pkg:kprobe: handle bpf_cmd argument

Signed-off-by: Djalal Harouni <tixxdz@gmail.com>
cilium · Sep 22, 2024 · 4ec398f · 4ec398f
1 parent 8d0d049
commit 4ec398f
Show file tree

Hide file tree

Showing 6 changed files with 39 additions and 1 deletion.
diff --git a/pkg/api/tracingapi/client_kprobe.go b/pkg/api/tracingapi/client_kprobe.go
@@ -317,6 +317,20 @@ func (m MsgGenericKprobeArgCapability) IsReturnArg() bool {
 	return m.Index == ReturnArgIndex
 }
 
+type MsgGenericKprobeArgBpfCmd struct {
+	Index uint64
+	Value int32
+	Label string
+}
+
+func (m MsgGenericKprobeArgBpfCmd) GetIndex() uint64 {
+	return m.Index
+}
+
+func (m MsgGenericKprobeArgBpfCmd) IsReturnArg() bool {
+	return m.Index == ReturnArgIndex
+}
+
 type MsgGenericKernelCapType struct {
 	Caps uint64
 }

diff --git a/pkg/btf/validation.go b/pkg/btf/validation.go
@@ -335,7 +335,7 @@ func typesCompatible(specTy string, kernelTy string) bool {
 		case "struct user_namespace *":
 			return true
 		}
-	case "capability":
+	case "capability", "bpf_cmd":
 		switch kernelTy {
 		case "int":
 			return true

diff --git a/pkg/generictypes/generictypes.go b/pkg/generictypes/generictypes.go
@@ -57,6 +57,8 @@ const (
 
 	GenericNetDev = 39
 
+	GenericBpfCmd = 40
+
 	GenericNopType     = -1
 	GenericInvalidType = -2
 )
@@ -108,6 +110,7 @@ var GenericStringToType = map[string]int{
 	"linux_binprm":    GenericLinuxBinprmType,
 	"data_loc":        GenericDataLoc,
 	"net_device":      GenericNetDev,
+	"bpf_cmd":         GenericBpfCmd,
 }
 
 var GenericTypeToStringTable = map[int]string{
@@ -150,6 +153,7 @@ var GenericTypeToStringTable = map[int]string{
 	GenericLinuxBinprmType: "linux_binprm",
 	GenericDataLoc:         "data_loc",
 	GenericNetDev:          "net_device",
+	GenericBpfCmd:          "bpf_cmd",
 	GenericInvalidType:     "",
 }
 

diff --git a/pkg/grpc/tracing/tracing.go b/pkg/grpc/tracing/tracing.go
@@ -265,6 +265,9 @@ func getKprobeArgument(arg tracingapi.MsgGenericKprobeArg) *tetragon.KprobeArgum
 		}
 		a.Arg = &tetragon.KprobeArgument_LinuxBinprmArg{LinuxBinprmArg: lArg}
 		a.Label = e.Label
+	case api.MsgGenericKprobeArgBpfCmd:
+		a.Arg = &tetragon.KprobeArgument_BpfCmdArg{BpfCmdArg: kernel.GetBpfCmd(e.Value)}
+		a.Label = e.Label
 	default:
 		logger.GetLogger().WithField("arg", e).Warnf("unexpected type: %T", e)
 	}

diff --git a/pkg/reader/kernel/kernel.go b/pkg/reader/kernel/kernel.go
@@ -7,6 +7,10 @@ import (
 	"github.com/cilium/tetragon/api/v1/tetragon"
 )
 
+func GetBpfCmd(cmd int32) tetragon.BpfCmd {
+	return tetragon.BpfCmd(cmd)
+}
+
 func GetTaintedBitsTypes(taints uint64) []tetragon.TaintedBitsType {
 	if taints == 0 {
 		// Not Tainted

diff --git a/pkg/sensors/tracing/args.go b/pkg/sensors/tracing/args.go
@@ -540,6 +540,19 @@ func getArg(r *bytes.Reader, a argPrinter) api.MsgGenericKprobeArg {
 		arg.Permission = mode
 		arg.Label = a.label
 		return arg
+	case gt.GenericBpfCmd:
+		var output int32
+		var arg api.MsgGenericKprobeArgBpfCmd
+
+		err := binary.Read(r, binary.LittleEndian, &output)
+		if err != nil {
+			logger.GetLogger().WithError(err).Warnf("bpf_cmd type error")
+		}
+
+		arg.Index = uint64(a.index)
+		arg.Value = output
+		arg.Label = a.label
+		return arg
 	default:
 		logger.GetLogger().WithError(err).WithField("event-type", a.ty).Warnf("Unknown event type")
 	}