From e1e071e9be0eca271071ae2f86d36f87a74cd537 Mon Sep 17 00:00:00 2001 From: Jiri Olsa Date: Sun, 29 Dec 2024 20:15:10 +0000 Subject: [PATCH] tetragon: Add session specific setup to TestLoadKprobeSensor Signed-off-by: Jiri Olsa --- pkg/sensors/tracing/kprobe_test.go | 146 ++++++++++++++++++++--------- 1 file changed, 101 insertions(+), 45 deletions(-) diff --git a/pkg/sensors/tracing/kprobe_test.go b/pkg/sensors/tracing/kprobe_test.go index 1822c482d77..ea8025cf10d 100644 --- a/pkg/sensors/tracing/kprobe_test.go +++ b/pkg/sensors/tracing/kprobe_test.go @@ -4327,64 +4327,120 @@ spec: } func TestLoadKprobeSensor(t *testing.T) { - var sensorProgs = []tus.SensorProg{ - // kprobe - 0: tus.SensorProg{Name: "generic_kprobe_event", Type: ebpf.Kprobe}, - 1: tus.SensorProg{Name: "generic_kprobe_setup_event", Type: ebpf.Kprobe}, - 2: tus.SensorProg{Name: "generic_kprobe_process_event", Type: ebpf.Kprobe}, - 3: tus.SensorProg{Name: "generic_kprobe_filter_arg", Type: ebpf.Kprobe}, - 4: tus.SensorProg{Name: "generic_kprobe_process_filter", Type: ebpf.Kprobe}, - 5: tus.SensorProg{Name: "generic_kprobe_actions", Type: ebpf.Kprobe}, - 6: tus.SensorProg{Name: "generic_kprobe_output", Type: ebpf.Kprobe}, - // retkprobe - 7: tus.SensorProg{Name: "generic_retkprobe_event", Type: ebpf.Kprobe}, - 8: tus.SensorProg{Name: "generic_retkprobe_filter_arg", Type: ebpf.Kprobe}, - 9: tus.SensorProg{Name: "generic_retkprobe_actions", Type: ebpf.Kprobe}, - 10: tus.SensorProg{Name: "generic_retkprobe_output", Type: ebpf.Kprobe}, - } + var ( + sensorProgs []tus.SensorProg + sensorMaps []tus.SensorMap + ) + + if bpf.HasKprobeSession() { + sensorProgs = []tus.SensorProg{ + 0: tus.SensorProg{Name: "generic_kprobe_event", Type: ebpf.Kprobe}, + 1: tus.SensorProg{Name: "generic_kprobe_setup_event", Type: ebpf.Kprobe}, + 2: tus.SensorProg{Name: "generic_kprobe_process_event", Type: ebpf.Kprobe}, + 3: tus.SensorProg{Name: "generic_kprobe_filter_arg", Type: ebpf.Kprobe}, + 4: tus.SensorProg{Name: "generic_kprobe_process_filter", Type: ebpf.Kprobe}, + 5: tus.SensorProg{Name: "generic_kprobe_actions", Type: ebpf.Kprobe}, + 6: tus.SensorProg{Name: "generic_kprobe_output", Type: ebpf.Kprobe}, + 7: tus.SensorProg{Name: "generic_retkprobe_filter_arg", Type: ebpf.Kprobe}, + 8: tus.SensorProg{Name: "generic_retkprobe_actions", Type: ebpf.Kprobe}, + 9: tus.SensorProg{Name: "generic_retkprobe_output", Type: ebpf.Kprobe}, + } - var sensorMaps = []tus.SensorMap{ - // all kprobe programs - tus.SensorMap{Name: "process_call_heap", Progs: []uint{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10}}, + sensorMaps = []tus.SensorMap{ + // all kprobe programs + tus.SensorMap{Name: "process_call_heap", Progs: []uint{0, 1, 2, 3, 4, 5, 6, 7, 8, 9}}, - // all but generic_kprobe_output - tus.SensorMap{Name: "kprobe_calls", Progs: []uint{0, 1, 2, 3, 4, 5}}, + // all but generic_kprobe_output + tus.SensorMap{Name: "kprobe_calls", Progs: []uint{0, 1, 2, 3, 4, 5}}, - // generic_retkprobe_event - tus.SensorMap{Name: "retkprobe_calls", Progs: []uint{7, 8, 9}}, + // generic_retkprobe_event + tus.SensorMap{Name: "retkprobe_calls", Progs: []uint{0, 7, 8}}, - // generic_kprobe_process_filter,generic_kprobe_filter_arg, - // generic_kprobe_actions,generic_kprobe_output - tus.SensorMap{Name: "filter_map", Progs: []uint{3, 4, 5}}, + // generic_kprobe_process_filter,generic_kprobe_filter_arg, + // generic_kprobe_actions,generic_kprobe_output + tus.SensorMap{Name: "filter_map", Progs: []uint{3, 4, 5, 7, 8}}, - // generic_kprobe_actions - tus.SensorMap{Name: "override_tasks", Progs: []uint{5}}, + // generic_kprobe_actions + tus.SensorMap{Name: "override_tasks", Progs: []uint{5, 8}}, - // all kprobe but generic_kprobe_process_filter,generic_retkprobe_event - tus.SensorMap{Name: "config_map", Progs: []uint{0, 1, 2}}, + // all kprobe but generic_kprobe_process_filter,generic_retkprobe_event + tus.SensorMap{Name: "config_map", Progs: []uint{0, 1, 2}}, - // generic_kprobe_process_event*,generic_kprobe_actions,retkprobe - tus.SensorMap{Name: "fdinstall_map", Progs: []uint{1, 2, 5, 7, 9}}, + // generic_kprobe_process_event*,generic_kprobe_actions,retkprobe + tus.SensorMap{Name: "fdinstall_map", Progs: []uint{0, 1, 2, 5, 8}}, - // generic_kprobe_event - tus.SensorMap{Name: "tg_conf_map", Progs: []uint{0}}, - } + // generic_kprobe_event + tus.SensorMap{Name: "tg_conf_map", Progs: []uint{0}}, - if kernels.EnableLargeProgs() { - // shared with base sensor - sensorMaps = append(sensorMaps, tus.SensorMap{Name: "execve_map", Progs: []uint{4, 5, 6, 7, 9}}) + // shared with base sensor + tus.SensorMap{Name: "execve_map", Progs: []uint{0, 4, 5, 6, 8, 9}}, - // generic_kprobe_process_event*,generic_kprobe_output,generic_retkprobe_output - sensorMaps = append(sensorMaps, tus.SensorMap{Name: "tcpmon_map", Progs: []uint{1, 2, 6, 10}}) + // generic_kprobe_process_event*,generic_kprobe_output,generic_retkprobe_output + tus.SensorMap{Name: "tcpmon_map", Progs: []uint{1, 2, 6, 9}}, - // generic_kprobe_process_event*,generic_kprobe_actions,retkprobe - sensorMaps = append(sensorMaps, tus.SensorMap{Name: "socktrack_map", Progs: []uint{1, 2, 5, 7, 9}}) + // generic_kprobe_process_event*,generic_kprobe_actions,retkprobe + tus.SensorMap{Name: "socktrack_map", Progs: []uint{0, 1, 2, 5, 8}}, + } } else { - // shared with base sensor - sensorMaps = append(sensorMaps, tus.SensorMap{Name: "execve_map", Progs: []uint{4, 7}}) + sensorProgs = []tus.SensorProg{ + // kprobe + 0: tus.SensorProg{Name: "generic_kprobe_event", Type: ebpf.Kprobe}, + 1: tus.SensorProg{Name: "generic_kprobe_setup_event", Type: ebpf.Kprobe}, + 2: tus.SensorProg{Name: "generic_kprobe_process_event", Type: ebpf.Kprobe}, + 3: tus.SensorProg{Name: "generic_kprobe_filter_arg", Type: ebpf.Kprobe}, + 4: tus.SensorProg{Name: "generic_kprobe_process_filter", Type: ebpf.Kprobe}, + 5: tus.SensorProg{Name: "generic_kprobe_actions", Type: ebpf.Kprobe}, + 6: tus.SensorProg{Name: "generic_kprobe_output", Type: ebpf.Kprobe}, + // retkprobe + 7: tus.SensorProg{Name: "generic_retkprobe_event", Type: ebpf.Kprobe}, + 8: tus.SensorProg{Name: "generic_retkprobe_filter_arg", Type: ebpf.Kprobe}, + 9: tus.SensorProg{Name: "generic_retkprobe_actions", Type: ebpf.Kprobe}, + 10: tus.SensorProg{Name: "generic_retkprobe_output", Type: ebpf.Kprobe}, + } + + sensorMaps = []tus.SensorMap{ + // all kprobe programs + tus.SensorMap{Name: "process_call_heap", Progs: []uint{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10}}, + + // all but generic_kprobe_output + tus.SensorMap{Name: "kprobe_calls", Progs: []uint{0, 1, 2, 3, 4, 5}}, + + // generic_retkprobe_event + tus.SensorMap{Name: "retkprobe_calls", Progs: []uint{7, 8, 9}}, + + // generic_kprobe_process_filter,generic_kprobe_filter_arg, + // generic_kprobe_actions,generic_kprobe_output + tus.SensorMap{Name: "filter_map", Progs: []uint{3, 4, 5}}, - // generic_kprobe_output,generic_retkprobe_output - sensorMaps = append(sensorMaps, tus.SensorMap{Name: "tcpmon_map", Progs: []uint{6, 10}}) + // generic_kprobe_actions + tus.SensorMap{Name: "override_tasks", Progs: []uint{5}}, + + // all kprobe but generic_kprobe_process_filter,generic_retkprobe_event + tus.SensorMap{Name: "config_map", Progs: []uint{0, 1, 2}}, + + // generic_kprobe_process_event*,generic_kprobe_actions,retkprobe + tus.SensorMap{Name: "fdinstall_map", Progs: []uint{1, 2, 5, 7, 9}}, + + // generic_kprobe_event + tus.SensorMap{Name: "tg_conf_map", Progs: []uint{0}}, + } + + if kernels.EnableLargeProgs() { + // shared with base sensor + sensorMaps = append(sensorMaps, tus.SensorMap{Name: "execve_map", Progs: []uint{4, 5, 6, 7, 9}}) + + // generic_kprobe_process_event*,generic_kprobe_output,generic_retkprobe_output + sensorMaps = append(sensorMaps, tus.SensorMap{Name: "tcpmon_map", Progs: []uint{1, 2, 6, 10}}) + + // generic_kprobe_process_event*,generic_kprobe_actions,retkprobe + sensorMaps = append(sensorMaps, tus.SensorMap{Name: "socktrack_map", Progs: []uint{1, 2, 5, 7, 9}}) + } else { + // shared with base sensor + sensorMaps = append(sensorMaps, tus.SensorMap{Name: "execve_map", Progs: []uint{4, 7}}) + + // generic_kprobe_output,generic_retkprobe_output + sensorMaps = append(sensorMaps, tus.SensorMap{Name: "tcpmon_map", Progs: []uint{6, 10}}) + } } readHook := `