tetragon: Add support for multi kprobe override #1218
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
olsajiri
force-pushed
the
multi_kprobe_override
branch
4 times, most recently
from
a028c22
to
d0f9e19
Compare
olsajiri
force-pushed
the
multi_kprobe_override
branch
from
d0f9e19
to
804288b
Compare
olsajiri
changed the title
olsajiri
force-pushed
the
multi_kprobe_override
branch
3 times, most recently
from
57ab859
to
26d2862
Compare
tpapagian
approved these changes
Jul 27, 2023
In case the override helper is not supported we can get verifier failure when loading kprobe multi object. Adding the code to skip the loading of override program the same way we do for normal kprobes. Fixes: 840b12d ("tetragon: Move override setup into kprobe open/attach functions") Signed-off-by: Jiri Olsa <[email protected]>
We will need to load override program with kprobe.multi interface in following changes. Signed-off-by: Jiri Olsa <[email protected]>
Adding support to load override helper for kprobe.multi attached kprobes. Signed-off-by: Jiri Olsa <[email protected]>
Adding override support for kprobes attached with kprobe.multi interface. Signed-off-by: Jiri Olsa <[email protected]>
Let's use multi object even for single kprobe, the kprobe-multi interface should be faster than generic kprobe attach. Signed-off-by: Jiri Olsa <[email protected]>
Adding verbose out about call being overridden for both
single and multi kprobes, like:
logcapture.go:25: time="2023-07-25T12:22:44Z" level=info msg="Added multi kprobe" function=__x64_sys_openat override=true return=true
logcapture.go:25: time="2023-07-25T12:22:44Z" level=info msg="Added multi kprobe" function=__x64_sys_linkat override=true return=false
logcapture.go:25: time="2023-07-25T12:22:44Z" level=info msg="Added multi kprobe" function=__x64_sys_symlinkat override=true return=false
logcapture.go:25: time="2023-07-25T12:22:44Z" level=info msg="Added multi kprobe" function=__x64_sys_renameat override=false return=false
Signed-off-by: Jiri Olsa <[email protected]>
Add override test for multiple kprobes to verify the kprobe multi interface handles override properly. The test hooks on 4 syscalls and override 3 of them. sys_openat override with -1 sys_linkat override with -2 sys_symlinkat override with -3 sys_renameat no override Signed-off-by: Jiri Olsa <[email protected]>
olsajiri
force-pushed
the
multi_kprobe_override
branch
from
26d2862
to
0e3cc8b
Compare
kkourt
approved these changes
Jul 27, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adding support to load override helper for kprobe.multi attached
kprobes.