Lists #1283

olsajiri · 2023-07-28T11:40:32Z

syscalls specified in list:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "list-syscalls"
spec:
  lists:
  - name: "syscalls"
    type: "syscalls"
    values:
    - "sys_dup"
    - "sys_dup2"
  kprobes:
  - call: "list:syscalls"

all syscalls (generated):

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "all-syscalls-for-kill"
spec:
  lists:
  - name: "all-syscalls"
    type: "generated_syscalls"
  kprobes:
  - call: "list:all-syscalls"
    selectors:
    - matchBinaries:
      - operator: "In"
        values:
        - "/usr/bin/kill"

ftrace functions (generated) with filter:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "all-ksys-for-kill"
spec:
  lists:
  - name: "ksys"
    type: "generated_ftrace"
    generate: "^ksys_*"
  kprobes:
  - call: "list:ksys"
    selectors:
    - matchBinaries:
      - operator: "In"
        values:
        - "/usr/bin/kill"

standard functions in the list:

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "ftrace"
spec:
  lists:
  - name: "ftrace"
    values:
    - "ksys_dup3"
    - "ksys_fadvise64_64"
    - "ksys_fallocate"
    - "ksys_fchown"
    - "ksys_ioperm"
    ...
    - "ksys_sync_file_range"
    - "ksys_sync_helper"
    - "ksys_unshare"
    - "ksys_write"
  kprobes:
    - call: "list:ftrace"

kkourt

Cool! Had a quick look and left a comment.

pkg/k8s/apis/cilium.io/v1alpha1/types.go

netlify · 2023-08-11T12:45:42Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`1ff1241`
🔍 Latest deploy log	https://app.netlify.com/sites/tetragon/deploys/64dddc54cc2c1b0008ef7fe2
😎 Deploy Preview	https://deploy-preview-1283--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site configuration.

pkg/sensors/tracing/generickprobe.go

pkg/k8s/apis/cilium.io/v1alpha1/types.go

Curve out addKprobe which adds single kprobe, so we can pass specific name to it following changes and support symbols lists. The number of in/out arguments for addKprobe function is too big so I added in and out structs to carry it. There's no functional change intended, just preparation for following changes. Signed-off-by: Jiri Olsa <[email protected]>

Adding support to define lists in the schema, like: spec: lists: - name: "syscalls" type: "syscalls" values: - "sys_dup" - "sys_dup2" They will be used in generic kprobes. The type can be: syscalls generated_syscalls generated_ftrace The implementation is in following patches. Signed-off-by: Jiri Olsa <[email protected]>

Result of 'make generate && make codegen'. Signed-off-by: Jiri Olsa <[email protected]>

kkourt

LGTM! Thanks!

Adding support to validate lists for generic kprobes. The specific type validation checks comes with type implementations in following changes. Signed-off-by: Jiri Olsa <[email protected]>

Adding support for syscall lists, like: spec: lists: - name: "syscalls" type: "syscalls" values: - "sys_dup" - "sys_dup2" kprobes: - call: "list:syscalls" The prevalidation adds the arch specific syscall prefix. Signed-off-by: Jiri Olsa <[email protected]>

Adding support to generated syscall list, like: spec: lists: - name: "all-syscalls" type: "generated-syscalls" kprobes: - call: "list:all-syscalls" selectors: - matchBinaries: - operator: "In" values: - "/usr/bin/kill" that hooks to all syscalls and trace them for kill binary. Signed-off-by: Jiri Olsa <[email protected]>

Adding support for generated ftrace list in tracing policy. The list is based on ftrace available_filter_functions file and filtered out for regex pattern specified in pattern value, like: spec: lists: - name: "ksys" type: "generated_ftrace" pattern: "^ksys_*" kprobes: - call: "list:ksys" selectors: - matchBinaries: - operator: "In" values: - "/usr/bin/kill" Signed-off-by: Jiri Olsa <[email protected]>

Adding support to use list in generic kprobe specs. It's now possible to specify list in 'call' value, like: kprobes: - call: "list:ksys" That makes all previous changelog examples working. Signed-off-by: Jiri Olsa <[email protected]>

Adding new all-syscalls-list sub command that allows to generate tracing policy with all available syscalls, like: # ./tetra tracingpolicy generate all-syscalls-list apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: "syscalls" spec: lists: - name: "syscalls" type: "syscalls" values: - "sys_shutdown" - "sys_kexec_file_load" - "sys_io_uring_enter" - "sys_pkey_alloc" - "sys_clone3" - "sys_munlock" - "sys_lookup_dcookie" - "sys_eventfd2" - "sys_finit_module" - "sys_pwrite64" - "sys_semget" ... - "sys_mkdirat" - "sys_sync_file_range" - "sys_preadv" - "sys_syncfs" - "sys_link" - "sys_timer_delete" - "sys_unlinkat" kprobes: - call: "list:syscalls" syscall: true Signed-off-by: Jiri Olsa <[email protected]>

Adding new avail-list sub command that allows to generate tracing policy with generated functions list. The list is based on ftrace available_filter_functions file and filtered out for regex pattern given in -r/--regex option, like: # ./tetra tracingpolicy generate avail-list -r ^ksys_ apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: "ftrace" spec: lists: - name: "ftrace" values: - "ksys_dup3" - "ksys_fadvise64_64" - "ksys_fallocate" - "ksys_fchown" - "ksys_ioperm" - "ksys_lseek" - "ksys_mmap_pgoff" - "ksys_msgctl.constprop.0" - "ksys_msgget" - "ksys_msgrcv" - "ksys_msgsnd" - "ksys_pread64" - "ksys_pwrite64" - "ksys_read" - "ksys_readahead" - "ksys_semctl.constprop.0" - "ksys_semget" - "ksys_semtimedop" - "ksys_setsid" - "ksys_shmctl.constprop.0" - "ksys_shmdt" - "ksys_shmget" - "ksys_sync" - "ksys_sync_file_range" - "ksys_sync_helper" - "ksys_unshare" - "ksys_write" kprobes: - call: "list:ftrace" Note it's possible to get all available functions generated, but it's not advisable to run such policy ;-) Signed-off-by: Jiri Olsa <[email protected]>

Adding syscall list tracing policy example. Signed-off-by: Jiri Olsa <[email protected]>

Adding syscall generated list tracing policy example. Signed-off-by: Jiri Olsa <[email protected]>

Adding ftrace generated list tracing policy example. Signed-off-by: Jiri Olsa <[email protected]>

mtardy · 2023-08-21T09:26:13Z

This is awesome! 🎉

olsajiri force-pushed the lists branch 11 times, most recently from 0c1442d to f02e127 Compare August 3, 2023 17:26

olsajiri force-pushed the lists branch 2 times, most recently from 8b43955 to c70db4c Compare August 9, 2023 07:29

kkourt reviewed Aug 9, 2023

View reviewed changes

pkg/k8s/apis/cilium.io/v1alpha1/types.go Outdated Show resolved Hide resolved

tixxdz self-requested a review August 9, 2023 08:07

olsajiri force-pushed the lists branch 2 times, most recently from 73f454a to cc2350f Compare August 11, 2023 12:45

olsajiri force-pushed the lists branch 4 times, most recently from c77a730 to 1b22606 Compare August 11, 2023 18:15

olsajiri marked this pull request as ready for review August 12, 2023 18:13

olsajiri requested a review from a team as a code owner August 12, 2023 18:13

olsajiri requested a review from jrfastab August 12, 2023 18:13

olsajiri force-pushed the lists branch 2 times, most recently from fe7630a to 1ff1241 Compare August 17, 2023 08:37

kkourt mentioned this pull request Aug 17, 2023

document lists in tracing policies #1365

Closed

kkourt reviewed Aug 17, 2023

View reviewed changes

pkg/sensors/tracing/generickprobe.go Show resolved Hide resolved

kkourt reviewed Aug 17, 2023

View reviewed changes

pkg/k8s/apis/cilium.io/v1alpha1/types.go Show resolved Hide resolved

olsajiri added 3 commits August 17, 2023 11:31

tetragon: Generate changes for list schema bits

84a6d71

Result of 'make generate && make codegen'. Signed-off-by: Jiri Olsa <[email protected]>

kkourt approved these changes Aug 17, 2023

View reviewed changes

olsajiri added 10 commits August 17, 2023 11:37

tetragon: Add support to validate lists

192c50e

Adding support to validate lists for generic kprobes. The specific type validation checks comes with type implementations in following changes. Signed-off-by: Jiri Olsa <[email protected]>

tetragon: Add syscall list tracing policy example

8d01d47

Adding syscall list tracing policy example. Signed-off-by: Jiri Olsa <[email protected]>

tetragon: Add syscall generated list tracing policy example

9419614

Adding syscall generated list tracing policy example. Signed-off-by: Jiri Olsa <[email protected]>

tetragon: Add ftrace generated list tracing policy example

d3004a8

Adding ftrace generated list tracing policy example. Signed-off-by: Jiri Olsa <[email protected]>

olsajiri force-pushed the lists branch from 1ff1241 to d3004a8 Compare August 17, 2023 11:50

kkourt merged commit f60404e into cilium:main Aug 17, 2023
24 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Lists #1283

Lists #1283

olsajiri commented Jul 28, 2023 •

edited

Loading

kkourt left a comment

netlify bot commented Aug 11, 2023 •

edited

Loading

kkourt left a comment •

edited

Loading

mtardy commented Aug 21, 2023

Lists #1283

Lists #1283

Conversation

olsajiri commented Jul 28, 2023 • edited Loading

kkourt left a comment

Choose a reason for hiding this comment

netlify bot commented Aug 11, 2023 • edited Loading

✅ Deploy Preview for tetragon ready!

kkourt left a comment • edited Loading

Choose a reason for hiding this comment

mtardy commented Aug 21, 2023

olsajiri commented Jul 28, 2023 •

edited

Loading

netlify bot commented Aug 11, 2023 •

edited

Loading

kkourt left a comment •

edited

Loading