Skip to content

Commit 4f73f6d

Browse files
kobrinelikobrineli
committed
selectors: add matchParents selector
This adds matchParents selector for granular parents filtering in kprobes, tracepoints and lsm hooks. In some cases we need not only to filter events by current binary path, but also by parent binary path. For instance, consider there is python script, which inside calls a system call, which we want to hook. If some system processes are executing this script, we don't want to report such cases, so we might want to add selectors for parent binary, rather than for current binary, which in case of python script is always python. matchParents selectors, which works exactly in the same way except of followChildren option (which is currently will not be supported), will help to solve this problem. Signed-off-by: Kobrin Ilay <[email protected]>
1 parent f5777a0 commit 4f73f6d

File tree

20 files changed

+1070
-20
lines changed

20 files changed

+1070
-20
lines changed

‎bpf/process/generic_calls.h‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1227,7 +1227,7 @@ FUNC_INLINE int generic_retkprobe(void *ctx, struct bpf_map_def *calls, unsigned
12271227
FUNC_INLINE int generic_process_filter(void)
12281228
{
12291229
int selectors, pass, zero = 0;
1230-
struct execve_map_value *enter;
1230+
struct execve_map_value *enter, *parent;
12311231
struct msg_generic_kprobe *msg;
12321232
struct msg_execve_key *current;
12331233
struct msg_selector_data *sel;
@@ -1246,6 +1246,11 @@ FUNC_INLINE int generic_process_filter(void)
12461246
msg->common.flags |= MSG_COMMON_FLAG_PROCESS_NOT_FOUND;
12471247
}
12481248

1249+
parent = event_find_parent();
1250+
if (!parent) {
1251+
return PFILTER_PARENT_NOT_FOUND;
1252+
}
1253+
12491254
f = map_lookup_elem(&filter_map, &msg->idx);
12501255
if (!f)
12511256
return PFILTER_ERROR;
@@ -1267,7 +1272,7 @@ FUNC_INLINE int generic_process_filter(void)
12671272
if (selectors <= sel->curr)
12681273
return process_filter_done(sel, enter, current);
12691274

1270-
pass = selector_process_filter(f, sel->curr, enter, msg);
1275+
pass = selector_process_filter(f, sel->curr, enter, parent, msg);
12711276
if (pass) {
12721277
/* Verify lost that msg is not null here so recheck */
12731278
int curr = sel->curr;

‎bpf/process/pfilter.h‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -81,6 +81,7 @@ enum {
8181
PFILTER_ACCEPT = 1, // filter check passed
8282
PFILTER_REJECT = 0, // filter check failed
8383
PFILTER_CURR_NOT_FOUND = 0, // event_find_curr() failed
84+
PFILTER_PARENT_NOT_FOUND = 0, // event_find_parent() failed
8485
};
8586

8687
FUNC_INLINE int
@@ -413,7 +414,7 @@ struct nc_filter {
413414

414415
FUNC_INLINE int
415416
selector_process_filter(__u32 *f, __u32 index, struct execve_map_value *enter,
416-
struct msg_generic_kprobe *msg)
417+
struct execve_map_value *parent, struct msg_generic_kprobe *msg)
417418
{
418419
int res = PFILTER_ACCEPT;
419420
struct pid_filter *pid;
@@ -425,10 +426,13 @@ selector_process_filter(__u32 *f, __u32 index, struct execve_map_value *enter,
425426
__u32 len;
426427
__u64 i;
427428

428-
/* Do binary filter first for selector index */
429+
/* Do binary and parent filter first for selector index */
429430
if (!match_binaries(index, enter))
430431
return 0;
431432

433+
if (!match_parents(index, parent))
434+
return 0;
435+
432436
/* Find selector offset byte index */
433437
index *= 4;
434438
index += 4;

‎bpf/process/types/basic.h‎

Lines changed: 41 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1588,10 +1588,29 @@ struct {
15881588
});
15891589
} tg_mb_paths SEC(".maps");
15901590

1591-
FUNC_INLINE int match_binaries(__u32 selidx, struct execve_map_value *current)
1592-
{
1591+
// This map is used by the matchParents selectors to retrieve their options
1592+
struct {
1593+
__uint(type, BPF_MAP_TYPE_ARRAY);
1594+
__uint(max_entries, MAX_SELECTORS);
1595+
__type(key, __u32); /* selector id */
1596+
__type(value, struct match_binaries_sel_opts);
1597+
} tg_mp_sel_opts SEC(".maps");
1598+
1599+
struct {
1600+
__uint(type, BPF_MAP_TYPE_ARRAY_OF_MAPS);
1601+
__uint(max_entries, MAX_SELECTORS); // only one matchParents per selector
1602+
__type(key, __u32);
1603+
__array(
1604+
values, struct {
1605+
__uint(type, BPF_MAP_TYPE_HASH);
1606+
__uint(max_entries, 1);
1607+
__type(key, __u8[MATCH_BINARIES_PATH_MAX_LENGTH]);
1608+
__type(value, __u8);
1609+
});
1610+
} tg_mp_paths SEC(".maps");
1611+
1612+
FUNC_INLINE int __match_binaries(struct execve_map_value *current, struct match_binaries_sel_opts *selector_options, void *path_map) {
15931613
bool match = 0;
1594-
void *path_map;
15951614
__u8 *found_key;
15961615
#ifdef __LARGE_BPF_PROG
15971616
struct string_prefix_lpm_trie prefix_key;
@@ -1600,12 +1619,8 @@ FUNC_INLINE int match_binaries(__u32 selidx, struct execve_map_value *current)
16001619

16011620
int zero = 0;
16021621
#endif /* __LARGE_BPF_PROG */
1603-
1604-
struct match_binaries_sel_opts *selector_options;
1605-
1606-
// retrieve the selector_options for the matchBinaries, if it's NULL it
1607-
// means there is not matchBinaries in this selector.
1608-
selector_options = map_lookup_elem(&tg_mb_sel_opts, &selidx);
1622+
1623+
// If selector_options is NULL, then there is no matchBinaries/matchParents in this selector.
16091624
if (selector_options) {
16101625
if (selector_options->op == op_filter_none)
16111626
return 1; // matchBinaries selector is empty <=> match
@@ -1631,7 +1646,6 @@ FUNC_INLINE int match_binaries(__u32 selidx, struct execve_map_value *current)
16311646
break;
16321647
}
16331648

1634-
path_map = map_lookup_elem(&tg_mb_paths, &selidx);
16351649
if (!path_map)
16361650
return 0;
16371651
found_key = map_lookup_elem(path_map, current->bin.path);
@@ -1679,10 +1693,26 @@ FUNC_INLINE int match_binaries(__u32 selidx, struct execve_map_value *current)
16791693
return is_not_operator(selector_options->op) ? !match : match;
16801694
}
16811695

1682-
// no matchBinaries selector <=> match
1696+
// no selector <=> match
16831697
return 1;
16841698
}
16851699

1700+
FUNC_INLINE int match_binaries(__u32 selidx, struct execve_map_value *current)
1701+
{
1702+
struct match_binaries_sel_opts *selector_options = map_lookup_elem(&tg_mb_sel_opts, &selidx);
1703+
void *path_map = map_lookup_elem(&tg_mb_paths, &selidx);
1704+
1705+
return __match_binaries(current, selector_options, path_map);
1706+
}
1707+
1708+
FUNC_INLINE int match_parents(__u32 selidx, struct execve_map_value *parent)
1709+
{
1710+
struct match_binaries_sel_opts *selector_options = map_lookup_elem(&tg_mp_sel_opts, &selidx);
1711+
void *path_map = map_lookup_elem(&tg_mp_paths, &selidx);
1712+
1713+
return __match_binaries(parent, selector_options, path_map);
1714+
}
1715+
16861716
FUNC_INLINE char *
16871717
get_arg(struct msg_generic_kprobe *e, __u32 index)
16881718
{

‎install/kubernetes/tetragon/crds-yaml/cilium.io_tracingpolicies.yaml‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -874,6 +874,30 @@ spec:
874874
- values
875875
type: object
876876
type: array
877+
matchParents:
878+
description: A list of process parent exec name filters.
879+
items:
880+
properties:
881+
operator:
882+
description: Filter operation.
883+
enum:
884+
- In
885+
- NotIn
886+
- Prefix
887+
- NotPrefix
888+
- Postfix
889+
- NotPostfix
890+
type: string
891+
values:
892+
description: Value to compare the argument against.
893+
items:
894+
type: string
895+
type: array
896+
required:
897+
- operator
898+
- values
899+
type: object
900+
type: array
877901
matchReturnActions:
878902
description: A list of actions to execute when MatchReturnArgs
879903
selector matches
@@ -1626,6 +1650,30 @@ spec:
16261650
- values
16271651
type: object
16281652
type: array
1653+
matchParents:
1654+
description: A list of process parent exec name filters.
1655+
items:
1656+
properties:
1657+
operator:
1658+
description: Filter operation.
1659+
enum:
1660+
- In
1661+
- NotIn
1662+
- Prefix
1663+
- NotPrefix
1664+
- Postfix
1665+
- NotPostfix
1666+
type: string
1667+
values:
1668+
description: Value to compare the argument against.
1669+
items:
1670+
type: string
1671+
type: array
1672+
required:
1673+
- operator
1674+
- values
1675+
type: object
1676+
type: array
16291677
matchReturnActions:
16301678
description: A list of actions to execute when MatchReturnArgs
16311679
selector matches
@@ -2414,6 +2462,30 @@ spec:
24142462
- values
24152463
type: object
24162464
type: array
2465+
matchParents:
2466+
description: A list of process parent exec name filters.
2467+
items:
2468+
properties:
2469+
operator:
2470+
description: Filter operation.
2471+
enum:
2472+
- In
2473+
- NotIn
2474+
- Prefix
2475+
- NotPrefix
2476+
- Postfix
2477+
- NotPostfix
2478+
type: string
2479+
values:
2480+
description: Value to compare the argument against.
2481+
items:
2482+
type: string
2483+
type: array
2484+
required:
2485+
- operator
2486+
- values
2487+
type: object
2488+
type: array
24172489
matchReturnActions:
24182490
description: A list of actions to execute when MatchReturnArgs
24192491
selector matches
@@ -3152,6 +3224,30 @@ spec:
31523224
- values
31533225
type: object
31543226
type: array
3227+
matchParents:
3228+
description: A list of process parent exec name filters.
3229+
items:
3230+
properties:
3231+
operator:
3232+
description: Filter operation.
3233+
enum:
3234+
- In
3235+
- NotIn
3236+
- Prefix
3237+
- NotPrefix
3238+
- Postfix
3239+
- NotPostfix
3240+
type: string
3241+
values:
3242+
description: Value to compare the argument against.
3243+
items:
3244+
type: string
3245+
type: array
3246+
required:
3247+
- operator
3248+
- values
3249+
type: object
3250+
type: array
31553251
matchReturnActions:
31563252
description: A list of actions to execute when MatchReturnArgs
31573253
selector matches
@@ -3882,6 +3978,30 @@ spec:
38823978
- values
38833979
type: object
38843980
type: array
3981+
matchParents:
3982+
description: A list of process parent exec name filters.
3983+
items:
3984+
properties:
3985+
operator:
3986+
description: Filter operation.
3987+
enum:
3988+
- In
3989+
- NotIn
3990+
- Prefix
3991+
- NotPrefix
3992+
- Postfix
3993+
- NotPostfix
3994+
type: string
3995+
values:
3996+
description: Value to compare the argument against.
3997+
items:
3998+
type: string
3999+
type: array
4000+
required:
4001+
- operator
4002+
- values
4003+
type: object
4004+
type: array
38854005
matchReturnActions:
38864006
description: A list of actions to execute when MatchReturnArgs
38874007
selector matches

0 commit comments

Comments
 (0)