[FEATURE] Missing syscalls modern BPF probe

[Andreagit97]

Feature

Right now the modern BPF probe support only a subset of the syscall supported by the current one, the so-called "simple set". You can check here the supported syscalls :point_down:

https://github.com/falcosecurity/libs/issues/513

Missing syscalls = 56

• [x] access
• [x] brk
• [x] epoll_wait
• [x] fstat
• [x] futex
• [x] getcwd
• [x] getdents
• [x] getdents64
• [x] getegid
• [x] geteuid
• [x] getgid
• [x] getpeername
• [x] getresgid
• [x] getresuid
• [x] getrlimit
• [x] getsockname
• [x] getsockopt
• [x] getuid
• [x] io_uring_enter
• [x] io_uring_register
• [x] io_uring_setup
• [x] llseek
• [x] lseek
• [x] lstat
• [x] mlock
• [x] mlock2
• [x] mlockall
• [x] mmap
• [x] mmap2
• [x] mprotect
• [x] munlock
• [x] munlockall
• [x] munmap
• [x] nanosleep
• [x] poll
• [x] ppoll
• [x] pread64
• [x] preadv
• [x] pwrite64
• [x] pwritev
• [x] read
• [x] readv
• [x] recvmmsg
• [x] select
• [x] semctl
• [x] semget
• [x] semop
• [x] sendfile
• [x] sendmmsg
• [x] splice
• [x] stat
• [x] ugetrlimit
• [x] write
• [x] writev
• [x] send
• [x] recv

There are some syscalls that should be never compiled unless you compile libs on some particular machines (kernel built without CONFIG_64BIT):

• [ ] fcntl64
• [ ] stat64
• [ ] fstat64
• [ ] sendfile64
• [ ] setresuid32
• [ ] setresgid32
• [ ] setuid32
• [ ] setgid32
• [ ] getuid32
• [ ] geteuid32
• [ ] getgid32
• [ ] getegid32
• [ ] getresuid32
• [ ] getresgid32

As you can notice they are all 64/32 bit versions of already implemented syscalls. Let's say that they are low-priority and very easy to implement, we can keep them as a last step to reach full parity :)

We need also to implement the generic one but this should be quite easy to do:

• [x] generic syscall support (https://github.com/falcosecurity/libs/pull/814)

Missing tracepoints:

• [x] page_fault_user
• [x] page_fault_kernel
• [x] signal_deliver

[Andreagit97]

I've noticed that we miss other 3 important syscalls that for some reason are never compiled according to our compact files

• llseek
• mmap2
• ugetrlimit

[Andreagit97]

Moreover, there are some syscalls that should be never compiled unless you compile libs on some particular machines:

• [ ] fcntl64
• [ ] stat64
• [ ] fstat64
• [ ] sendfile64
• [ ] setresuid32
• [ ] setresgid32
• [ ] setuid32
• [ ] setgid32
• [ ] getuid32
• [ ] geteuid32
• [ ] getgid32
• [ ] getegid32
• [ ] getresuid32
• [ ] getresgid32

As you can notice they are all 64/32 bit versions of already implemented syscalls. Let's say that they are low-priority and very easy to implement, we can keep them as a last step to reach full parity :)

[FedeDP]

I've noticed that we miss other 3 important syscalls that for some reason are never compiled according to our compact files

It seems like they're not present on x86: https://marcin.juszkiewicz.com.pl/download/tables/syscalls.html!

I am not sure how to proceed; they exist on other architectures. In syscalls bumper, i assumed that "x86_64" always had the larges possible set; i think we might have to fix that.

[Andreagit97]

yeah, it seems that none of our 3 supported architectures defines them :/

[hbrueckner]

As you can notice they are all 64/32 bit versions of already implemented syscalls. Let's say that they are low-priority and very easy to implement, we can keep them as a last step to reach full parity :)

Looks like that they are only available when the kernel being built without CONFIG_64BIT (for s390x the syscall table is here. For s390x, 32/31-bit support has been removed a while ago and CONFIG_64BIT is the default now. So I think would consider this also a low-priority unless there are use cases I am not aware of.

[Andreagit97]

Hey all, in the next days I will take care of implementing the following syscalls:

• [x] writev
• [x] pwrite64
• [x] pwritev

I post it here so we avoid implementing 2 times same syscalls since now we have different folks from the community working on it (thank you very much @dwindsor @loresuso @hbrueckner :tada: )

[Andreagit97]

Now we can finally say that the modern probe reached the full syscall parity :tada: to be honest we still miss some syscalls but they are never compiled on our architectures so we can implement them also in a second step

[Andreagit97]

BTW i would keep this issue open until we will implement also these corner cases :)

[loresuso]

Great news! 🥳

[FedeDP]

Heroic effort from multiple people! Thank you very much to everyone involved! Let me thanks Andrea specifically for its huge work on the modern bpf architecture, programs(attached and tail called) and testing framework. Superb work!

[Andreagit97]

Collected the remaining points into #1004 we can close this :) /close