Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat(driver): support for init_module, finit_module syscalls #1242

Merged
merged 4 commits into from
Aug 1, 2023
Merged

feat(driver): support for init_module, finit_module syscalls #1242

merged 4 commits into from
Aug 1, 2023

Conversation

therealbobo
Copy link
Contributor

@therealbobo therealbobo commented Jul 27, 2023 •
edited
Loading

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap-engine-udig

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This adds the support for init_module, finit_module syscalls.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

@poiana poiana requested a review from FedeDP July 27, 2023 16:36
@github-actions
Copy link

github-actions bot commented Jul 27, 2023 •
edited
Loading

Please double check driver/API_VERSION file. See versioning.

@poiana poiana requested a review from hbrueckner July 27, 2023 16:36
@therealbobo therealbobo deleted the feat/rootkit-detection branch July 28, 2023 09:48
@therealbobo therealbobo restored the feat/rootkit-detection branch July 28, 2023 09:48
@therealbobo therealbobo reopened this Jul 28, 2023
@therealbobo therealbobo force-pushed the feat/rootkit-detection branch 2 times, most recently from e2ed9cd to 573995d Compare July 28, 2023 10:17
Andreagit97
Andreagit97 reviewed Jul 28, 2023
View reviewed changes
Copy link
Member

@Andreagit97 Andreagit97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Amazing work!

driver/bpf/fillers.h Show resolved Hide resolved
driver/bpf/fillers.h Outdated Show resolved Hide resolved
driver/bpf/fillers.h Outdated Show resolved Hide resolved
driver/bpf/fillers.h Show resolved Hide resolved
driver/bpf/fillers.h Show resolved Hide resolved
test/drivers/test_suites/syscall_enter_suite/init_module_e.cpp Outdated Show resolved Hide resolved
test/drivers/test_suites/syscall_exit_suite/finit_module_x.cpp Outdated Show resolved Hide resolved
test/drivers/test_suites/syscall_exit_suite/finit_module_x.cpp Outdated Show resolved Hide resolved
test/drivers/test_suites/syscall_exit_suite/finit_module_x.cpp Outdated Show resolved Hide resolved
test/drivers/test_suites/syscall_exit_suite/init_module_x.cpp Outdated Show resolved Hide resolved
@Andreagit97
Copy link
Member

Please double-check these tests in sinsp:

[  FAILED  ] events_set.event_set_to_names_generic_events
[  FAILED  ] events_set.event_set_to_names_no_generic_events2
[  FAILED  ] interesting_syscalls.event_set_to_sc_set_generic_events

You will notice that they assert INIT_MODULE syscall as generic but from now on it won't be generic

@therealbobo therealbobo force-pushed the feat/rootkit-detection branch 6 times, most recently from f8568da to 6e847e5 Compare July 31, 2023 09:38
@Andreagit97 Andreagit97 added this to the next-driver milestone Jul 31, 2023
Andreagit97
Andreagit97 reviewed Jul 31, 2023
View reviewed changes
Copy link
Member

@Andreagit97 Andreagit97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

just a last comment on flags and we have done :)

driver/bpf/fillers.h Outdated Show resolved Hide resolved
driver/event_table.c Outdated Show resolved Hide resolved
driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/finit_module.bpf.c Outdated Show resolved Hide resolved
driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/finit_module.bpf.c Outdated Show resolved Hide resolved
driver/ppm_fillers.c Outdated Show resolved Hide resolved
driver/ppm_flag_helpers.h Outdated Show resolved Hide resolved
@therealbobo therealbobo force-pushed the feat/rootkit-detection branch 2 times, most recently from e6fcb08 to 508f605 Compare August 1, 2023 07:59
therealbobo and others added 4 commits August 1, 2023 08:50
@therealbobo @Andreagit97
feat(driver): support for init_module,finit_module syscalls
b3225b9 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
Co-Authored-By: Andrea Terzolo <andreaterzolo3@gmail.com>
@therealbobo @Andreagit97
fix(libsinsp/test): fix sinsp api tests
56b98f9 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
Co-Authored-By: Andrea Terzolo <andreaterzolo3@gmail.com>
@therealbobo
test(drivers): added tests for finit_module flags
aacfef4 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
@therealbobo
chore: bump schema version
9eea9b3 
Signed-off-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
FedeDP
FedeDP approved these changes Aug 1, 2023
View reviewed changes
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Aug 1, 2023
@poiana
Copy link
Contributor

poiana commented Aug 1, 2023

LGTM label has been added.

Git tree hash: 812b91bcdef34acd373e0220c101f27f968d812e

@poiana poiana added the approved label Aug 1, 2023
Andreagit97
Andreagit97 approved these changes Aug 1, 2023
View reviewed changes
Copy link
Member

@Andreagit97 Andreagit97 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Aug 1, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, FedeDP, therealbobo

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit ba75e6e into falcosecurity:master Aug 1, 2023
29 checks passed
This was referenced Jul 28, 2023
Closed
Closed
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@FedeDP FedeDP FedeDP approved these changes

@Andreagit97 Andreagit97 Andreagit97 approved these changes

@hbrueckner hbrueckner Awaiting requested review from hbrueckner

Assignees

@FedeDP FedeDP

@Andreagit97 Andreagit97

Labels
approved area/driver-bpf area/driver-kmod area/driver-modern-bpf area/tests dco-signoff: yes kind/feature New feature or request lgtm release-note-none size/XXL
Projects
None yet
Milestone
6.0.0+driver
Development

Successfully merging this pull request may close these issues.
4 participants
@therealbobo @Andreagit97 @poiana @FedeDP