Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Lists #1283

Merged
merged 13 commits into from
Aug 17, 2023
Merged

Lists #1283

merged 13 commits into from
Aug 17, 2023

Commits on Aug 17, 2023

  1. tetragon: Refactor createGenericKprobeSensor function 

    Curve out addKprobe which adds single kprobe, so we can pass
specific name to it following changes and support symbols lists.

The number of in/out arguments for addKprobe function is too
big so I added in and out structs to carry it.

There's no functional change intended, just preparation for
following changes.

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    7821907 View commit details
    Browse the repository at this point in the history

  2. tetragon: Add ListSpec to the schema 

    Adding support to define lists in the schema, like:

spec:
  lists:
  - name: "syscalls"
    type: "syscalls"
    values:
    - "sys_dup"
    - "sys_dup2"

They will be used in generic kprobes.

The type can be:
  syscalls
  generated_syscalls
  generated_ftrace

The implementation is in following patches.

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    746f9cc View commit details
    Browse the repository at this point in the history

  3. tetragon: Generate changes for list schema bits 

    Result of 'make generate && make codegen'.

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    84a6d71 View commit details
    Browse the repository at this point in the history

  4. tetragon: Add support to validate lists 

    Adding support to validate lists for generic kprobes.

The specific type validation checks comes with type implementations
in following changes.

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    192c50e View commit details
    Browse the repository at this point in the history

  5. tetragon: Add support for syscall lists 

    Adding support for syscall lists, like:

  spec:
    lists:
    - name: "syscalls"
      type: "syscalls"
      values:
      - "sys_dup"
      - "sys_dup2"
    kprobes:
    - call: "list:syscalls"

The prevalidation adds the arch specific syscall prefix.

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    112cb0c View commit details
    Browse the repository at this point in the history

  6. tetragon: Add support for generated syscall lists 

    Adding support to generated syscall list, like:

  spec:
    lists:
    - name: "all-syscalls"
      type: "generated-syscalls"
    kprobes:
    - call: "list:all-syscalls"
      selectors:
      - matchBinaries:
        - operator: "In"
          values:
          - "/usr/bin/kill"

that hooks to all syscalls and trace them for kill binary.

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    38d7891 View commit details
    Browse the repository at this point in the history

  7. tetragon: Add support for generated ftrace lists 

    Adding support for generated ftrace list in tracing policy.

The list is based on ftrace available_filter_functions file and
filtered out for regex pattern specified in pattern value, like:

  spec:
    lists:
    - name: "ksys"
      type: "generated_ftrace"
      pattern: "^ksys_*"
    kprobes:
    - call: "list:ksys"
      selectors:
      - matchBinaries:
        - operator: "In"
          values:
          - "/usr/bin/kill"

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    7ef488b View commit details
    Browse the repository at this point in the history

  8. tetragon: Add support to use list in generic kprobes 

    Adding support to use list in generic kprobe specs.

It's now possible to specify list in 'call' value, like:

  kprobes:
  - call: "list:ksys"

That makes all previous changelog examples working.

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    570e146 View commit details
    Browse the repository at this point in the history

  9. tetra: Add all-syscalls-list tracingpolicy generate sub command 

    Adding new all-syscalls-list sub command that allows to generate
tracing policy with all available syscalls, like:

  # ./tetra tracingpolicy generate all-syscalls-list
  apiVersion: cilium.io/v1alpha1
  kind: TracingPolicy
  metadata:
    name: "syscalls"
  spec:
    lists:
    - name: "syscalls"
      type: "syscalls"
      values:
      - "sys_shutdown"
      - "sys_kexec_file_load"
      - "sys_io_uring_enter"
      - "sys_pkey_alloc"
      - "sys_clone3"
      - "sys_munlock"
      - "sys_lookup_dcookie"
      - "sys_eventfd2"
      - "sys_finit_module"
      - "sys_pwrite64"
      - "sys_semget"

      ...

      - "sys_mkdirat"
      - "sys_sync_file_range"
      - "sys_preadv"
      - "sys_syncfs"
      - "sys_link"
      - "sys_timer_delete"
      - "sys_unlinkat"
    kprobes:
      - call: "list:syscalls"
        syscall: true

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    cda3592 View commit details
    Browse the repository at this point in the history

  10. tetra: Add avail-list tracingpolicy generate sub command 

    Adding new avail-list sub command that allows to generate tracing
policy with generated functions list.

The list is based on ftrace available_filter_functions file and
filtered out for regex pattern given in -r/--regex option, like:

  # ./tetra tracingpolicy generate avail-list -r ^ksys_
  apiVersion: cilium.io/v1alpha1
  kind: TracingPolicy
  metadata:
    name: "ftrace"
  spec:
    lists:
    - name: "ftrace"
      values:
      - "ksys_dup3"
      - "ksys_fadvise64_64"
      - "ksys_fallocate"
      - "ksys_fchown"
      - "ksys_ioperm"
      - "ksys_lseek"
      - "ksys_mmap_pgoff"
      - "ksys_msgctl.constprop.0"
      - "ksys_msgget"
      - "ksys_msgrcv"
      - "ksys_msgsnd"
      - "ksys_pread64"
      - "ksys_pwrite64"
      - "ksys_read"
      - "ksys_readahead"
      - "ksys_semctl.constprop.0"
      - "ksys_semget"
      - "ksys_semtimedop"
      - "ksys_setsid"
      - "ksys_shmctl.constprop.0"
      - "ksys_shmdt"
      - "ksys_shmget"
      - "ksys_sync"
      - "ksys_sync_file_range"
      - "ksys_sync_helper"
      - "ksys_unshare"
      - "ksys_write"
    kprobes:
      - call: "list:ftrace"

Note it's possible to get all available functions generated,
but it's not advisable to run such policy ;-)

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    d05b29b View commit details
    Browse the repository at this point in the history

  11. tetragon: Add syscall list tracing policy example 

    Adding syscall list tracing policy example.

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    8d01d47 View commit details
    Browse the repository at this point in the history

  12. tetragon: Add syscall generated list tracing policy example 

    Adding syscall generated list tracing policy example.

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    9419614 View commit details
    Browse the repository at this point in the history

  13. tetragon: Add ftrace generated list tracing policy example 

    Adding ftrace generated list tracing policy example.

Signed-off-by: Jiri Olsa <[email protected]>
    @olsajiri
    olsajiri committed Aug 17, 2023
    Configuration menu
    Copy the full SHA
    d3004a8 View commit details
    Browse the repository at this point in the history