Skip to content

feat(userspace/libsinsp): improve recvmsg SCM_RIGHTS cmsg handling#2262

Merged
poiana merged 2 commits intofalcosecurity:masterfrom
ekoops:ekoops/scm-rights-procfs-scan
Feb 4, 2025
Merged

feat(userspace/libsinsp): improve recvmsg SCM_RIGHTS cmsg handling#2262
poiana merged 2 commits intofalcosecurity:masterfrom
ekoops:ekoops/scm-rights-procfs-scan

Conversation

@ekoops
Copy link
Copy Markdown
Contributor

@ekoops ekoops commented Jan 29, 2025

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

This enhances file descriptor handling in the context of SCM_RIGHTS control message processing for recvmsg events. Specifically:

  • it introduces a new API in libscap for getting single fd info
  • it handles all cmsghdr and all file descriptors contained in SCM_RIGHTS control messages, by selectively call the new API on them, instead of entirely scanning the entire procfs fd directory each time.
  • it replaces readlink + sscanf calls with a single call to stat for retrieving the inode number of a network namespace in scap_fd_scan_fd_dir and scap_fd_get_fdinfo

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

@ekoops
feat(userspace/libscap): add API for getting single fd info
710a236 
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
@ekoops ekoops changed the title feat(userspace/libsinsp): improve recvmsg SCM_RIGHTS cmsg handling feat(userspace/libsinsp): improve recvmsg SCM_RIGHTS cmsg handling Jan 29, 2025
@FedeDP
Copy link
Copy Markdown
Contributor

FedeDP commented Jan 29, 2025

/milestone 0.21.0

@poiana poiana added this to the 0.21.0 milestone Jan 29, 2025
@github-actions
Copy link
Copy Markdown

github-actions bot commented Jan 29, 2025 •
edited
Loading

Perf diff from master - unit tests

    10.00%     +0.51%  [.] sinsp_parser::reset
     2.39%     +0.43%  [.] sinsp_parser::process_event
     1.19%     +0.35%  [.] libsinsp::sinsp_suppress::process_event
     5.22%     +0.33%  [.] next_event_from_file
     1.04%     -0.33%  [.] std::vector<sinsp_evt_param, std::allocator<sinsp_evt_param> >::emplace_back<sinsp_evt*, unsigned int&, char const*, unsigned long&>
     1.70%     -0.32%  [.] sinsp::fetch_next_event
     1.13%     -0.29%  [.] sinsp_evt::get_syscall_return_value
     2.75%     +0.28%  [.] sinsp_thread_manager::find_thread
     2.34%     +0.27%  [.] is_conversion_needed
     1.47%     +0.26%  [.] sinsp_evt_filter::sinsp_evt_filter

Heap diff from master - unit tests

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 0B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            +0.0387         +0.0387           144           149           144           149
BM_sinsp_split_median                                          +0.0381         +0.0381           144           149           144           149
BM_sinsp_split_stddev                                          -0.0183         -0.0202             1             1             1             1
BM_sinsp_split_cv                                              -0.0549         -0.0567             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  +0.1208         +0.1208            57            64            57            64
BM_sinsp_concatenate_paths_relative_path_median                +0.1177         +0.1177            57            64            57            64
BM_sinsp_concatenate_paths_relative_path_stddev                -0.5385         -0.5383             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_cv                    -0.5882         -0.5880             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0384         -0.0384            25            24            25            24
BM_sinsp_concatenate_paths_empty_path_median                   -0.0380         -0.0380            25            24            25            24
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.8459         -0.8472             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       -0.8398         -0.8411             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  -0.0270         -0.0269            57            55            57            55
BM_sinsp_concatenate_paths_absolute_path_median                -0.0653         -0.0652            57            53            57            53
BM_sinsp_concatenate_paths_absolute_path_stddev                +5.6359         +5.6367             0             3             0             3
BM_sinsp_concatenate_paths_absolute_path_cv                    +5.8201         +5.8203             0             0             0             0
BM_sinsp_split_container_image_mean                            +0.0285         +0.0286           392           403           392           403
BM_sinsp_split_container_image_median                          +0.0280         +0.0281           392           403           392           403
BM_sinsp_split_container_image_stddev                          -0.4869         -0.4874             3             1             3             1
BM_sinsp_split_container_image_cv                              -0.5011         -0.5016             0             0             0             0

@codecov
Copy link
Copy Markdown

codecov bot commented Jan 29, 2025 •
edited
Loading

Codecov Report

Attention: Patch coverage is 0% with 35 lines in your changes missing coverage. Please review.

Project coverage is 75.29%. Comparing base (3476089) to head (3b34a3a).
Report is 3 commits behind head on master.

Files with missing lines Patch % Lines
userspace/libsinsp/parsers.cpp 0.00% 35 Missing ⚠️
Additional details and impacted files 
@@            Coverage Diff             @@
##           master    #2262      +/-   ##
==========================================
- Coverage   75.34%   75.29%   -0.05%     
==========================================
  Files         279      279              
  Lines       34368    34389      +21     
  Branches     5872     5878       +6     
==========================================
- Hits        25894    25893       -1     
- Misses       8474     8496      +22
Flag Coverage Δ
libsinsp 75.29% <0.00%> (-0.05%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@ekoops
Copy link
Copy Markdown
Contributor Author

ekoops commented Jan 29, 2025

/hold

@ekoops ekoops force-pushed the ekoops/scm-rights-procfs-scan branch 9 times, most recently from db5ffd2 to 7c9c7e7 Compare January 31, 2025 14:57
@ekoops
Copy link
Copy Markdown
Contributor Author

ekoops commented Feb 3, 2025

/unhold

FedeDP
FedeDP previously approved these changes Feb 3, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Feb 3, 2025
@poiana
Copy link
Copy Markdown
Contributor

poiana commented Feb 3, 2025

LGTM label has been added.

DetailsGit tree hash: ed418fb1d1833b1bb60fc0d7f582962a9e5720f6

@poiana poiana added the approved label Feb 3, 2025
@ekoops
Copy link
Copy Markdown
Contributor Author

ekoops commented Feb 3, 2025

/hold

@ekoops @therealbobo
feat(userspace/libsinsp): improve recvmsg SCM_RIGHTS cmsg handling
3b34a3a 
Parse all control messages instead of parsing just the first one.
Leverage the new scap_get_fdinfo API to get info only from the file
in procfs associated to the file descriptor, instead of scanning each
time the entire procfs fd directory.

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
Co-authored-by: Roberto Scolaro <roberto.scolaro21@gmail.com>
@ekoops ekoops force-pushed the ekoops/scm-rights-procfs-scan branch from 7c9c7e7 to 3b34a3a Compare February 3, 2025 10:56
@poiana poiana removed the lgtm label Feb 3, 2025
@poiana poiana requested a review from FedeDP February 3, 2025 10:56
@ekoops
Copy link
Copy Markdown
Contributor Author

ekoops commented Feb 3, 2025

/unhold

FedeDP
FedeDP approved these changes Feb 3, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Feb 3, 2025
@poiana
Copy link
Copy Markdown
Contributor

poiana commented Feb 3, 2025

LGTM label has been added.

DetailsGit tree hash: 582885ca14dccf5450fcef4854563bef35caba4a

@poiana
Copy link
Copy Markdown
Contributor

poiana commented Feb 3, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ekoops, FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit e1637e4 into falcosecurity:master Feb 4, 2025
@ekoops ekoops deleted the ekoops/scm-rights-procfs-scan branch February 26, 2025 13:30
@bevanjkay bevanjkay mentioned this pull request May 20, 2025
Closed
@deepskyblue86 deepskyblue86 mentioned this pull request Dec 19, 2025
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@leogr leogr leogr approved these changes

@FedeDP FedeDP FedeDP approved these changes

@hbrueckner hbrueckner Awaiting requested review from hbrueckner

@jasondellaluce jasondellaluce Awaiting requested review from jasondellaluce

Assignees

@leogr leogr

@FedeDP FedeDP

Labels

approved area/libscap area/libscap-engine-gvisor area/libsinsp dco-signoff: yes kind/feature New feature or request lgtm release-note-none size/XL

Projects

Falco Roadmap
Archived in project

Milestone

0.21.0

Development

Successfully merging this pull request may close these issues.

4 participants

@ekoops @FedeDP @poiana @leogr