Add support to exclude valid processes from dump processCache

When running ./tetra dump processcache we can get all processes in the
user-space process cache. Out of these, we can use --skip-zero-refcnt to
exclude processes with refCnt equals to 0. These are processes that will
be removed from the processCache soon.

Out of these processes with refCnt not equal to 0, most of them are
nornal running processes that also exist in the execve_map.

This patch adds another command line option
--exclude-execve-map-processes that excludes processes that exist in the
execve_map.

The remaining processes (if any) have possibly an error in the reference
counting.

Signed-off-by: Anastasios Papagiannis <tasos.papagiannnis@gmail.com>

api/v1/tetragon/sensors.proto

@@ -145,6 +145,7 @@ enum LogLevel {
 
 message DumpProcessCacheReqArgs {
 	bool skip_zero_refcnt = 1;
+	bool exclude_execve_map_processes = 2;
 }
 
 message ProcessInternal {

cmd/tetra/dump/dump.go

@@ -107,6 +107,7 @@ func dumpExecveMap(fname string) {
 
 func dumpProcessCache() *cobra.Command {
 	skipZeroRefcnt := false
+	excludeExecveMapProcesses := false
 	var maxCallRecvMsgSize int
 
 	ret := &cobra.Command{
@@ -125,7 +126,8 @@ func dumpProcessCache() *cobra.Command {
 				Flag: tetragon.ConfigFlag_CONFIG_FLAG_DUMP_PROCESS_CACHE,
 				Arg: &tetragon.GetDebugRequest_Dump{
 					Dump: &tetragon.DumpProcessCacheReqArgs{
-						SkipZeroRefcnt: skipZeroRefcnt,
+						SkipZeroRefcnt:            skipZeroRefcnt,
+						ExcludeExecveMapProcesses: excludeExecveMapProcesses,
 					},
 				},
 			}
@@ -152,6 +154,7 @@ func dumpProcessCache() *cobra.Command {
 
 	flags := ret.Flags()
 	flags.BoolVar(&skipZeroRefcnt, "skip-zero-refcnt", skipZeroRefcnt, "skip entries with zero refcnt")
+	flags.BoolVar(&excludeExecveMapProcesses, "exclude-execve-map-processes", excludeExecveMapProcesses, "exclude processes that also exist in the execve_map")
 	flags.IntVar(&maxCallRecvMsgSize, "max-recv-size", 4194304, "The maximum message size in bytes the client can receive. Default is gRPC 4MB default.")
 
 	return ret

pkg/process/cache.go

@@ -5,11 +5,15 @@ package process
 
 import (
 	"fmt"
+	"path/filepath"
 	"sync/atomic"
 	"time"
 
+	"github.com/cilium/ebpf"
 	"github.com/cilium/tetragon/api/v1/tetragon"
+	"github.com/cilium/tetragon/pkg/defaults"
 	"github.com/cilium/tetragon/pkg/logger"
+	"github.com/cilium/tetragon/pkg/sensors/exec/execvemap"
 	lru "github.com/hashicorp/golang-lru/v2"
 	"google.golang.org/protobuf/types/known/wrapperspb"
 )
@@ -196,11 +200,26 @@ func (pc *Cache) len() int {
 }
 
 func (pc *Cache) dump(opts *tetragon.DumpProcessCacheReqArgs) []*tetragon.ProcessInternal {
+	execveMapPath := filepath.Join(defaults.DefaultMapRoot, defaults.DefaultMapPrefix, "execve_map")
+	execveMap, err := ebpf.LoadPinnedMap(execveMapPath, &ebpf.LoadPinOptions{ReadOnly: true})
+	if err != nil {
+		logger.GetLogger().WithError(err).Warn("failed to open execve_map")
+		return []*tetragon.ProcessInternal{}
+	}
+	defer execveMap.Close()
+
 	var processes []*tetragon.ProcessInternal
 	for _, v := range pc.cache.Values() {
 		if opts.SkipZeroRefcnt && v.refcnt == 0 {
 			continue
 		}
+		if opts.ExcludeExecveMapProcesses {
+			var val execvemap.ExecveValue
+			if err := execveMap.Lookup(&execvemap.ExecveKey{Pid: v.process.Pid.Value}, &val); err == nil {
+				// pid exists in the execve_map, so skip this process
+				continue
+			}
+		}
 		processes = append(processes, &tetragon.ProcessInternal{
 			Process:   v.process,
 			Refcnt:    &wrapperspb.UInt32Value{Value: v.refcnt},