!

Rohith-Raju commented Jun 14, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Andreagit97 commented Jun 14, 2023

Uh oh!

Rohith-Raju commented Jun 14, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Rohith-Raju commented Jun 14, 2023

Uh oh!

Andreagit97 left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Andreagit97 commented Jun 15, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

FedeDP left a comment

Choose a reason for hiding this comment

Uh oh!

poiana commented Jun 15, 2023

Uh oh!

Andreagit97 left a comment

Choose a reason for hiding this comment

Uh oh!

poiana commented Jun 15, 2023

Uh oh!

FedeDP commented Jul 28, 2023

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Rohith-Raju commented May 31, 2023 •

edited

Loading

github-actions Bot commented May 31, 2023 •

edited

Loading

Rohith-Raju commented Jun 14, 2023 •

edited

Loading

Andreagit97 left a comment •

edited

Loading

Andreagit97 commented Jun 15, 2023 •

edited

Loading