bugfix: Fix Prefix operator with file type in matchArgs #1301
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
tpapagian
force-pushed
the
pr/apapag/fix_file_sel
branch
from
a435b4c
to
1d93922
Compare
In https://raw.githubusercontent.com/cilium/tetragon/main/examples/tracingpolicy/file_monitoring.yaml Prefix does not seem to work as expected. This means that we also get events with different prefix compared to /etc/. The issues for that is that we do not calculate correctly the offsets inside the buffer of the specific argument. Now we use structs to make that easier to read and argue about. Signed-off-by: Anastasios Papagiannis <[email protected]>
tpapagian
force-pushed
the
pr/apapag/fix_file_sel
branch
from
1d93922
to
fe4309d
Compare
tpapagian
changed the title
tpapagian
changed the title
tpapagian
added
release-note/bug
tpapagian
force-pushed
the
pr/apapag/fix_file_sel
branch
from
fe4309d
to
a409932
Compare
This test uses the tracing policy described https://raw.githubusercontent.com/cilium/tetragon/main/examples/tracingpolicy/file_monitoring.yaml. Signed-off-by: Anastasios Papagiannis <[email protected]>
tpapagian
force-pushed
the
pr/apapag/fix_file_sel
branch
from
a409932
to
abfbc80
Compare
kkourt
approved these changes
Aug 2, 2023
| @@ -649,17 +649,17 @@ filter_char_buf(struct selector_arg_filter *filter, char *args, int value_off) | |||
| return 0; | |||
| } | |||
|
|
|||
| struct string_buf { | |||
| __u32 len; | |||
| char buf[]; | |||
There was a problem hiding this comment.
Nice, I like that! It makes the format explicit.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The tracing policy provided in https://raw.githubusercontent.com/cilium/tetragon/main/examples/tracingpolicy/file_monitoring.yaml does not work as expected.
The matchArgs filter with file type and Prefix operator results in events with filenames with different prefixes as what we expected. This means that expect from the events that we care about, we also get a bunch of unrelated events.
More details on commit messages.