[CWS] fix support for ubuntu 24.04 (DataDog#25356)

* add ubuntu 24.04 sec agent runs * move mount.mnt_id to a managed constant * add missing structs * fix net device name offset * fix test octogon * CWS: sync BTFhub constants --------- Co-authored-by: paulcacheux <[email protected]>
kkpan11 · May 10, 2024 · 2e8477b · 2e8477b
1 parent 854f002
commit 2e8477b
Show file tree

Hide file tree

Showing 9 changed files with 4,953 additions and 4,287 deletions.
diff --git a/.gitlab/kernel_matrix_testing/security_agent.yml b/.gitlab/kernel_matrix_testing/security_agent.yml
@@ -127,6 +127,7 @@ kmt_run_secagent_tests_x64:
           - "ubuntu_20.04"
           - "ubuntu_22.04"
           - "ubuntu_23.10"
+          - "ubuntu_24.04"
           - "amazon_5.4"
           - "amazon_5.10"
           - "fedora_37"
@@ -164,6 +165,7 @@ kmt_run_secagent_tests_arm64:
       - TAG:
           - "ubuntu_22.04"
           - "ubuntu_23.10"
+          - "ubuntu_24.04"
           - "amazon_5.4"
           - "amazon_5.10"
           - "fedora_37"

diff --git a/pkg/security/ebpf/c/include/constants/offsets/netns.h b/pkg/security/ebpf/c/include/constants/offsets/netns.h
@@ -12,6 +12,13 @@ __attribute__((always_inline)) u32 get_ifindex_from_net_device(struct net_device
     return ifindex;
 }
 
+__attribute__((always_inline)) char* get_net_device_name(struct net_device *device) {
+    u64 net_device_name_offset;
+    LOAD_CONSTANT("net_device_name_offset", net_device_name_offset);
+
+    return (char *)((void *)device + net_device_name_offset);
+}
+
 #define NET_STRUCT_HAS_PROC_INUM 0
 #define NET_STRUCT_HAS_NS        1
 

diff --git a/pkg/security/ebpf/c/include/hooks/network/net_device.h b/pkg/security/ebpf/c/include/hooks/network/net_device.h
@@ -164,7 +164,8 @@ int rethook_register_netdevice(ctx_t *ctx) {
         .netns = entry->ifindex.netns,
     };
     // populate interface name directly from the net_device structure
-    bpf_probe_read(&device.name[0], sizeof(device.name), entry->device);
+    char *name = get_net_device_name(entry->device);
+    bpf_probe_read(&device.name, sizeof(device.name), name);
 
     // check where we're at in the veth state machine
     struct veth_state_t *state = bpf_map_lookup_elem(&veth_state_machine, &id);