Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(scap): move machine/agent info to generic platform #1204

Merged
merged 8 commits into from
Jul 18, 2023

Conversation

gnosek
Copy link
Contributor

@gnosek gnosek commented Jul 16, 2023

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap-engine-udig

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

What this PR does / why we need it:

The generic platform didn't expose machine_info or agent_info, while we do need this even for source plugins.

Also, allow source plugins to use the live platform (for upcoming syscall plugins).

Special notes for your reviewer:

macOS and Windows support is completely untested, fingers crossed for the CI doing its job.

Does this PR introduce a user-facing change?:

NONE

@gnosek
Copy link
Contributor Author

gnosek commented Jul 16, 2023

cc @incertum

@gnosek
Copy link
Contributor Author

gnosek commented Jul 16, 2023

also cc @geraldcombs since you seem to be involved with the non-Linux side of things :)

@gnosek gnosek force-pushed the platform-machine-info branch 2 times, most recently from 8db5e54 to 1b06b7d Compare July 16, 2023 09:50
incertum
incertum previously approved these changes Jul 16, 2023
Copy link
Contributor

@incertum incertum left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @gnosek 🤩

/approve

/milestone 0.12.0

@poiana poiana added this to the 0.12.0 milestone Jul 16, 2023
@poiana poiana added the lgtm label Jul 16, 2023
@poiana
Copy link
Contributor

poiana commented Jul 16, 2023

LGTM label has been added.

Git tree hash: e4a29cd7f6d0b6da8bcf5b9dd1de73fc496ea05e

{
OSVERSIONINFOA os_info;
os_info.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);
if(GetVersionExA(&os_info))
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note that this probably won't return the correct version on modern versions of Windows. We use RtlGetVersion in Wireshark, but it looks like you can also call GetFileVersionInfo on one of the kernel DLLs.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm happy it compiled without me seeing a Windows machine ;) I'm even happier to replace it with something that actually works.

For future me: https://github.com/wireshark/wireshark/blob/dcc9cbffefe0598eadec11cbc1869943a26219c5/wsutil/os_version_info.c#L192

(I don't think we need anything that fancy but I'll use it for inspiration ;])

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@geraldcombs and @gnosek is this a blocker or a note for a future PR? The primary fix this PR addresses is around plugins and linux ...

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@incertum I think this falls in the "future PR" category.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@gnosek I'll re-approve tomorrow as we need a rebase now!

@FedeDP
Copy link
Contributor

FedeDP commented Jul 17, 2023

/milestone 0.12.0

Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
This still needs macOS and Windows support

Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
@poiana poiana requested a review from incertum July 18, 2023 11:52
@gnosek
Copy link
Contributor Author

gnosek commented Jul 18, 2023

@incertum, rebased.

@geraldcombs, I did a yolo implementation using RtlGetVersion, please take a look if you can :) (taken from Wireshark, simplified a lot with less detail)

Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
The generic platform handles machine_info now.

Signed-off-by: Grzegorz Nosek <grzegorz.nosek@sysdig.com>
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Jul 18, 2023

LGTM label has been added.

Git tree hash: 76b7e2955e38508dbd2c75ce9865bfd7ca7e1747

Copy link
Contributor

@incertum incertum left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Jul 18, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, gnosek, incertum

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [FedeDP,gnosek,incertum]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit 9c7d59b into falcosecurity:master Jul 18, 2023
25 checks passed
@gnosek gnosek deleted the platform-machine-info branch September 20, 2023 13:19
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants