From d667639fb43d0e417ad9207bfbd9de78af52022e Mon Sep 17 00:00:00 2001
From: Sylvain Baubeau <sylvain.baubeau@datadoghq.com>
Date: Tue, 3 Dec 2024 13:27:45 +0100
Subject: [PATCH] [CWS] Fix cgroup dentry resolution for RHEL 7 (#31666)

---
 pkg/security/probe/probe_ebpf.go | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/pkg/security/probe/probe_ebpf.go b/pkg/security/probe/probe_ebpf.go
index 62e0782fa38dc..b918a87aabdf4 100644
--- a/pkg/security/probe/probe_ebpf.go
+++ b/pkg/security/probe/probe_ebpf.go
@@ -830,7 +830,11 @@ func (p *EBPFProbe) handleEvent(CPU int, data []byte) {
 		if pce != nil {
 			path, err := p.Resolvers.DentryResolver.Resolve(event.CgroupWrite.File.PathKey, true)
 			if err == nil && path != "" {
-				cgroupID := containerutils.CGroupID(filepath.Dir(string(path)))
+				if !p.kernelVersion.IsRH7Kernel() {
+					path = filepath.Dir(string(path))
+				}
+
+				cgroupID := containerutils.CGroupID(path)
 				pce.CGroup.CGroupID = cgroupID
 				pce.Process.CGroup.CGroupID = cgroupID
 				cgroupFlags := containerutils.CGroupFlags(event.CgroupWrite.CGroupFlags)