Skip to content

Commit

Permalink
trigger: fix context apply (aquasecurity#2090)
Browse files Browse the repository at this point in the history
Fixes applying the context from triggering event.
Previously the invoking context was applied with a reference assignment
however when the value went out of scope the reference popped back
to the previous value.

Also adds ContainerID and ProcessName to happy path tests as they are
critical fields.
  • Loading branch information
NDStrahilevitz authored Aug 24, 2022
1 parent d4ad612 commit edcaf81
Show file tree
Hide file tree
Showing 2 changed files with 16 additions and 6 deletions.
6 changes: 5 additions & 1 deletion pkg/ebpf/events_processor.go
Original file line number Diff line number Diff line change
Expand Up @@ -413,7 +413,11 @@ func (t *Tracee) processEvent(event *trace.Event) error {
if err != nil {
return fmt.Errorf("failed to apply invoke context on %s event: %s", event.EventName, err)
}
event = &withInvokingContext

// this was previously event = &withInvokingContext
// however, if applied as such, withInvokingContext will go out of scope and the reference will be moved back
// as such we apply the value internally and not through a referene switch
(*event) = withInvokingContext
}

return nil
Expand Down
16 changes: 11 additions & 5 deletions pkg/events/trigger/context_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -25,14 +25,18 @@ func TestContext_Apply(t *testing.T) {
EventName: "open",
Timestamp: 123,
ProcessID: 5,
ContainerID: "abc123",
ProcessName: "insmod",
ReturnValue: 2,
},
inputEvent: trace.Event{
EventID: int(events.PrintNetSeqOps),
EventName: "print_net_seq_ops",
Timestamp: 187,
ProcessID: 0,
ArgsNum: 3,
EventID: int(events.PrintNetSeqOps),
EventName: "print_net_seq_ops",
Timestamp: 187,
ProcessID: 0,
ArgsNum: 3,
ContainerID: "",
ProcessName: "tracee-ebpf",
Args: []trace.Argument{
{
ArgMeta: trace.ArgMeta{
Expand Down Expand Up @@ -63,6 +67,8 @@ func TestContext_Apply(t *testing.T) {
Timestamp: 123,
ProcessID: 5,
ReturnValue: 0,
ContainerID: "abc123",
ProcessName: "insmod",
ArgsNum: 3,
Args: []trace.Argument{
{
Expand Down

0 comments on commit edcaf81

Please sign in to comment.