-
Notifications
You must be signed in to change notification settings - Fork 165
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Enhancements to initial scan of /proc, for supportability
- Support terminating scan after specified timeout - Support periodic log messages to report progress - API to specify timeout, log interval, and log function - Add last PID and total FDs processed, to /proc scan progress messages - Enhance scap_open args and logic to record debug_log_fn and parameters - Reworked /proc scan to reduce complexity and nesting depth - Pass through API to specify log/timeout parameters to libscap /proc scan Signed-off-by: Joseph Pittman <[email protected]>
- Loading branch information
1 parent
a6efb4a
commit 89a8a08
Showing
12 changed files
with
386 additions
and
16 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| /* | ||
| Copyright (C) 2022 The Falco Authors. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
| #ifndef __CLOCK_HELPERS_H | ||
| #define __CLOCK_HELPERS_H | ||
|
|
||
| #define SCAP_GET_CUR_TS_MS_CONTEXT_INIT ((uint64_t)0) | ||
| #define SCAP_GET_CUR_TS_MS_CONTEXT_ERROR_FLAG ((uint64_t)0x8000000000000000) | ||
| #define SCAP_GET_CUR_TS_MS_CONTEXT_PREV_VALUE_MASK ((uint64_t)0x7fffffffffffffff) | ||
|
|
||
| #define S_TO_MS(_sec) (((uint64_t)_sec) * (uint64_t)1000) | ||
| #define NS_TO_MS(_ns) (((uint64_t)_ns) / ((uint64_t)(1000 * 1000))) | ||
|
|
||
| /** | ||
| * Return monotonically increasing time in ms. | ||
| * Caller initializes context to SCAP_GET_CUR_TS_MS_CONTEXT_INIT, | ||
| * Function uses and updates context, to recognize and handle the | ||
| * following cases: | ||
| * - failed clock_gettime() system call | ||
| * - non-monotonic behavior of CLOCK_MONOTONIC | ||
| * - time values that cannot be represented in uint64_t number of msec | ||
| */ | ||
| static __always_inline uint64_t scap_get_monotonic_ts_ms(uint64_t* context) | ||
| { | ||
| // Record previously reported time; will be 0 for first call. | ||
| uint64_t prev_time = ((*context) & SCAP_GET_CUR_TS_MS_CONTEXT_PREV_VALUE_MASK); | ||
|
|
||
| // If context indicates error already detected, just return the | ||
| // last reported time | ||
| if ((*context) & SCAP_GET_CUR_TS_MS_CONTEXT_ERROR_FLAG) | ||
| { | ||
| return prev_time; | ||
| } | ||
|
|
||
| // Fetch current monotonic time from kernel | ||
| struct timespec ts; | ||
| if (clock_gettime(CLOCK_MONOTONIC, &ts)) | ||
| { | ||
| // System call failed. | ||
| // Set error flag | ||
| *context |= SCAP_GET_CUR_TS_MS_CONTEXT_ERROR_FLAG; | ||
|
|
||
| // Return previously reported time, now frozen | ||
| return prev_time; | ||
| } | ||
|
|
||
| // Form new time | ||
| uint64_t new_time = S_TO_MS(ts.tv_sec) + NS_TO_MS(ts.tv_nsec); | ||
|
|
||
| // Check for overflow or non-monotonic behavior | ||
| if ((new_time & SCAP_GET_CUR_TS_MS_CONTEXT_ERROR_FLAG) || | ||
| (new_time < prev_time)) | ||
| { | ||
| // System call failed. | ||
| // Set error flag | ||
| *context |= SCAP_GET_CUR_TS_MS_CONTEXT_ERROR_FLAG; | ||
|
|
||
| // Return previously reported time, now frozen | ||
| return prev_time; | ||
| } | ||
|
|
||
| // New time looks OK. | ||
| // Store it into the context, and return it. | ||
| *context = new_time; | ||
| return new_time; | ||
| } | ||
|
|
||
| #endif /* __CLOCK_HELPERS_H */ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,41 @@ | ||
| /* | ||
| Copyright (C) 2022 The Falco Authors. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| */ | ||
| #ifndef __DEBUG_LOG_HELPERS_H | ||
| #define __DEBUG_LOG_HELPERS_H | ||
|
|
||
| #include "scap.h" | ||
| #include <stdarg.h> | ||
|
|
||
| /** | ||
| * If debug_log_fn has been established in the handle, call that function | ||
| * to log a debug message. | ||
| */ | ||
| static void scap_debug_log(scap_t* handle, const char* fmt, ...) | ||
| { | ||
| if (handle->m_debug_log_fn != NULL) | ||
| { | ||
| char buf[256]; | ||
| va_list ap; | ||
| va_start(ap, fmt); | ||
| vsnprintf(buf, sizeof(buf), fmt, ap); | ||
| va_end(ap); | ||
|
|
||
| (*handle->m_debug_log_fn)(buf); | ||
| } | ||
| } | ||
|
|
||
| #endif /* __DEBUG_LOG_HELPERS_H */ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.