fix(tests): fix hotplug tests

Signed-off-by: Andrea Terzolo <[email protected]>
falcosecurity · Jan 22, 2025 · a0e8b4b · a0e8b4b
1 parent b5a9c14
commit a0e8b4b
Show file tree

Hide file tree

Showing 4 changed files with 26 additions and 6 deletions.
diff --git a/test/libscap/helpers/engines.cpp b/test/libscap/helpers/engines.cpp
@@ -225,6 +225,14 @@ void check_hotplug_event(scap_t *h, std::ofstream &cpu_file) {
 	// Generate some syscalls on CPU 1 to make sure we generate an event
 	cpu_file.close();
 
+	// the legacy ebpf probe needs also a new event on CPU 0 after the hotplug to send the event in
+	// userspace
+	CPU_ZERO(&set);    // clear cpu mask
+	CPU_SET(0, &set);  // set cpu 1
+	sched_setaffinity(0, sizeof(cpu_set_t), &set);
+	// we throw a failed close to generate an event
+	close(-1);
+
 	// Reset affinity
 	sched_setaffinity(0, sizeof(cpu_set_t), &starting_set);
 

diff --git a/test/libscap/test_suites/engines/bpf/bpf.cpp b/test/libscap/test_suites/engines/bpf/bpf.cpp
@@ -290,8 +290,13 @@ TEST(bpf, hotplug) {
 	cpu_file << "0";
 	cpu_file.flush();
 
-	// open scap
-	scap_t* h = open_bpf_engine(error_buffer, &ret, 4 * 4096, LIBSCAP_TEST_BPF_PROBE_PATH);
+	// open scap, we limit the capture to just one syscall to avoid too many events.
+	// The close syscall will be called inside `check_hotplug_event`.
+	scap_t* h = open_bpf_engine(error_buffer,
+	                            &ret,
+	                            4 * 4096,
+	                            LIBSCAP_TEST_BPF_PROBE_PATH,
+	                            {PPM_SC_CLOSE});
 	ASSERT_FALSE(!h || ret != SCAP_SUCCESS)
 	        << "unable to open bpf engine: " << error_buffer << std::endl;
 

diff --git a/test/libscap/test_suites/engines/kmod/kmod.cpp b/test/libscap/test_suites/engines/kmod/kmod.cpp
@@ -344,8 +344,13 @@ TEST(kmod, hotplug) {
 	cpu_file << "0";
 	cpu_file.flush();
 
-	// open scap
-	scap_t* h = open_kmod_engine(error_buffer, &ret, 4 * 4096, LIBSCAP_TEST_KERNEL_MODULE_PATH);
+	// open scap, we limit the capture to just one syscall to avoid too many events.
+	// The close syscall will be called inside `check_hotplug_event`.
+	scap_t* h = open_kmod_engine(error_buffer,
+	                             &ret,
+	                             4 * 4096,
+	                             LIBSCAP_TEST_KERNEL_MODULE_PATH,
+	                             {PPM_SC_CLOSE});
 	ASSERT_FALSE(!h || ret != SCAP_SUCCESS)
 	        << "unable to open kmod engine: " << error_buffer << std::endl;
 

diff --git a/test/libscap/test_suites/engines/modern_bpf/modern_bpf.cpp b/test/libscap/test_suites/engines/modern_bpf/modern_bpf.cpp
@@ -428,8 +428,10 @@ TEST(modern_bpf, hotplug) {
 	cpu_file << "0";
 	cpu_file.flush();
 
-	// open scap
-	scap_t* h = open_modern_bpf_engine(error_buffer, &ret, 1 * 1024 * 1024, 0, true);
+	// open scap, we limit the capture to just one syscall to avoid too many events.
+	// The close syscall will be called inside `check_hotplug_event`.
+	scap_t* h =
+	        open_modern_bpf_engine(error_buffer, &ret, 1 * 1024 * 1024, 0, true, {PPM_SC_CLOSE});
 	ASSERT_FALSE(!h || ret != SCAP_SUCCESS)
 	        << "unable to open modern bpf engine: " << error_buffer << std::endl;