fix kernel maps fallback (#11084)

pkg/security/probe/probe.go

@@ -506,19 +506,9 @@ func (p *Probe) handleEvent(CPU uint64, data []byte) {
 			return
 		}
 
-		p.resolvers.ProcessResolver.SetProcessArgs(event.processCacheEntry)
-		p.resolvers.ProcessResolver.SetProcessEnvs(event.processCacheEntry)
-
-		if _, err = p.resolvers.ProcessResolver.SetProcessPath(event.processCacheEntry); err != nil {
-			log.Debugf("failed to resolve exec path: %s", err)
+		if err = p.resolvers.ProcessResolver.ResolveNewProcessCacheEntryContext(event.processCacheEntry); err != nil {
+			log.Debugf("failed to resolve new process cache entry context: %s", err)
 		}
-		p.resolvers.ProcessResolver.SetProcessFilesystem(event.processCacheEntry)
-
-		p.resolvers.ProcessResolver.SetProcessTTY(event.processCacheEntry)
-
-		p.resolvers.ProcessResolver.SetProcessUsersGroups(event.processCacheEntry)
-
-		p.resolvers.ProcessResolver.ApplyBootTime(event.processCacheEntry)
 
 		p.resolvers.ProcessResolver.AddExecEntry(event.ProcessContext.Pid, event.processCacheEntry)
 

pkg/security/probe/process_resolver.go

@@ -537,7 +537,7 @@ func (p *ProcessResolver) unmarshalFromKernelMaps(entry *model.ProcessCacheEntry
 	}
 	entry.ContainerID = id
 
-	read, err := entry.UnmarshalBinary(data[64:])
+	read, err := entry.Process.UnmarshalBinary(data[64:])
 	if err != nil {
 		return read + 64, err
 	}
@@ -559,6 +559,20 @@ func (p *ProcessResolver) resolveFromCache(pid, tid uint32) *model.ProcessCacheE
 	return entry
 }
 
+// ResolveNewProcessCacheEntryContext resolves the context fields of a new process cache entry parsed from kernel data
+func (p *ProcessResolver) ResolveNewProcessCacheEntryContext(entry *model.ProcessCacheEntry) error {
+	p.SetProcessArgs(entry)
+	p.SetProcessEnvs(entry)
+	if _, err := p.SetProcessPath(entry); err != nil {
+		return fmt.Errorf("failed to resolve exec path: %w", err)
+	}
+	p.SetProcessFilesystem(entry)
+	p.SetProcessTTY(entry)
+	p.SetProcessUsersGroups(entry)
+	p.ApplyBootTime(entry)
+	return nil
+}
+
 func (p *ProcessResolver) resolveWithKernelMaps(pid, tid uint32) *model.ProcessCacheEntry {
 	pidb := make([]byte, 4)
 	model.ByteOrder.PutUint32(pidb, pid)
@@ -583,6 +597,11 @@ func (p *ProcessResolver) resolveWithKernelMaps(pid, tid uint32) *model.ProcessC
 	entry.Pid = pid
 	entry.Tid = tid
 
+	// resolve paths and other context fields
+	if err = p.ResolveNewProcessCacheEntryContext(entry); err != nil {
+		return nil
+	}
+
 	// If we fall back to the kernel maps for a process in a container that was already running when the agent
 	// started, the kernel space container ID will be empty even though the process is inside a container. Since there
 	// is no insurance that the parent of this process is still running, we can't use our user space cache to check if