[CWS] fix overlayfs support on rocky 9.4 (DataDog#31948)

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
kkpan11 · Dec 10, 2024 · b92624a · b92624a
1 parent 5ff3a47
commit b92624a
Show file tree

Hide file tree

Showing 6 changed files with 268 additions and 1 deletion.
diff --git a/pkg/security/ebpf/c/include/constants/offsets/filesystem.h b/pkg/security/ebpf/c/include/constants/offsets/filesystem.h
@@ -23,9 +23,12 @@ dev_t __attribute__((always_inline)) get_inode_dev(struct inode *inode) {
 }
 
 dev_t __attribute__((always_inline)) get_dentry_dev(struct dentry *dentry) {
+    u64 offset;
+    LOAD_CONSTANT("dentry_d_sb_offset", offset);
+
     dev_t dev;
     struct super_block *sb;
-    bpf_probe_read(&sb, sizeof(sb), &dentry->d_sb);
+    bpf_probe_read(&sb, sizeof(sb), (char *)dentry + offset);
     bpf_probe_read(&dev, sizeof(dev), &sb->s_dev);
     return dev;
 }

diff --git a/pkg/security/ebpf/kernel/kernel.go b/pkg/security/ebpf/kernel/kernel.go
@@ -251,6 +251,11 @@ func (k *Version) IsRH9_3Kernel() bool {
 	return k.IsRH9Kernel() && strings.HasPrefix(k.OsRelease["VERSION_ID"], "9.3")
 }
 
+// IsRH9_4Kernel returns whether the kernel is a rh9.3 kernel
+func (k *Version) IsRH9_4Kernel() bool {
+	return k.IsRH9Kernel() && strings.HasPrefix(k.OsRelease["VERSION_ID"], "9.4")
+}
+
 // IsSuseKernel returns whether the kernel is a suse kernel
 func (k *Version) IsSuseKernel() bool {
 	return k.IsSLESKernel() || k.OsRelease["ID"] == "opensuse-leap"