Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cleanup(libsinsp): re-order proc filtercheck fields + more unit testing #962

Merged
merged 4 commits into from
Mar 13, 2023

Conversation

incertum
Copy link
Contributor

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area API-version

/area build

/area CI

/area driver-kmod

/area driver-bpf

/area driver-modern-bpf

/area libscap-engine-bpf

/area libscap-engine-gvisor

/area libscap-engine-kmod

/area libscap-engine-modern-bpf

/area libscap-engine-nodriver

/area libscap-engine-noop

/area libscap-engine-source-plugin

/area libscap-engine-savefile

/area libscap-engine-udig

/area libscap

/area libpman

/area libsinsp

/area tests

/area proposals

Does this PR require a change in the driver versions?

/version driver-API-version-major

/version driver-API-version-minor

/version driver-API-version-patch

/version driver-SCHEMA-version-major

/version driver-SCHEMA-version-minor

/version driver-SCHEMA-version-patch

What this PR does / why we need it:

Follow up #938, re-order proc filterchecks definitions to provide a nicer end user experience when reading the supported fields on the website and also improve clarity for developers via grouping related fields together. In addition, adjusted wording slightly for consistency and easier understanding.

While these changes are minor, they require careful review. Therefore, also extended the unit test for spawn_process.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

NONE

scap_const_sized_buffer empty_bytebuf = {.buf = nullptr, .size = 0};

add_event_advance_ts(increasing_ts(), parent_tid, PPME_SYSCALL_CLONE_20_E, 0);
std::vector<std::string> cgroups = {"cpuset=/", "cpu=/user.slice", "cpuacct=/user.slice", "io=/user.slice", "memory=/user.slice/user-1000.slice/session-1.scope", "devices=/user.slice", "freezer=/", "net_cls=/", "perf_event=/", "net_prio=/", "hugetlb=/", "pids=/user.slice/user-1000.slice/session-1.scope", "rdma=/", "misc=/"};
std::string cgroupsv = test_utils::to_null_delimited(cgroups);
std::vector<std::string> env = {"SHELL=/bin/bash", "PWD=/home/user", "HOME=/home/user"};
std::string envv = test_utils::to_null_delimited(env);
std::vector<std::string> args = {"--help"};
std::vector<std::string> args = {"-c", "'echo aGVsbG8K | base64 -d'"};
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

is that change done to test multiple arguments to the binary?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes

@LucaGuerra
Copy link
Contributor

I like this! 🚀 Thanks a lot!

@@ -329,27 +329,48 @@ class sinsp_filter_check_thread : public sinsp_filter_check
public:
enum check_type
{
TYPE_PID = 0,
TYPE_EXE,
TYPE_EXE = 0,
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am not sure: given this is a public enum, isn't this an API break?
I mean i know that nobody links libsinsp as a shared library, and we already broke API since 0.10.x release, but i am still unsure about this.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where is this used publicly? It looks to me that this is first mapped in order to the filterchecks defined as string and only used later, I believe I may be missing something

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It is not used at least by us, but it is exposed in a public header, right?
Perhaps i am wrong :)

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Also think it's a non-breaking change (definitely for Falco). We can add a release note with ! for sure, just in case.

@incertum
Copy link
Contributor Author

@LucaGuerra one more thought: As you are fixing up the test framework, why don't we move the unit test updates from here to your PR? I'll then rebase and squash.

@LucaGuerra
Copy link
Contributor

PR is out with the fix: #969

@incertum I'd rather keep PR 969 focused on that specific fix, would you be able to rebase this one after 969 is merged? Thanks!

@LucaGuerra
Copy link
Contributor

/milestone 0.11.0

@poiana poiana added this to the 0.11.0 milestone Mar 13, 2023
@incertum incertum force-pushed the re-order-proc-fields branch from 0dd7942 to bd874cc Compare March 13, 2023 16:44
Copy link
Contributor

@LucaGuerra LucaGuerra left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for this change! LGTM

@poiana
Copy link
Contributor

poiana commented Mar 13, 2023

LGTM label has been added.

Git tree hash: a8c3be1b1749812e6633421ab6e0acfcdd1e8f54

Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana
Copy link
Contributor

poiana commented Mar 13, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, incertum, LucaGuerra

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:
  • OWNERS [FedeDP,LucaGuerra,incertum]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit fb43868 into falcosecurity:master Mar 13, 2023
@incertum incertum deleted the re-order-proc-fields branch December 8, 2023 20:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

4 participants