-
Notifications
You must be signed in to change notification settings - Fork 473
tetragon: assorted fixes #4131
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
tetragon: assorted fixes #4131
Conversation
9c785b9 to
07dd27a
Compare
✅ Deploy Preview for tetragon ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
07dd27a to
8d09c3c
Compare
8d09c3c to
b4a1ba3
Compare
|
fyi moved ongoing exec changes in here #4184 |
b4a1ba3 to
19685fc
Compare
mtardy
left a comment
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
just a question, I don't remember why I choose this over the other in 42316d9
bpf/process/bpf_execve_event.c
Outdated
| // reuse p->args first string that contains the filename, this can't be | ||
| // above 256 in size (otherwise the complete will be send via data msg) | ||
| // which is okay because we need the 256 first bytes. | ||
| curr->bin.path_length = probe_read_str(curr->bin.path, BINARY_PATH_MAX_LEN, &p->args); | ||
| char *filename = (char *)ctx + (_(ctx->__data_loc_filename) & 0xFFFF); | ||
|
|
||
| curr->bin.path_length = probe_read_str(curr->bin.path, BINARY_PATH_MAX_LEN, (void *)filename); |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
what's the change from reading from the tracing points args?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I'm changing the data layout a bit in another PR and thought this might go independently, but it's not apparent without the rest of the changes, so I'll skip it for now
It's not used, we use TetragonConfValue instead. Signed-off-by: Jiri Olsa <[email protected]>
Add some structure to the execParse tests. Signed-off-by: Jiri Olsa <[email protected]>
We need to set process size, not exec object. Signed-off-by: Jiri Olsa <[email protected]>
19685fc to
c0afd7e
Compare
assorted fixes