ROX-33614: Update Falco to 0.23.1

collector/CMakeLists.txt

@@ -87,7 +87,6 @@ set(USE_BUNDLED_DEPS OFF CACHE BOOL "Enable bundled dependencies instead of usin
 set(USE_BUNDLED_CARES OFF CACHE BOOL "Enable bundled dependencies instead of using the system ones" FORCE)
 set(BUILD_LIBSCAP_GVISOR OFF CACHE BOOL "Do not build gVisor support" FORCE)
 set(MINIMAL_BUILD OFF CACHE BOOL "Minimal" FORCE)
-set(SINSP_SLIM_THREADINFO ON CACHE BOOL "Slim threadinfo" FORCE)
 set(BUILD_SHARED_LIBS OFF CACHE BOOL "Build position independent libraries and executables" FORCE)
 set(LIBELF_LIB_SUFFIX ".so" CACHE STRING "Use libelf.so" FORCE)
 
@@ -101,6 +100,6 @@ set(SCAP_HOST_ROOT_ENV_VAR_NAME "COLLECTOR_HOST_ROOT" CACHE STRING "Host root en
 set(BUILD_LIBSCAP_MODERN_BPF ON CACHE BOOL "Enable modern bpf engine" FORCE)
 set(MODERN_BPF_DEBUG_MODE ${BPF_DEBUG_MODE} CACHE BOOL "Enable BPF debug prints" FORCE)
 
-set(MODERN_BPF_EXCLUDE_PROGS "^(openat2|ppoll|setsockopt|io_uring_setup|nanosleep)$" CACHE STRING "Set of syscalls to exclude from modern bpf engine " FORCE)
+set(MODERN_BPF_EXCLUDE_PROGS "^(openat2|ppoll|setsockopt|io_uring_setup|nanosleep|pread64|preadv|pwritev|read|readv|writev|recv|process_vm_readv|process_vm_writev)$" CACHE STRING "Set of syscalls to exclude from modern bpf engine " FORCE)
 
 add_subdirectory(${FALCO_DIR} falco)

collector/lib/CollectorService.cpp

@@ -65,7 +65,7 @@ CollectorService::CollectorService(CollectorConfig& config, std::atomic<ControlV
   civet_endpoints_.emplace_back(std::make_unique<ProfilerHandler>());
 
   if (config.IsIntrospectionEnabled()) {
-    civet_endpoints_.emplace_back(std::make_unique<ContainerInfoInspector>(system_inspector_.GetContainerMetadataInspector()));
+    civet_endpoints_.emplace_back(std::make_unique<ContainerInfoInspector>());
     civet_endpoints_.emplace_back(std::make_unique<NetworkStatusInspector>(conn_tracker_));
     civet_endpoints_.emplace_back(std::make_unique<CollectorConfigInspector>(config_));
   }

collector/lib/ContainerInfoInspector.cpp

@@ -23,7 +23,7 @@ bool ContainerInfoInspector::handleGet(CivetServer* server, struct mg_connection
   Json::Value root;
 
   root["container_id"] = container_id;
-  root["namespace"] = std::string(container_metadata_inspector_->GetNamespace(container_id));
+  root["namespace"] = "";
 
   mg_printf(conn, "HTTP/1.1 200 OK\r\nContent-Type: application/json\r\nConnection: close\r\n\r\n");
   mg_printf(conn, "%s\r\n", writer_.write(root).c_str());

collector/lib/ContainerInfoInspector.h

@@ -2,22 +2,15 @@
 
 #include <CivetServer.h>
 #include <civetweb.h>
-#include <memory>
 #include <string>
-#include <unordered_map>
 
 #include "CivetWrapper.h"
-#include "ContainerMetadata.h"
 #include "json/writer.h"
 
 namespace collector {
 
-using QueryParams = std::unordered_map<std::string, std::string>;
-
 class ContainerInfoInspector : public CivetWrapper {
  public:
-  ContainerInfoInspector(const std::shared_ptr<ContainerMetadata>& cmi) : container_metadata_inspector_(cmi) {}
-
   // implementation of CivetHandler
   bool handleGet(CivetServer* server, struct mg_connection* conn) override;
 
@@ -28,7 +21,6 @@ class ContainerInfoInspector : public CivetWrapper {
  private:
   static const std::string kBaseRoute;
 
-  std::shared_ptr<ContainerMetadata> container_metadata_inspector_;
   Json::FastWriter writer_;
 };
 

collector/lib/ContainerMetadata.cpp

@@ -2,6 +2,7 @@
 
 #include <libsinsp/sinsp.h>
 
+#include "Logging.h"
 #include "system-inspector/EventExtractor.h"
 
 namespace collector {
@@ -11,28 +12,19 @@ ContainerMetadata::ContainerMetadata(sinsp* inspector) : event_extractor_(std::m
 }
 
 std::string ContainerMetadata::GetNamespace(sinsp_evt* event) {
-  const char* ns = event_extractor_->get_k8s_namespace(event);
-  return ns != nullptr ? ns : "";
+  return "";
 }
 
 std::string ContainerMetadata::GetNamespace(const std::string& container_id) {
   return GetContainerLabel(container_id, "io.kubernetes.pod.namespace");
 }
 
 std::string ContainerMetadata::GetContainerLabel(const std::string& container_id, const std::string& label) {
-  auto containers = inspector_->m_container_manager.get_containers();
-  const auto& container = containers->find(container_id);
-  if (container == containers->end()) {
-    return "";
-  }
-
-  const auto& labels = container->second->m_labels;
-  const auto& label_it = labels.find(label);
-  if (label_it == labels.end()) {
-    return "";
-  }
-
-  return label_it->second;
+  // Container labels are not available through the sinsp API.
+  CLOG_THROTTLED(DEBUG, std::chrono::seconds(300))
+      << "Container label lookup by container ID is not supported: "
+      << "container_id=" << container_id << " label=" << label;
+  return "";
 }
 
 }  // namespace collector

collector/lib/NetworkSignalHandler.cpp

@@ -1,11 +1,11 @@
 #include "NetworkSignalHandler.h"
 
-#include <cstring>
 #include <optional>
 
 #include <libsinsp/sinsp.h>
 
 #include "EventMap.h"
+#include "Utility.h"
 #include "system-inspector/EventExtractor.h"
 
 namespace collector {
@@ -75,17 +75,36 @@ std::optional<Connection> NetworkSignalHandler::GetConnection(sinsp_evt* evt) {
   }
 
   // With collect_connection_status_ set, we can prevent reporting of asynchronous
-  // connections which fail.
+  // connections which fail. This check is only relevant for connection
+  // establishment events (connect, accept, getsockopt). For send/recv events,
+  // a previous failed operation on the same fd can leave the socket marked as
+  // "failed" even when subsequent operations succeed, because the sinsp parser
+  // (parse_rw_exit) does not clear the failed flag on successful send/recv.
   if (collect_connection_status_) {
-    // note: connection status tracking enablement is managed in system_inspector::Service
-    if (fd_info->is_socket_failed()) {
-      // connect() failed or getsockopt(SO_ERROR) returned a failure
-      return std::nullopt;
-    }
-
-    if (fd_info->is_socket_pending()) {
-      // connect() returned E_INPROGRESS
-      return std::nullopt;
+    switch (evt->get_type()) {
+      case PPME_SOCKET_SENDTO_E:
+      case PPME_SOCKET_SENDTO_X:
+      case PPME_SOCKET_RECV_E:
+      case PPME_SOCKET_RECV_X:
+      case PPME_SOCKET_RECVFROM_E:
+      case PPME_SOCKET_RECVFROM_X:
+      case PPME_SOCKET_SENDMSG_E:
+      case PPME_SOCKET_SENDMSG_X:
+      case PPME_SOCKET_SENDMMSG_E:
+      case PPME_SOCKET_SENDMMSG_X:
+      case PPME_SOCKET_RECVMSG_E:
+      case PPME_SOCKET_RECVMSG_X:
+      case PPME_SOCKET_RECVMMSG_E:
+      case PPME_SOCKET_RECVMMSG_X:
+        break;
+      default:
+        if (fd_info->is_socket_failed()) {
+          return std::nullopt;
+        }
+        if (fd_info->is_socket_pending()) {
+          return std::nullopt;
+        }
+        break;
     }
   }
 
@@ -133,11 +152,12 @@ std::optional<Connection> NetworkSignalHandler::GetConnection(sinsp_evt* evt) {
   const Endpoint* local = is_server ? &server : &client;
   const Endpoint* remote = is_server ? &client : &server;
 
-  const std::string* container_id = event_extractor_->get_container_id(evt);
-  if (!container_id) {
+  auto container_id = GetContainerID(evt);
+  if (container_id.empty()) {
     return std::nullopt;
   }
-  return {Connection(*container_id, *local, *remote, l4proto, is_server)};
+
+  return {Connection(container_id, *local, *remote, l4proto, is_server)};
 }
 
 SignalHandler::Result NetworkSignalHandler::HandleSignal(sinsp_evt* evt) {

collector/lib/Process.cpp

@@ -5,6 +5,7 @@
 #include <libsinsp/sinsp.h>
 
 #include "CollectorStats.h"
+#include "Utility.h"
 #include "system-inspector/Service.h"
 
 namespace collector {
@@ -32,7 +33,10 @@ std::string Process::container_id() const {
   WaitForProcessInfo();
 
   if (system_inspector_threadinfo_) {
-    return system_inspector_threadinfo_->m_container_id;
+    auto id = GetContainerID(*system_inspector_threadinfo_);
+    if (!id.empty()) {
+      return id;
+    }
   }
 
   return NOT_AVAILABLE;

collector/lib/ProcessSignalFormatter.cpp

@@ -59,8 +59,8 @@ std::string extract_proc_args(sinsp_threadinfo* tinfo) {
 ProcessSignalFormatter::ProcessSignalFormatter(
     sinsp* inspector,
     const CollectorConfig& config) : event_names_(EventNames::GetInstance()),
+                                     inspector_(inspector),
                                      event_extractor_(std::make_unique<system_inspector::EventExtractor>()),
-                                     container_metadata_(inspector),
                                      config_(config) {
   event_extractor_->Init(inspector);
 }
@@ -176,8 +176,9 @@ ProcessSignal* ProcessSignalFormatter::CreateProcessSignal(sinsp_evt* event) {
   signal->set_allocated_time(timestamp);
 
   // set container_id
-  if (const std::string* container_id = event_extractor_->get_container_id(event)) {
-    signal->set_container_id(*container_id);
+  auto container_id = GetContainerID(event);
+  if (!container_id.empty()) {
+    signal->set_container_id(container_id);
   }
 
   // set process lineage
@@ -190,7 +191,7 @@ ProcessSignal* ProcessSignalFormatter::CreateProcessSignal(sinsp_evt* event) {
   }
 
   CLOG(DEBUG) << "Process (" << signal->container_id() << ": " << signal->pid() << "): "
-              << signal->name() << "[" << container_metadata_.GetNamespace(event) << "] "
+              << signal->name()
               << " (" << signal->exec_file_path() << ")"
               << " " << signal->args();
 
@@ -232,16 +233,16 @@ ProcessSignal* ProcessSignalFormatter::CreateProcessSignal(sinsp_threadinfo* tin
   signal->set_pid(tinfo->m_pid);
 
   // set user and group id credentials
-  signal->set_uid(tinfo->m_user.uid());
-  signal->set_gid(tinfo->m_group.gid());
+  signal->set_uid(tinfo->m_uid);
+  signal->set_gid(tinfo->m_gid);
 
   // set time
   auto timestamp = Allocate<Timestamp>();
   *timestamp = TimeUtil::NanosecondsToTimestamp(tinfo->m_clone_ts);
   signal->set_allocated_time(timestamp);
 
   // set container_id
-  signal->set_container_id(tinfo->m_container_id);
+  signal->set_container_id(GetContainerID(*tinfo));
 
   // set process lineage
   std::vector<LineageInfo> lineage;
@@ -265,11 +266,11 @@ std::string ProcessSignalFormatter::ProcessDetails(sinsp_evt* event) {
   std::stringstream ss;
   const std::string* path = event_extractor_->get_exepath(event);
   const std::string* name = event_extractor_->get_comm(event);
-  const std::string* container_id = event_extractor_->get_container_id(event);
+  auto container_id = GetContainerID(event);
   const char* args = event_extractor_->get_proc_args(event);
   const int64_t* pid = event_extractor_->get_pid(event);
 
-  ss << "Container: " << (container_id ? *container_id : "null")
+  ss << "Container: " << (container_id.empty() ? "null" : container_id)
      << ", Name: " << (name ? *name : "null")
      << ", PID: " << (pid ? *pid : -1)
      << ", Path: " << (path ? *path : "null")
@@ -327,7 +328,7 @@ void ProcessSignalFormatter::GetProcessLineage(sinsp_threadinfo* tinfo,
       return;
     }
   }
-  sinsp_threadinfo::visitor_func_t visitor = [this, &lineage](sinsp_threadinfo* pt) {
+  sinsp_thread_manager::visitor_func_t visitor = [this, &lineage](sinsp_threadinfo* pt) {
     if (pt == NULL) {
       return false;
     }
@@ -341,13 +342,13 @@ void ProcessSignalFormatter::GetProcessLineage(sinsp_threadinfo* tinfo,
     //
     // In back-ported eBPF probes, `m_vpid` will not be set for containers
     // running when collector comes online because /proc/{pid}/status does
-    // not contain namespace information, so `m_container_id` is checked
-    // instead. `m_container_id` is not enough on its own to identify
+    // not contain namespace information, so the container ID is checked
+    // instead. The container ID is not enough on its own to identify
     // containerized processes, because it is not guaranteed to be set on
     // all platforms.
     //
     if (pt->m_vpid == 0) {
-      if (pt->m_container_id.empty()) {
+      if (GetContainerID(*pt).empty()) {
         return false;
       }
     } else if (pt->m_pid == pt->m_vpid) {
@@ -361,7 +362,7 @@ void ProcessSignalFormatter::GetProcessLineage(sinsp_threadinfo* tinfo,
     // Collapse parent child processes that have the same path
     if (lineage.empty() || (lineage.back().parent_exec_file_path() != pt->m_exepath)) {
       LineageInfo info;
-      info.set_parent_uid(pt->m_user.uid());
+      info.set_parent_uid(pt->m_uid);
       info.set_parent_exec_file_path(pt->m_exepath);
       lineage.push_back(info);
     }
@@ -373,7 +374,7 @@ void ProcessSignalFormatter::GetProcessLineage(sinsp_threadinfo* tinfo,
 
     return true;
   };
-  mt->traverse_parent_state(visitor);
+  inspector_->m_thread_manager->traverse_parent_state(*mt, visitor);
   CountLineage(lineage);
 }
 

collector/lib/ProcessSignalFormatter.h

@@ -10,7 +10,6 @@
 
 #include "CollectorConfig.h"
 #include "CollectorStats.h"
-#include "ContainerMetadata.h"
 #include "EventNames.h"
 #include "ProtoSignalFormatter.h"
 
@@ -55,8 +54,8 @@ class ProcessSignalFormatter : public ProtoSignalFormatter<sensor::SignalStreamM
   void CountLineage(const std::vector<LineageInfo>& lineage);
 
   const EventNames& event_names_;
+  sinsp* inspector_;
   std::unique_ptr<system_inspector::EventExtractor> event_extractor_;
-  ContainerMetadata container_metadata_;
 
   const CollectorConfig& config_;
 };

collector/lib/Utility.cpp

@@ -57,9 +57,29 @@ const char* SignalName(int signum) {
   }
 }
 
+std::string GetContainerID(const sinsp_threadinfo& tinfo) {
+  for (const auto& [subsys, cgroup_path] : tinfo.cgroups()) {
+    if (auto id = ExtractContainerIDFromCgroup(cgroup_path)) {
+      return std::string(*id);
+    }
+  }
+  return {};
+}
+
+std::string GetContainerID(sinsp_evt* event) {
+  if (!event) {
+    return {};
+  }
+  sinsp_threadinfo* tinfo = event->get_thread_info();
+  if (!tinfo) {
+    return {};
+  }
+  return GetContainerID(*tinfo);
+}
+
 std::ostream& operator<<(std::ostream& os, const sinsp_threadinfo* t) {
   if (t) {
-    os << "Container: \"" << t->m_container_id << "\", Name: " << t->m_comm << ", PID: " << t->m_pid << ", Args: " << t->m_exe;
+    os << "Container: \"" << GetContainerID(*t) << "\", Name: " << t->m_comm << ", PID: " << t->m_pid << ", Args: " << t->m_exe;
   } else {
     os << "NULL\n";
   }
@@ -203,7 +223,7 @@ std::optional<std::string_view> ExtractContainerIDFromCgroup(std::string_view cg
   }
 
   auto container_id_part = cgroup.substr(cgroup.size() - (CONTAINER_ID_LENGTH + 1));
-  if (container_id_part[0] != '/' && container_id_part[0] != '-') {
+  if (container_id_part[0] != '/' && container_id_part[0] != '-' && container_id_part[0] != ':') {
     return {};
   }