"Revert: made changes as per review request"

This reverts commit 41208ce. Signed-off-by: RohithRaju <rohithraju488@gmail.com>
falcosecurity · Feb 7, 2024 · 5d811ce · 5d811ce
1 parent 71c85a2
commit 5d811ce
Show file tree

Hide file tree

Showing 5 changed files with 22 additions and 10 deletions.
diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h
@@ -5802,8 +5802,8 @@ FILLER(sys_bpf_x, true)
 	bpf_push_s64_to_ring(data, fd);
 
 	/* Parameter 2: cmd (type: PT_ENUMFLAGS32) */
-	int32_t cmd = (int32_t)bpf_syscall_get_argument(data, 0);
-	return bpf_push_u32_to_ring(data, (uint32_t)cmd);
+	unsigned long cmd = bpf_syscall_get_argument(data, 0);
+	return bpf_push_s32_to_ring(data, (int32_t)bpf_cmd_to_scap(cmd));
 }
 
 FILLER(sys_unlinkat_x, true)

diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bpf.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/bpf.bpf.c
@@ -58,9 +58,9 @@ int BPF_PROG(bpf_x,
 	/* Parameter 1: fd (type: PT_FD) */
 	ringbuf__store_s64(&ringbuf, ret);
 
-	/* Parameter 2: cmd (type: PT_ENUMFLAGS32) */
-	int32_t cmd = (int32_t)extract__syscall_argument(regs, 0);
-	ringbuf__store_u32(&ringbuf, (uint32_t)cmd);
+	/* Parameter 2: cmd (type: PT_INT32) */
+	unsigned long cmd = extract__syscall_argument(regs, 0);
+	ringbuf__store_s32(&ringbuf,(int32_t)bpf_cmd_to_scap(cmd));
 
 
 	/*=============================== COLLECT PARAMETERS  ===========================*/

diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c
@@ -6733,7 +6733,7 @@ int f_sys_bpf_e(struct event_filler_arguments *args)
 	unsigned long val = 0;
 	syscall_get_arguments_deprecated(args, 0, 1, &val);
 
-	/* Parameter 1: cmd (type: PT_INT64) */
+	/* Parameter 1: cmd (type: PT_ENUMFLAGS32) */
 	cmd = (int32_t)val;
 	res = val_to_ring(args, (int64_t)cmd, 0, false, 0);
 	CHECK_RES(res);
@@ -6752,10 +6752,10 @@ int f_sys_bpf_x(struct event_filler_arguments *args)
 	res = val_to_ring(args, fd, 0, false, 0);
 	CHECK_RES(res);
 
-	/* Parameter 2: cmd (type: PT_ENUMFLAGS32) */
+	/* Parameter 2: cmd (type: PT_INT64) */
 	syscall_get_arguments_deprecated(args, 0, 1, &val);
-	cmd = (int32_t)val;
-	res = val_to_ring(args, (uint32_t)cmd, 0, false, 0);
+	cmd = (int32_t)bpf_cmd_to_scap(val);
+	res = val_to_ring(args, cmd, 0, false, 0);
 	CHECK_RES(res);
 	return add_sentinel(args);
 }

diff --git a/driver/ppm_flag_helpers.h b/driver/ppm_flag_helpers.h
@@ -2221,4 +2221,16 @@ static __always_inline uint32_t mknod_mode_to_scap(uint32_t modes)
 
 	return res;
 }
+
+static __always_inline uint32_t bpf_cmd_to_scap (unsigned long cmd){
+	/*
+	 * bpf opcodes are defined via enum in uapi/linux/bpf.h.
+	 * It is userspace API (thus stable) and arch-independent.
+	 * Therefore we map them 1:1; if any unmapped flag arrives,
+	 * we will just print its value to userspace without mapping it to a string flag.
+	 * We then need to append new flags to both flags_table and ppm_events_public PPM_ flags.
+	 */
+
+	return cmd;
+}
 #endif /* PPM_FLAG_HELPERS_H_ */
diff --git a/test/drivers/test_suites/syscall_exit_suite/bpf_x.cpp b/test/drivers/test_suites/syscall_exit_suite/bpf_x.cpp
@@ -147,7 +147,7 @@ TEST(SyscallExit, bpfX_MAP_CREATE)
 
 	/* Parameter 1: fd (type: PT_FD) */
 	evt_test->assert_numeric_param(1, errno_value);
-	/* Parameter 2: cmd (type: PT_INT32)*/
+	/* Parameter 2: cmd (type: PT_ENUMFLAGS32)*/
 	evt_test->assert_numeric_param(2, PPM_BPF_MAP_CREATE);
 
 	/*=============================== ASSERT PARAMETERS  ===========================*/