search

aquasecurity / tracee

Linux Runtime Security and Forensics using eBPF
https://aquasecurity.github.io/tracee/latest
Apache License 2.0
3.58k stars 414 forks source link

Error handling event by signature (Process Tree Data Source Test) #3878

Open geyslan opened 7 months ago

geyslan commented 7 months ago

Description

https://github.com/aquasecurity/tracee/actions/runs/7980171604/job/21789214615?pr=3877#step:5:1575

./tests/e2e-inst-test.sh failed with 

{"level":"error","ts":1708465206.4616668,"msg":"Handling event by signature Process Tree Data Source Test: process (tid: 12665 pid: 12665, ppid: 12657, time: 1708465191356487053, hash: 3194477383) no match for ppid"}
INFO: = TEST: PROCTREE_DATA_SOURCE ==============================================
INFO: 
INFO: 
INFO: UP AND RUNNING
INFO: 
INFO: 
INFO: PROCTREE_DATA_SOURCE: FAILED, stderr from tracee:
{"level":"error","ts":1708465206.4616668,"msg":"Handling event by signature Process Tree Data Source Test: process (tid: 12665 pid: 12665, ppid: 12657, time: 1708465191356487053, hash: 3194477383) no match for ppid"}
INFO: PROCTREE_DATA_SOURCE: FAILED, events from tracee:
{"timestamp":1708465191352844876,"threadStartTime":1708465191352057027,"processorId":1,"processId":12655,"cgroupId":4648,"threadId":12655,"parentProcessId":12649,"hostProcessId":12655,"hostThreadId":12655,"hostParentProcessId":12649,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":1669051517,"processEntityId":1669051517,"parentEntityId":4225537210,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"./tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["./tests/e2e-inst-signatures/scripts/proctreetester"]},{"name":"interp","type":"const char*","value":"./tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191354245193,"threadStartTime":1708465191353884891,"processorId":1,"processId":12658,"cgroupId":4648,"threadId":12658,"parentProcessId":12655,"hostProcessId":12658,"hostThreadId":12658,"hostParentProcessId":12655,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":3357930708,"processEntityId":3357930708,"parentEntityId":1669051517,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191355569196,"threadStartTime":1708465191353775944,"processorId":1,"processId":12657,"cgroupId":4648,"threadId":12657,"parentProcessId":12655,"hostProcessId":12657,"hostThreadId":12657,"hostParentProcessId":12655,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":3283683016,"processEntityId":3283683016,"parentEntityId":1669051517,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191357856888,"threadStartTime":1708465191356391647,"processorId":1,"processId":12664,"cgroupId":4648,"threadId":12664,"parentProcessId":12657,"hostProcessId":12664,"hostThreadId":12664,"hostParentProcessId":12657,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":155691347,"processEntityId":155691347,"parentEntityId":3283683016,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191360379905,"threadStartTime":1708465191353981277,"processorId":1,"processId":12659,"cgroupId":4648,"threadId":12659,"parentProcessId":12655,"hostProcessId":12659,"hostThreadId":12659,"hostParentProcessId":12655,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":445358212,"processEntityId":445358212,"parentEntityId":1669051517,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191361575350,"threadStartTime":1708465191355290259,"processorId":1,"processId":12662,"cgroupId":4648,"threadId":12662,"parentProcessId":12658,"hostProcessId":12662,"hostThreadId":12662,"hostParentProcessId":12658,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":2695203339,"processEntityId":2695203339,"parentEntityId":3357930708,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191363069973,"threadStartTime":1708465191355192182,"processorId":1,"processId":12661,"cgroupId":4648,"threadId":12661,"parentProcessId":12658,"hostProcessId":12661,"hostThreadId":12661,"hostParentProcessId":12658,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":1158832170,"processEntityId":1158832170,"parentEntityId":3357930708,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191365042696,"threadStartTime":1708465191357608303,"processorId":1,"processId":12669,"cgroupId":4648,"threadId":12669,"parentProcessId":12665,"hostProcessId":12669,"hostThreadId":12669,"hostParentProcessId":12665,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":836705362,"processEntityId":836705362,"parentEntityId":3194477383,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191365622812,"threadStartTime":1708465191358468576,"processorId":1,"processId":12671,"cgroupId":4648,"threadId":12671,"parentProcessId":12664,"hostProcessId":12671,"hostThreadId":12671,"hostParentProcessId":12664,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":1031202147,"processEntityId":1031202147,"parentEntityId":155691347,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191366565651,"threadStartTime":1708465191361149293,"processorId":0,"processId":12681,"cgroupId":4648,"threadId":12681,"parentProcessId":12659,"hostProcessId":12681,"hostThreadId":12681,"hostParentProcessId":12659,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":1185601184,"processEntityId":1185601184,"parentEntityId":445358212,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191367246173,"threadStartTime":1708465191361387398,"processorId":1,"processId":12682,"cgroupId":4648,"threadId":12682,"parentProcessId":12659,"hostProcessId":12682,"hostThreadId":12682,"hostParentProcessId":12659,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":2843307796,"processEntityId":2843307796,"parentEntityId":445358212,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191367517930,"threadStartTime":1708465191362226520,"processorId":0,"processId":12684,"cgroupId":4648,"threadId":12684,"parentProcessId":12662,"hostProcessId":12684,"hostThreadId":12684,"hostParentProcessId":12662,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":2935645732,"processEntityId":2935645732,"parentEntityId":2695203339,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191369873757,"threadStartTime":1708465191363986290,"processorId":0,"processId":12688,"cgroupId":4648,"threadId":12688,"parentProcessId":12661,"hostProcessId":12688,"hostThreadId":12688,"hostParentProcessId":12661,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":1639480076,"processEntityId":1639480076,"parentEntityId":1158832170,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191371719642,"threadStartTime":1708465191367874452,"processorId":1,"processId":12699,"cgroupId":4648,"threadId":12699,"parentProcessId":12682,"hostProcessId":12699,"hostThreadId":12699,"hostParentProcessId":12682,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":3952962008,"processEntityId":3952962008,"parentEntityId":2843307796,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}
{"timestamp":1708465191371909534,"threadStartTime":1708465191368786979,"processorId":0,"processId":12701,"cgroupId":4648,"threadId":12701,"parentProcessId":12681,"hostProcessId":12701,"hostThreadId":12701,"hostParentProcessId":12681,"userId":0,"mountNamespace":4026531841,"pidNamespace":4026531836,"processName":"proctreetester","executable":{"path":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},"hostName":"ip-10-1-7-132","containerId":"","container":{},"kubernetes":{},"eventId":"6005","eventName":"PROCTREE_DATA_SOURCE","matchedPolicies":[""],"argsNum":1,"returnValue":0,"syscall":"execve","stackAddresses":null,"contextFlags":{"containerStarted":false,"isCompat":false},"threadEntityId":3664648310,"processEntityId":3664648310,"parentEntityId":1185601184,"args":[{"name":"triggeredBy","type":"unknown","value":{"args":[{"name":"cmdpath","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"pathname","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"dev","type":"dev_t","value":271581185},{"name":"inode","type":"unsigned long","value":335672},{"name":"ctime","type":"unsigned long","value":1708465191345601524},{"name":"inode_mode","type":"umode_t","value":33261},{"name":"interpreter_pathname","type":"const char*","value":null},{"name":"interpreter_dev","type":"dev_t","value":null},{"name":"interpreter_inode","type":"unsigned long","value":null},{"name":"interpreter_ctime","type":"unsigned long","value":null},{"name":"argv","type":"const char**","value":["proctreetester"]},{"name":"interp","type":"const char*","value":"/actions-runner/_work/tracee/tracee/tests/e2e-inst-signatures/scripts/proctreetester"},{"name":"stdin_type","type":"string","value":"S_IFIFO"},{"name":"stdin_path","type":"char*","value":""},{"name":"invoked_from_kernel","type":"int","value":0},{"name":"env","type":"const char**","value":null}],"id":714,"name":"sched_process_exec","returnValue":0}}],"metadata":{"Version":"0.1.0","Description":"Instrumentation events E2E Tests: Process Tree Data Source Test","Tags":["e2e","instrumentation"],"Properties":{"Category":null,"Severity":null,"Technique":null,"external_id":null,"id":null,"signatureID":"PROCTREE_DATA_SOURCE","signatureName":"Process Tree Data Source Test"}}}

Output of tracee version:

Output of uname -a:

Additional details

NDStrahilevitz commented 7 months ago

I think this e2e test might just be slightly flaky. Not sure if it's worth giving much priority.

geyslan commented 6 months ago

Happening more often: