fix listen syscall backlog field size

[oheifetz]

Reported by: github issue #515

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap-engine-udig

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it: fix listen syscall backlog field size

Which issue(s) this PR fixes: issue 515 listen bullet

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

[poiana]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: oheifetz
Once this PR has been reviewed and has the lgtm label, please assign leogr for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[github-actions]

Please double check driver/SCHEMA_VERSION file. See versioning.

[incertum]

@oheifetz thank you! Will help with the tests if needed. Also let us plan and coordinate this one with the loginuid fix PR as there will be a merge conflict depending on the order. Both of them will likely go into the release after 0.12.0 (due ~ July 21) aka they'll both have to wait 1-2 weeks.

Also don't worry about the driver schema version, we will coordinate that as well.

[incertum]

@oheifetz could you use rebase instead of merge, see our contributor guidelines in the CONTRIBUTING.md

In addition, those are all the unit tests you can try locally, plus we have e2e tests, hope the READMEs give even more info and let us know if you have questions.

make -j 16 unit-test-libsinsp; make run-unit-test-libsinsp;
make -j 16 libscap_test; sudo ./test/libscap/libscap_test;
make -j 16 drivers_test; sudo ./test/drivers/drivers_test -b driver/bpf/probe.o  # works with -k or -m as well

[incertum]

re #1200 (comment) would you prefer checking on the failing tests first or would you prefer us directly helping?

[oheifetz]

@incertum, thanks for sharing the local test list, I ran the driver_tests til now and got the impression that it suffices, now I am fixing the issues. Strange that there is no single commits that changed the SCHEMA and modified all files that I see failing.
Also I could not decide if I should bump the SCHEMA_VERSION for the same reason.

Regarding make libscap_test; sudo ./test/libscap/libscap_test, I could not run this command on my source code, but I did manage to run: make unit-test-libscap; sudo libscap/test/unit-test-libscap

Are these runs equivalent?

[incertum]

https://github.com/falcosecurity/libs/tree/master/test/libscap
https://github.com/falcosecurity/libs/tree/master/userspace/libscap/test

Apologies that's on us with having started migrating out test suites to libs/test ...

We are working on updating developer docs everywhere, I'll keep this in mind when we get here.

We bump the schema versions manually and there are other PRs that are already bumping them, let's see where we once we are ready to merge this one.

[FedeDP]

/milestone driver-backlog

[incertum]

@oheifetz we did reach new consensus, see here #1192 (comment) and will not require a new event type in cases like here.

Please accept our apologies for the unnecessary work we caused. Would you be willing to adjust these changes? If it's a consolation, I will also have to squash my changes in the loginuid PR ...

[poiana]

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.

📝 Please follow instructions in the contributing guide to update your commits with the DCO

Full details of the Developer Certificate of Origin can be found at developercertificate.org.

The list of commits missing DCO signoff:

• 1a6e81f Merge branch 'falcosecurity:master' into issue_515_listen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[poiana]

Thanks for your pull request. Before we can look at it, you'll need to add a 'DCO signoff' to your commits.

📝 Please follow instructions in the contributing guide to update your commits with the DCO

Full details of the Developer Certificate of Origin can be found at developercertificate.org.

The list of commits missing DCO signoff:

• 1a6e81f Merge branch 'falcosecurity:master' into issue_515_listen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

[poiana]

Adding label do-not-merge/contains-merge-commits because PR contains merge commits, which are not allowed in this repository.
Use git rebase to reapply your commits on top of the target branch. Detailed instructions for doing so can be found here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.