Skip to content

Commit

Permalink
only save new profile/activity when sets are updated
Browse files Browse the repository at this point in the history 
Signed-off-by: Matthias Bertschy <[email protected]>
  • Loading branch information
@matthyx
matthyx committed Nov 14, 2023
1 parent d9c6b09 commit 80e1ab7
Show file tree
Hide file tree
Showing 2 changed files with 80 additions and 74 deletions.
150 changes: 78 additions & 72 deletions pkg/applicationprofilemanager/v1/applicationprofile_manager.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -169,108 +169,114 @@ func (am *ApplicationProfileManager) saveProfile(ctx context.Context, watchedCon
return
}

// get syscalls from IG
observedSyscalls, err := am.syscallPeekFunc(watchedContainer.NsMntId)
if err != nil {
logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to get syscalls", helpers.Error(err))
}
// activity sets
syscalls := mapset.NewSet[string]()
var addedActivities int
syscalls := mapset.NewSet[string](observedSyscalls...)
// existing activity
existingActivity, _ := am.storageClient.GetApplicationActivity(slug, namespace)
if existingActivity != nil {
syscalls.Append(existingActivity.Spec.Syscalls...)
addedActivities += syscalls.Append(existingActivity.Spec.Syscalls...)
}
// new activity
newActivity := &v1beta1.ApplicationActivity{
ObjectMeta: metav1.ObjectMeta{
Name: slug,
Annotations: map[string]string{
instanceidhandler.WlidMetadataKey: watchedContainer.Wlid,
instanceidhandler.StatusMetadataKey: "",
if addedActivities > 0 {
newActivity := &v1beta1.ApplicationActivity{
ObjectMeta: metav1.ObjectMeta{
Name: slug,
Annotations: map[string]string{
instanceidhandler.WlidMetadataKey: watchedContainer.Wlid,
instanceidhandler.StatusMetadataKey: "",
},
Labels: utils.GetLabels(watchedContainer, true),
},
Labels: utils.GetLabels(watchedContainer, true),
},
}
// add syscalls
newSyscalls, err := am.syscallPeekFunc(watchedContainer.NsMntId)
if err == nil {
syscalls.Append(newSyscalls...)
} else {
logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to get syscalls", helpers.Error(err))
}
newActivity.Spec.Syscalls = syscalls.ToSlice()
if err := am.storageClient.CreateApplicationActivity(newActivity, namespace); err != nil {
logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to save application activity", helpers.Error(err))
}
// add syscalls
newActivity.Spec.Syscalls = syscalls.ToSlice()
// save application activity
if err := am.storageClient.CreateApplicationActivity(newActivity, namespace); err != nil {
logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to save application activity", helpers.Error(err))
}
}

// profile sets
var addedProfiles int
capabilities := am.capabilitiesSets.Get(watchedContainer.K8sContainerID)
execs := am.execSets.Get(watchedContainer.K8sContainerID)
opens := am.openSets.Get(watchedContainer.K8sContainerID)
// existing profile
existingProfile, _ := am.storageClient.GetApplicationProfile(slug, namespace)
existingProfileContainer := utils.GetApplicationProfileContainer(existingProfile, watchedContainer.ContainerType, watchedContainer.ContainerIndex)
if existingProfile != nil {
capabilities.Append(existingProfileContainer.Capabilities...)
addedProfiles += capabilities.Append(existingProfileContainer.Capabilities...)
for _, exec := range existingProfileContainer.Execs {
if _, exist := execs[exec.Path]; !exist {
execs[exec.Path] = mapset.NewSet[string]()
}
execs[exec.Path].Append(exec.Args...)
addedProfiles += execs[exec.Path].Append(exec.Args...)
}
for _, open := range existingProfileContainer.Opens {
if _, exist := opens[open.Path]; !exist {
opens[open.Path] = mapset.NewSet[string]()
}
opens[open.Path].Append(open.Flags...)
addedProfiles += opens[open.Path].Append(open.Flags...)
}
}
// new profile
newProfile := &v1beta1.ApplicationProfile{
ObjectMeta: metav1.ObjectMeta{
Name: slug,
Annotations: map[string]string{
instanceidhandler.WlidMetadataKey: watchedContainer.Wlid,
instanceidhandler.StatusMetadataKey: "",
if addedProfiles > 0 {
newProfile := &v1beta1.ApplicationProfile{
ObjectMeta: metav1.ObjectMeta{
Name: slug,
Annotations: map[string]string{
instanceidhandler.WlidMetadataKey: watchedContainer.Wlid,
instanceidhandler.StatusMetadataKey: "",
},
Labels: utils.GetLabels(watchedContainer, true),
},
Labels: utils.GetLabels(watchedContainer, true),
},
}
newProfileContainer := v1beta1.ApplicationProfileContainer{
Name: watchedContainer.InstanceID.GetContainerName(),
}
// add capabilities
newProfileContainer.Capabilities = capabilities.ToSlice()
sort.Strings(newProfileContainer.Capabilities)
// add execs
newProfileContainer.Execs = make([]v1beta1.ExecCalls, 0)
for path, exec := range execs {
args := exec.ToSlice()
sort.Strings(args)
newProfileContainer.Execs = append(newProfileContainer.Execs, v1beta1.ExecCalls{
Path: path,
Args: args,
})
}
// add opens
newProfileContainer.Opens = make([]v1beta1.OpenCalls, 0)
for path, open := range opens {
flags := open.ToSlice()
sort.Strings(flags)
newProfileContainer.Opens = append(newProfileContainer.Opens, v1beta1.OpenCalls{
Path: path,
Flags: flags,
})
}
// insert application profile container
utils.InsertApplicationProfileContainer(newProfile, watchedContainer.ContainerType, watchedContainer.ContainerIndex, newProfileContainer)
// save application profile
if err := am.storageClient.CreateApplicationProfile(newProfile, namespace); err != nil {
logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to save application profile", helpers.Error(err))
}
logger.L().Debug("ApplicationProfileManager - saved application profile", helpers.String("slug", slug), helpers.String("container ID", watchedContainer.ContainerID), helpers.String("k8s workload", watchedContainer.K8sContainerID), helpers.Interface("profile", newProfile))
// profile summary
summary := &v1beta1.ApplicationProfileSummary{
ObjectMeta: newProfile.ObjectMeta,
}
if err := am.storageClient.CreateApplicationProfileSummary(summary, namespace); err != nil {
logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to save application profile summary", helpers.Error(err))
}
newProfileContainer := v1beta1.ApplicationProfileContainer{
Name: watchedContainer.InstanceID.GetContainerName(),
}
// add capabilities
newProfileContainer.Capabilities = capabilities.ToSlice()
sort.Strings(newProfileContainer.Capabilities)
// add execs
newProfileContainer.Execs = make([]v1beta1.ExecCalls, 0)
for path, exec := range execs {
args := exec.ToSlice()
sort.Strings(args)
newProfileContainer.Execs = append(newProfileContainer.Execs, v1beta1.ExecCalls{
Path: path,
Args: args,
})
}
// add opens
newProfileContainer.Opens = make([]v1beta1.OpenCalls, 0)
for path, open := range opens {
flags := open.ToSlice()
sort.Strings(flags)
newProfileContainer.Opens = append(newProfileContainer.Opens, v1beta1.OpenCalls{
Path: path,
Flags: flags,
})
}
// insert application profile container
utils.InsertApplicationProfileContainer(newProfile, watchedContainer.ContainerType, watchedContainer.ContainerIndex, newProfileContainer)
// save application profile
if err := am.storageClient.CreateApplicationProfile(newProfile, namespace); err != nil {
logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to save application profile", helpers.Error(err))
}
logger.L().Debug("ApplicationProfileManager - saved application profile", helpers.String("slug", slug), helpers.String("container ID", watchedContainer.ContainerID), helpers.String("k8s workload", watchedContainer.K8sContainerID), helpers.Interface("profile", newProfile))
// profile summary
summary := &v1beta1.ApplicationProfileSummary{
ObjectMeta: newProfile.ObjectMeta,
}
if err := am.storageClient.CreateApplicationProfileSummary(summary, namespace); err != nil {
logger.L().Ctx(ctx).Error("ApplicationProfileManager - failed to save application profile summary", helpers.Error(err))
}
}
}

Expand Down
4 changes: 2 additions & 2 deletions pkg/applicationprofilemanager/v1/applicationprofile_manager_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -68,10 +68,10 @@ func TestApplicationProfileManager(t *testing.T) {
assert.Equal(t, 2, len(storageClient.ApplicationActivities))
sort.Strings(storageClient.ApplicationActivities[0].Spec.Syscalls)
assert.Equal(t, []string{"dup", "listen", "open"}, storageClient.ApplicationActivities[0].Spec.Syscalls)
assert.Equal(t, 2, len(storageClient.ApplicationProfiles))
assert.Equal(t, 1, len(storageClient.ApplicationProfiles))
sort.Strings(storageClient.ApplicationProfiles[0].Spec.Containers[0].Capabilities)
assert.Equal(t, []string{"NET_BIND_SERVICE", "NET_BROADCAST"}, storageClient.ApplicationProfiles[0].Spec.Containers[1].Capabilities)
assert.Equal(t, []v1beta1.ExecCalls{{Path: "/bin/bash", Args: []string{"-c", "ls"}, Envs: []string(nil)}}, storageClient.ApplicationProfiles[0].Spec.Containers[1].Execs)
assert.Equal(t, []v1beta1.OpenCalls{{Path: "/etc/passwd", Flags: []string{"O_RDONLY"}}}, storageClient.ApplicationProfiles[0].Spec.Containers[1].Opens)
assert.Equal(t, 2, len(storageClient.ApplicationProfileSummaries))
assert.Equal(t, 1, len(storageClient.ApplicationProfileSummaries))
}

0 comments on commit 80e1ab7

Please sign in to comment.