fix: handle core dumped signals for process exit

The ProcessExit event returns a signal that the process received when it exited. However, core dumped signals (SIGSEGV, SIGILL, etc.) are not returned. This patch fixes the issue by checking if the process exit code has the core dump bit set (7th bit, 0x80), and returns the correct signal. Signed-off-by: Justin Chen <[email protected]>
cilium · Oct 28, 2024 · 7b04416 · 7b04416
1 parent ba06bb9
commit 7b04416
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/pkg/grpc/exec/exec.go b/pkg/grpc/exec/exec.go
@@ -351,6 +351,11 @@ func GetProcessExit(event *MsgExitEventUnix) *tetragon.ProcessExit {
 	code := event.Info.Code >> 8
 	signal := readerexec.Signal(event.Info.Code & 0xFF)
 
+	if event.Info.Code&0x80 != 0 {
+		// Core dumped
+		signal = readerexec.Signal(event.Info.Code & 0x7F)
+	}
+
 	// Per thread tracking rules PID == TID.
 	//
 	// Exit events should have TID==PID at same time we want to correlate