Open fntlnz opened 5 years ago
Update, just tested this on a machine with an older kernel and works as expected:
sudo ./userspace/sysdig/sysdig evt.type=unlinkat -p" %evt.num %evt.outputtime %evt.cpu %proc.name (%thread.tid) %evt.dir %evt.type %evt.info"
5672 14:29:07.650800968 1 rm (22218) > unlinkat
5673 14:29:07.650834692 1 rm (22218) < unlinkat res=0 dirfd=-100(AT_FDCWD) name=ciao(/home/ubuntu/sysdig/build/ciao) flags=0
Kernel info
Linux gallifrey 4.15.0-1044-aws #46-Ubuntu SMP Thu Jul 4 13:38:28 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
Debugged this a bit, it looks like that ppm_copy_from_user returns 16
while doing __copy_from_user_inatomic
by calling raw_copy_from_user
However raw_copy_from_user
didn't change between the two reported versions, it actually didn't change in the past two years.
So at this point I have two hypothesis:
Update: It happens everytime val_to_ring
is called with is_user
true.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
tl;dr
On kernel
5.1.4-arch1-1-ARCH
with sysdig commit from dev92622e3e2a33d5f0f5b2b84d1abd95211d1e67d8
, when using the kernel module, all the syscalls with a filler as defined here do not get the information filled.When using the BPF probe everything works just fine.
Examples
Here are a couple of examples with fillers:
unlinkat
kernel module, has a custom filler, NOT FILLING
https://github.com/draios/sysdig/blob/fd3dfd1e2e1757173722dfe78485c9302ec037cb/driver/ppm_fillers.c#L2864
bpf probe, has a custom filler FILLING https://github.com/draios/sysdig/blob/3b7a794f8d8cf1409a5734a3c6a8ab25daedf110/driver/bpf/fillers.h#L4014
connect
kernel module, has a custom filler, NOT FILLING
bpf probe, has a custom filler, FILLING
openat
kernel module, has a custom filler, NOT FILLING
bpf probe, has a custom filler, FILLING
Here are a couple of examples without fillers
unlink
kernel module, does not have a custom filler, FILLING
bpf probe, does not have a custom filler, FILLING
rmdir
kernel module, does not have a custom filler, FILLING
bpf probe, does not have a custom filler, FILLING
Notice how the ones without fillers just work.
More details
kernel version extended