Skip to content

feat(driver): add filename parameter to PPME_SYSCALL_EXECVE_19_X#2735

Merged
poiana merged 2 commits intomasterfrom
ekoops/add-execve-filename
Dec 8, 2025
Merged

feat(driver): add filename parameter to PPME_SYSCALL_EXECVE_19_X#2735
poiana merged 2 commits intomasterfrom
ekoops/add-execve-filename

Conversation

@ekoops
Copy link
Copy Markdown
Contributor

@ekoops ekoops commented Dec 4, 2025 •
edited by deepskyblue86
Loading

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-savefile

/area tests

Does this PR require a change in the driver versions?

/version driver-SCHEMA-version-minor

What this PR does / why we need it:

As highlighted in #2709, the filename parameter, originally present in PPME_SYSCALL_EXECVE_19_E, could be useful in some circumstances.
This PR adds the filename parameter to PPME_SYSCALL_EXECVE_19_X, so users can continue to use it in rules related to events of type execve.

Which issue(s) this PR fixes:

Fixes #2709

Special notes for your reviewer:

/milestone next-driver

Does this PR introduce a user-facing change?:

NONE

@poiana poiana added this to the next-driver milestone Dec 4, 2025
@poiana poiana requested review from hbrueckner and terror96 December 4, 2025 16:45
@poiana poiana added the approved label Dec 4, 2025
@ekoops ekoops mentioned this pull request Dec 4, 2025
Closed
@ekoops ekoops force-pushed the ekoops/add-execve-filename branch from a3f831a to db4bd12 Compare December 4, 2025 16:49
@github-actions
Copy link
Copy Markdown

github-actions bot commented Dec 4, 2025 •
edited
Loading

X64 kernel testing matrix

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-5.10 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
amazonlinux2023-6.1 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.0 🟢 🟢 🟢 🟢 🟢 🟢
archlinux-6.7 🟢 🟢 🟢 🟢 🟢 🟢
centos-3.10 🟢 🟢 🟢 🟡 🟡 🟡
centos-4.18 🟢 🟢 🟢 🟢 🟢 🟢
centos-5.14 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.17 🟢 🟢 🟢 🟢 🟢 🟢
fedora-5.8 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-4.14 🟢 🟢 🟢 🟢 🟢 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-5.4 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-5.8 🟢 🟢 🟢 🟢 🟢 🟡
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

ARM64 kernel testing matrix

KERNEL CMAKE-CONFIGURE KMOD BUILD KMOD SCAP-OPEN BPF-PROBE BUILD BPF-PROBE SCAP-OPEN MODERN-BPF SCAP-OPEN
amazonlinux2-5.4 🟢 🟢 🟢 🟢 🟢 🟡
amazonlinux2022-5.15 🟢 🟢 🟢 🟢 🟢 🟢
fedora-6.2 🟢 🟢 🟢 🟢 🟢 🟢
oraclelinux-4.14 🟢 🟢 🟢 🟡 🟡 🟡
oraclelinux-5.15 🟢 🟢 🟢 🟢 🟢 🟢
ubuntu-6.5 🟢 🟢 🟢 🟢 🟢 🟢

@codecov
Copy link
Copy Markdown

codecov bot commented Dec 4, 2025 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 77.03%. Comparing base (69417c3) to head (23e2af9).
⚠️ Report is 2 commits behind head on master.

Additional details and impacted files 
@@           Coverage Diff           @@
##           master    #2735   +/-   ##
=======================================
  Coverage   77.02%   77.03%           
=======================================
  Files         296      296           
  Lines       30818    30829   +11     
  Branches     4670     4670           
=======================================
+ Hits        23738    23749   +11     
  Misses       7080     7080
Flag Coverage Δ
libsinsp 77.03% <100.00%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ekoops ekoops force-pushed the ekoops/add-execve-filename branch 2 times, most recently from 4d0da3c to 15d7ae3 Compare December 5, 2025 13:37
leogr
leogr previously approved these changes Dec 5, 2025
View reviewed changes
@poiana poiana added the lgtm label Dec 5, 2025
@ekoops
Copy link
Copy Markdown
Contributor Author

ekoops commented Dec 5, 2025

/hold

ekoops added 2 commits December 5, 2025 17:35
@ekoops
fix(driver/bpf): send \0 in case of empty strings from user memory
015188b 
Differently from what `bpf_probe_read_user_str()` documentation says,
the helper indeed returns 0 in case of empty strings. Take it into
account and push a single NULL terminator character.

Ref: 88ab162

Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
@ekoops
feat(driver): add filename parameter to PPME_SYSCALL_EXECVE_19_X
23e2af9 
Signed-off-by: Leonardo Di Giovanna <leonardodigiovanna1@gmail.com>
@ekoops ekoops force-pushed the ekoops/add-execve-filename branch from 15d7ae3 to 23e2af9 Compare December 5, 2025 16:35
@poiana poiana added size/XXL and removed size/XL labels Dec 5, 2025
@ekoops
Copy link
Copy Markdown
Contributor Author

ekoops commented Dec 5, 2025

/remove-hold

@ekoops ekoops requested a review from leogr December 5, 2025 16:37
@github-actions
Copy link
Copy Markdown

github-actions bot commented Dec 5, 2025

Perf diff from master - unit tests

     1.74%     +2.11%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_add_ref_lock_nothrow()
     2.00%     -1.66%  [.] std::__shared_count<(__gnu_cxx::_Lock_policy)2>::_M_get_use_count() const
     2.32%     -0.43%  [.] std::__shared_ptr<sinsp_threadinfo, (__gnu_cxx::_Lock_policy)2>::__shared_ptr(std::__weak_ptr<sinsp_threadinfo, (__gnu_cxx::_Lock_policy)2> const&, std::nothrow_t)
     1.79%     -0.40%  [.] sinsp_threadinfo::update_main_fdtable()
     1.89%     +0.27%  [.] std::_Hashtable<conversion_key, std::pair<conversion_key const, conversion_info>, std::allocator<std::pair<conversion_key const, conversion_info> >, std::__detail::_Select1st, std::equal_to<conversion_key>, std::hash<conversion_key>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<true, false, true> >::_M_find_before_node(unsigned long, conversion_key const&, unsigned long) const
     0.85%     +0.24%  [.] thread_group_info::get_first_thread() const
     5.44%     +0.20%  [.] sinsp::next(sinsp_evt**)
     2.91%     +0.19%  [.] std::_Sp_counted_base<(__gnu_cxx::_Lock_policy)2>::_M_release()
     0.20%     +0.18%  [.] is_schedswitch_event(unsigned short)
     0.51%     -0.18%  [.] sinsp_evt_param::data_and_len_with_legacy_null_encoding() const

Heap diff from master - unit tests

peak heap memory consumption: -520B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: -80B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            +0.0124         +0.0123           236           239           236           238
BM_sinsp_split_median                                          +0.0126         +0.0122           235           238           235           238
BM_sinsp_split_stddev                                          +0.5376         +0.4805             1             2             1             1
BM_sinsp_split_cv                                              +0.5188         +0.4626             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  +0.0817         +0.0818            68            73            68            73
BM_sinsp_concatenate_paths_relative_path_median                +0.0869         +0.0868            68            73            68            73
BM_sinsp_concatenate_paths_relative_path_stddev                +0.9693         +0.9842             1             1             1             1
BM_sinsp_concatenate_paths_relative_path_cv                    +0.8205         +0.8341             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     -0.0358         -0.0358            43            41            43            41
BM_sinsp_concatenate_paths_empty_path_median                   -0.0631         -0.0632            43            41            43            41
BM_sinsp_concatenate_paths_empty_path_stddev                   -0.1129         -0.1148             1             1             1             1
BM_sinsp_concatenate_paths_empty_path_cv                       -0.0800         -0.0819             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  +0.0659         +0.0660            68            73            68            73
BM_sinsp_concatenate_paths_absolute_path_median                +0.0663         +0.0664            68            73            68            73
BM_sinsp_concatenate_paths_absolute_path_stddev                -0.4437         -0.4326             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_cv                    -0.4781         -0.4678             0             0             0             0

deepskyblue86
deepskyblue86 approved these changes Dec 5, 2025
View reviewed changes
Copy link
Copy Markdown
Member

@deepskyblue86 deepskyblue86 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

terror96
terror96 approved these changes Dec 8, 2025
View reviewed changes
Copy link
Copy Markdown
Contributor

@terror96 terror96 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@github-project-automation github-project-automation bot moved this from Todo to In progress in Falco Roadmap Dec 8, 2025
@poiana
Copy link
Copy Markdown
Contributor

poiana commented Dec 8, 2025

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: deepskyblue86, ekoops, terror96

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details Needs approval from an approver in each of these files:
  • OWNERS [deepskyblue86,ekoops]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit a4f3dcb into master Dec 8, 2025
57 checks passed
@poiana poiana deleted the ekoops/add-execve-filename branch December 8, 2025 09:02
@github-project-automation github-project-automation bot moved this from In progress to Done in Falco Roadmap Dec 8, 2025
@ekoops ekoops mentioned this pull request Dec 19, 2025
Closed
15 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@terror96 terror96 terror96 approved these changes

@deepskyblue86 deepskyblue86 deepskyblue86 approved these changes

@hbrueckner hbrueckner Awaiting requested review from hbrueckner

@leogr leogr Awaiting requested review from leogr

Assignees

@leogr leogr

@terror96 terror96

@deepskyblue86 deepskyblue86

Labels

approved area/driver-bpf area/driver-kmod area/driver-modern-bpf area/libscap-engine-savefile area/tests dco-signoff: yes kind/feature New feature or request lgtm release-note-none size/XXL

Projects

Falco Roadmap
Status: Done

Milestone

9.1.0+driver

Development

Successfully merging this pull request may close these issues.

Missing "filename" argument to execve syscall in libscap 0.22.x

5 participants

@ekoops @poiana @leogr @terror96 @deepskyblue86