Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion .gitmodules
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
[submodule "third_party/stackrox"]
path = third_party/stackrox
url = https://github.com/stackrox/stackrox
branch = master
branch = jv-ROX-31434-enrich-file-system-events-with-node-details
3 changes: 3 additions & 0 deletions fact-ebpf/src/bpf/bound_path.h
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,9 @@ __always_inline static void path_write_char(char* p, unsigned int offset, char c

__always_inline static struct bound_path_t* path_read(struct path* path) {
struct bound_path_t* bound_path = get_bound_path();
if (bound_path == NULL) {
return NULL;
}

bound_path->len = bpf_d_path(path, bound_path->path, PATH_MAX);
if (bound_path->len <= 0) {
Expand Down
8 changes: 5 additions & 3 deletions fact-ebpf/src/bpf/events.h
Original file line number Diff line number Diff line change
Expand Up @@ -17,9 +17,11 @@ __always_inline static void submit_event(struct metrics_by_hook_t* m, file_activ
bpf_probe_read_str(event->filename, PATH_MAX, filename);

struct helper_t* helper = get_helper();
const char* p = get_host_path(helper->buf, dentry);
if (p != NULL) {
bpf_probe_read_str(event->host_file, PATH_MAX, p);
if (helper != NULL) {
const char* p = get_host_path(helper->buf, dentry);
if (p != NULL) {
bpf_probe_read_str(event->host_file, PATH_MAX, p);
}
}

int64_t err = process_fill(&event->process);
Expand Down
6 changes: 6 additions & 0 deletions fact-ebpf/src/bpf/main.c
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,9 @@ char _license[] SEC("license") = "Dual MIT/GPL";
SEC("lsm/file_open")
int BPF_PROG(trace_file_open, struct file* file) {
struct metrics_t* m = get_metrics();
if (m == NULL) {
return 0;
}

m->file_open.total++;

Expand Down Expand Up @@ -58,6 +61,9 @@ int BPF_PROG(trace_file_open, struct file* file) {
SEC("lsm/path_unlink")
int BPF_PROG(trace_path_unlink, struct path* dir, struct dentry* dentry) {
struct metrics_t* m = get_metrics();
if (m == NULL) {
return 0;
}

m->path_unlink.total++;

Expand Down
3 changes: 3 additions & 0 deletions fact-ebpf/src/bpf/maps.h
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,9 @@ struct {
__always_inline static bool filter_by_prefix() {
unsigned int zero = 0;
char* res = bpf_map_lookup_elem(&filter_by_prefix_map, &zero);
if (res == NULL) {
return false;
}
return *res != 0;
}

Expand Down
1 change: 1 addition & 0 deletions fact/src/event/mod.rs
Original file line number Diff line number Diff line change
Expand Up @@ -89,6 +89,7 @@ impl From<Event> for fact_api::FileActivity {
file: Some(file),
timestamp: Some(timestamp),
process: Some(process),
node: value.hostname.to_string(),
}
}
}
Expand Down
2 changes: 1 addition & 1 deletion third_party/stackrox
Submodule stackrox updated 3613 files
Loading