search

falcosecurity / libs

libsinsp, libscap, the kernel module driver, and the eBPF driver sources
https://falcosecurity.github.io/libs/
Apache License 2.0
212 stars 158 forks source link

Legacy bpf probe verifier issue in `find_new_reaper_pid` #1521

Open FedeDP opened 7 months ago

FedeDP commented 7 months ago

Describe the bug

-- BEGIN PROG LOAD LOG -- 
insn 6910 cannot be patched due to 16-bit range 
processed 40396 insns (limit 1000000) max_states_per_insn 1 total_states 4057 peak_states 4057 mark_read 73 
-- END PROG LOAD LOG -- 
Unable to open the engine: libscap: bpf_load_program() event=raw_tracepoint/filler/sys_procexit_e: Operation not permitted

How to reproduce it

For now, the issue was only visible during a ppc64le test: https://github.com/falcosecurity/libs/pull/1497/files#discussion_r1407367449

Expected behaviour

No issue of course ;)

FedeDP commented 7 months ago

cc @mdafsanhossain

FedeDP commented 7 months ago

/milestone TBD

poiana commented 4 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

FedeDP commented 4 months ago

/remove-lifecycle stale

poiana commented 1 month ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

Andreagit97 commented 1 month ago

/remove-lifecycle stale