diff --git a/pkg/api/tracingapi/client_kprobe.go b/pkg/api/tracingapi/client_kprobe.go index b94db1a697d..1fc5e5f4c48 100644 --- a/pkg/api/tracingapi/client_kprobe.go +++ b/pkg/api/tracingapi/client_kprobe.go @@ -317,6 +317,20 @@ func (m MsgGenericKprobeArgCapability) IsReturnArg() bool { return m.Index == ReturnArgIndex } +type MsgGenericKprobeArgBpfCmd struct { + Index uint64 + Value int32 + Label string +} + +func (m MsgGenericKprobeArgBpfCmd) GetIndex() uint64 { + return m.Index +} + +func (m MsgGenericKprobeArgBpfCmd) IsReturnArg() bool { + return m.Index == ReturnArgIndex +} + type MsgGenericKernelCapType struct { Caps uint64 } diff --git a/pkg/btf/validation.go b/pkg/btf/validation.go index ec8a55e58e2..83eba5222d9 100644 --- a/pkg/btf/validation.go +++ b/pkg/btf/validation.go @@ -335,7 +335,7 @@ func typesCompatible(specTy string, kernelTy string) bool { case "struct user_namespace *": return true } - case "capability": + case "capability", "bpf_cmd": switch kernelTy { case "int": return true diff --git a/pkg/generictypes/generictypes.go b/pkg/generictypes/generictypes.go index d9f0d99e44c..90bbd3296bd 100644 --- a/pkg/generictypes/generictypes.go +++ b/pkg/generictypes/generictypes.go @@ -57,6 +57,8 @@ const ( GenericNetDev = 39 + GenericBpfCmd = 40 + GenericNopType = -1 GenericInvalidType = -2 ) @@ -108,6 +110,7 @@ var GenericStringToType = map[string]int{ "linux_binprm": GenericLinuxBinprmType, "data_loc": GenericDataLoc, "net_device": GenericNetDev, + "bpf_cmd": GenericBpfCmd, } var GenericTypeToStringTable = map[int]string{ @@ -150,6 +153,7 @@ var GenericTypeToStringTable = map[int]string{ GenericLinuxBinprmType: "linux_binprm", GenericDataLoc: "data_loc", GenericNetDev: "net_device", + GenericBpfCmd: "bpf_cmd", GenericInvalidType: "", } diff --git a/pkg/grpc/tracing/tracing.go b/pkg/grpc/tracing/tracing.go index c447af54d40..d9ff2fc2cf3 100644 --- a/pkg/grpc/tracing/tracing.go +++ b/pkg/grpc/tracing/tracing.go @@ -265,6 +265,9 @@ func getKprobeArgument(arg tracingapi.MsgGenericKprobeArg) *tetragon.KprobeArgum } a.Arg = &tetragon.KprobeArgument_LinuxBinprmArg{LinuxBinprmArg: lArg} a.Label = e.Label + case api.MsgGenericKprobeArgBpfCmd: + a.Arg = &tetragon.KprobeArgument_BpfCmdArg{BpfCmdArg: kernel.GetBpfCmd(e.Value)} + a.Label = e.Label default: logger.GetLogger().WithField("arg", e).Warnf("unexpected type: %T", e) } diff --git a/pkg/reader/kernel/kernel.go b/pkg/reader/kernel/kernel.go index 6344075dea4..49d702bb423 100644 --- a/pkg/reader/kernel/kernel.go +++ b/pkg/reader/kernel/kernel.go @@ -7,6 +7,10 @@ import ( "github.com/cilium/tetragon/api/v1/tetragon" ) +func GetBpfCmd(cmd int32) tetragon.BpfCmd { + return tetragon.BpfCmd(cmd) +} + func GetTaintedBitsTypes(taints uint64) []tetragon.TaintedBitsType { if taints == 0 { // Not Tainted diff --git a/pkg/sensors/tracing/args.go b/pkg/sensors/tracing/args.go index f9a673cf596..429f3e2319f 100644 --- a/pkg/sensors/tracing/args.go +++ b/pkg/sensors/tracing/args.go @@ -540,6 +540,19 @@ func getArg(r *bytes.Reader, a argPrinter) api.MsgGenericKprobeArg { arg.Permission = mode arg.Label = a.label return arg + case gt.GenericBpfCmd: + var output int32 + var arg api.MsgGenericKprobeArgBpfCmd + + err := binary.Read(r, binary.LittleEndian, &output) + if err != nil { + logger.GetLogger().WithError(err).Warnf("bpf_cmd type error") + } + + arg.Index = uint64(a.index) + arg.Value = output + arg.Label = a.label + return arg default: logger.GetLogger().WithError(err).WithField("event-type", a.ty).Warnf("Unknown event type") }