Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[backport/v1.2] Add support to dump processLRU #3038

Merged
merged 1 commit into from
Oct 28, 2024
Merged

[backport/v1.2] Add support to dump processLRU #3038

merged 1 commit into from
Oct 28, 2024

Conversation

tpapagian
Copy link
Member

Backport of #2246.

@tpapagian
Add support to dump processLRU
f3247ba 
[upstream commit 02c4fdd]

This patch adds support to print the contents of process cache. This may be useful during debugging.

Example:

$ sudo ./tetra dump processCache
{"process":{"exec_id":"YXBhcGFnLXVidW50dS1kZXY6MTAwNjgwMDAwMDAwOjE4OTg=", "pid":1898, "uid":1010, "cwd":"/home/apapag", "binary":"/home/apapag/.vscode-server/cli/servers/Stable-fee1edb8d6d72a0ddff41e5f71a671c23ed924b9/server/node", "arguments":"--dns-result-order=ipv4first /home/apapag/.vscode-server/cli/servers/Stable-fee1edb8d6d72a0ddff41e5f71a671c23ed924b9/server/out/bootstrap-fork --type=extensionHost --transformURIs --useHostProxy=false", "flags":"procFS auid", "start_time":"2024-09-05T07:00:23.274832687Z", "auid":1010, "parent_exec_id":"YXBhcGFnLXVidW50dS1kZXY6ODk5NTAwMDAwMDA6MTc3Ng==", "tid":1898}, "color":"inUse", "refcnt":5, "refcntOps":{"parent++":346, "parent--":342, "process++":1}}
{"process":{"exec_id":"YXBhcGFnLXVidW50dS1kZXY6MTU2OTQ0MDAwMDAwMDozMzM3OA==", "pid":33378, "uid":1010, "cwd":"/home/apapag/tetragon", "binary":"/usr/bin/bash", "flags":"procFS auid", "start_time":"2024-09-05T07:24:52.034832554Z", "auid":1010, "parent_exec_id":"YXBhcGFnLXVidW50dS1kZXY6MTU2OTIyMDAwMDAwMDozMzM3Nw==", "tid":33378}, "color":"inUse", "refcnt":2, "refcntOps":{"parent++":30, "parent--":29, "process++":1}}
{"process":{"exec_id":"YXBhcGFnLXVidW50dS1kZXY6Mjg1MjM2Nzc1Nzc4NDo1MjE1Mg==", "pid":52152, "uid":0, "cwd":"/home/apapag/tetragon", "binary":"/usr/bin/sudo", "arguments":"./tetra dump processCache --skip-zero-refcnt", "flags":"execve clone", "start_time":"2024-09-05T07:46:14.962590751Z", "auid":1010, "parent_exec_id":"YXBhcGFnLXVidW50dS1kZXY6MTU2OTQ0MDAwMDAwMDozMzM3OA==", "tid":52152}, "color":"inUse", "refcnt":2, "refcntOps":{"parent++":1, "process++":1}}
{"process":{"exec_id":"YXBhcGFnLXVidW50dS1kZXY6Mjg1MjM3NjMxOTI2OTo1MjE1NA==", "pid":52154, "uid":0, "cwd":"/home/apapag/tetragon", "binary":"/home/apapag/tetragon/tetra", "arguments":"dump processCache --skip-zero-refcnt", "flags":"execve clone", "start_time":"2024-09-05T07:46:14.971151996Z", "auid":1010, "parent_exec_id":"YXBhcGFnLXVidW50dS1kZXY6Mjg1MjM3NTU4MTQxMTo1MjE1Mw==", "tid":52154}, "color":"inUse", "refcnt":1, "refcntOps":{"process++":1}}
{"process":{"exec_id":"YXBhcGFnLXVidW50dS1kZXY6Mjg1MjM3NTU4MTQxMTo1MjE1Mw==", "pid":52153, "uid":0, "cwd":"/home/apapag/tetragon", "binary":"/usr/bin/sudo", "arguments":"./tetra dump processCache --skip-zero-refcnt", "flags":"execve", "start_time":"2024-09-05T07:46:14.970414578Z", "auid":1010, "parent_exec_id":"YXBhcGFnLXVidW50dS1kZXY6Mjg1MjM2Nzc1Nzc4NDo1MjE1Mg==", "refcnt":1, "tid":52153}, "color":"inUse", "refcnt":2, "refcntOps":{"parent++":2, "parent--":1, "process++":1}}
[...]

We also provide "--skip-zero-refcnt" command line argument to print only the entries with refcnt not equals to zero.

$ sudo ./tetra dump processCache --skip-zero-refcnt
{"process":{"exec_id":"YXBhcGFnLXVidW50dS1kZXY6MTAwNjgwMDAwMDAwOjE4OTg=", "pid":1898, "uid":1010, "cwd":"/home/apapag", "binary":"/home/apapag/.vscode-server/cli/servers/Stable-fee1edb8d6d72a0ddff41e5f71a671c23ed924b9/server/node", "arguments":"--dns-result-order=ipv4first /home/apapag/.vscode-server/cli/servers/Stable-fee1edb8d6d72a0ddff41e5f71a671c23ed924b9/server/out/bootstrap-fork --type=extensionHost --transformURIs --useHostProxy=false", "flags":"procFS auid", "start_time":"2024-09-05T07:00:23.274832687Z", "auid":1010, "parent_exec_id":"YXBhcGFnLXVidW50dS1kZXY6ODk5NTAwMDAwMDA6MTc3Ng==", "tid":1898}, "color":"inUse", "refcnt":5, "refcntOps":{"parent++":346, "parent--":342, "process++":1}}
{"process":{"exec_id":"YXBhcGFnLXVidW50dS1kZXY6MTU2OTQ0MDAwMDAwMDozMzM3OA==", "pid":33378, "uid":1010, "cwd":"/home/apapag/tetragon", "binary":"/usr/bin/bash", "flags":"procFS auid", "start_time":"2024-09-05T07:24:52.034832554Z", "auid":1010, "parent_exec_id":"YXBhcGFnLXVidW50dS1kZXY6MTU2OTIyMDAwMDAwMDozMzM3Nw==", "tid":33378}, "color":"inUse", "refcnt":2, "refcntOps":{"parent++":30, "parent--":29, "process++":1}}
{"process":{"exec_id":"YXBhcGFnLXVidW50dS1kZXY6Mjg1MjM2Nzc1Nzc4NDo1MjE1Mg==", "pid":52152, "uid":0, "cwd":"/home/apapag/tetragon", "binary":"/usr/bin/sudo", "arguments":"./tetra dump processCache --skip-zero-refcnt", "flags":"execve clone", "start_time":"2024-09-05T07:46:14.962590751Z", "auid":1010, "parent_exec_id":"YXBhcGFnLXVidW50dS1kZXY6MTU2OTQ0MDAwMDAwMDozMzM3OA==", "tid":52152}, "color":"inUse", "refcnt":2, "refcntOps":{"parent++":1, "process++":1}}
{"process":{"exec_id":"YXBhcGFnLXVidW50dS1kZXY6Mjg1MjM3NjMxOTI2OTo1MjE1NA==", "pid":52154, "uid":0, "cwd":"/home/apapag/tetragon", "binary":"/home/apapag/tetragon/tetra", "arguments":"dump processCache --skip-zero-refcnt", "flags":"execve clone", "start_time":"2024-09-05T07:46:14.971151996Z", "auid":1010, "parent_exec_id":"YXBhcGFnLXVidW50dS1kZXY6Mjg1MjM3NTU4MTQxMTo1MjE1Mw==", "tid":52154}, "color":"inUse", "refcnt":1, "refcntOps":{"process++":1}}
{"process":{"exec_id":"YXBhcGFnLXVidW50dS1kZXY6Mjg1MjM3NTU4MTQxMTo1MjE1Mw==", "pid":52153, "uid":0, "cwd":"/home/apapag/tetragon", "binary":"/usr/bin/sudo", "arguments":"./tetra dump processCache --skip-zero-refcnt", "flags":"execve", "start_time":"2024-09-05T07:46:14.970414578Z", "auid":1010, "parent_exec_id":"YXBhcGFnLXVidW50dS1kZXY6Mjg1MjM2Nzc1Nzc4NDo1MjE1Mg==", "refcnt":1, "tid":52153}, "color":"inUse", "refcnt":2, "refcntOps":{"parent++":2, "parent--":1, "process++":1}}
[...]

Signed-off-by: Anastasios Papagiannis <[email protected]>
@tpapagian tpapagian requested a review from a team as a code owner October 24, 2024 09:06
@tpapagian tpapagian requested review from kevsecurity and removed request for a team October 24, 2024 09:06
@tpapagian tpapagian closed this Oct 24, 2024
@tpapagian tpapagian reopened this Oct 24, 2024
@tpapagian tpapagian marked this pull request as draft October 24, 2024 09:07
@tpapagian tpapagian added the release-note/misc This PR makes changes that have no direct user impact. label Oct 24, 2024
@tpapagian tpapagian marked this pull request as ready for review October 24, 2024 09:54
@tpapagian tpapagian mentioned this pull request Oct 24, 2024
Merged
mtardy
mtardy approved these changes Oct 24, 2024
View reviewed changes
Copy link
Member

@mtardy mtardy left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot for that

@tpapagian tpapagian merged commit 2d4c40c into v1.2 Oct 28, 2024
62 of 68 checks passed
@tpapagian tpapagian deleted the pr/apapag/backport_2246_v1.2 branch October 28, 2024 08:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@kevsecurity kevsecurity kevsecurity approved these changes

@mtardy mtardy mtardy approved these changes

Assignees
No one assigned
Labels
release-note/misc This PR makes changes that have no direct user impact.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@tpapagian @mtardy @kevsecurity