diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c21b4984..b5374b14 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -49,25 +49,9 @@ jobs: runner: ubuntu-latest kernels: '[ "amazonlinux2", "debian", "fedora", "mainline", "rocky", "ubuntu-aws", "ubuntu-azure", "ubuntu-gcp", "ubuntu-gke", "ubuntu-oracle" ]' secrets: inherit - local-build-x86_64: - name: Platform (x86_64) - uses: ./.github/workflows/local-build.yml - with: - architecture: x86_64 - runner: ubuntu-latest - secrets: inherit - local-build-aarch64: - name: Platform (aarch64) - uses: ./.github/workflows/local-build.yml - with: - architecture: aarch64 - runner: ubuntu-latest - secrets: inherit merge-auditor: name: CI Merge Auditor needs: - - local-build-x86_64 - - local-build-aarch64 - multikernel-tester-x86_64 - multikernel-tester-aarch64 runs-on: ubuntu-latest diff --git a/.github/workflows/issues.yml b/.github/workflows/issues.yml deleted file mode 100644 index ca162c80..00000000 --- a/.github/workflows/issues.yml +++ /dev/null @@ -1,21 +0,0 @@ -name: Add issues to AWP Sensor Project - -on: - issues: - types: - - opened - - transferred - - reopened - - edited - - synchronized - -jobs: - add-to-project: - name: Add issue to project - runs-on: ubuntu-latest - continue-on-error: true - steps: - - uses: actions/add-to-project@v0.3.0 - with: - project-url: https://github.com/orgs/elastic/projects/765 - github-token: ${{ secrets.ELASTIC_PAT }} diff --git a/.github/workflows/local-build.yml b/.github/workflows/local-build.yml deleted file mode 100644 index b8b4a93b..00000000 --- a/.github/workflows/local-build.yml +++ /dev/null @@ -1,42 +0,0 @@ -on: - workflow_call: - inputs: - architecture: - required: true - type: string - description: Architecture string, for example aarch64 - runner: - required: true - type: string - description: The runner to execute the build on, for example ubuntu-latest - -jobs: - local-image-build: - name: Container Image Build - runs-on: ${{ inputs.runner }} - steps: - - uses: actions/checkout@v2 - - name: Get Dockerfile Hash - run: echo "DOCKERFILE_HASH=$(md5sum docker/Dockerfile.builder | awk '{print $1}')" >> $GITHUB_ENV - - name: Check if rebuild is required - id: cachedockerfile - uses: actions/cache@v3 - with: - key: dockerfile-${{ inputs.architecture }}-${{ env.DOCKERFILE_HASH }} - path: docker/Dockerfile.builder - - name: Configure System - if: ${{ steps.cachedockerfile.outputs.cache-hit != 'true' || github.event_name != 'pull_request' }} - run: | - sudo apt-get update -y - sudo apt-get install -y qemu-user-static - env: - DEBIAN_FRONTEND: noninteractive - - name: Test Container Image Formatting - if: ${{ steps.cachedockerfile.outputs.cache-hit != 'true' || github.event_name != 'pull_request' }} - run: make test-format BUILD_CONTAINER_IMAGE=True ARCH=${{ inputs.architecture }} - - name: Test Container Image Build - if: ${{ steps.cachedockerfile.outputs.cache-hit != 'true' || github.event_name != 'pull_request' }} - run: make build BUILD_CONTAINER_IMAGE=True ARCH=${{ inputs.architecture }} - - name: Test Packaging - if: ${{ steps.cachedockerfile.outputs.cache-hit != 'true' || github.event_name != 'pull_request' }} - run: make package BUILD_CONTAINER_IMAGE=True ARCH=${{ inputs.architecture }} diff --git a/non-GPL/Events/EventsTrace/EventsTrace.c b/non-GPL/Events/EventsTrace/EventsTrace.c index a66321d7..2469346b 100644 --- a/non-GPL/Events/EventsTrace/EventsTrace.c +++ b/non-GPL/Events/EventsTrace/EventsTrace.c @@ -16,6 +16,7 @@ #include #include #include +#include #include #include @@ -109,6 +110,7 @@ uint64_t g_events_env = 0; uint64_t g_features_env = 0; bool g_print_features_init = 0; +bool g_features_printed = 0; bool g_unbuffer_stdout = 0; bool g_libbpf_verbose = 0; @@ -859,6 +861,10 @@ static void out_network_connection_closed_event(struct ebpf_net_event *evt) static int event_ctx_callback(struct ebpf_event_header *evt_hdr) { + if (g_print_features_init) + while (!g_features_printed) + usleep(100000); + switch (evt_hdr->type) { case EBPF_EVENT_PROCESS_FORK: out_process_fork((struct ebpf_process_fork_event *)evt_hdr); @@ -945,8 +951,10 @@ int main(int argc, char **argv) goto out; } - if (g_print_features_init) + if (g_print_features_init) { print_init_msg(ebpf_event_ctx__get_features(ctx)); + g_features_printed = 1; + } while (!exiting) { err = ebpf_event_ctx__next(ctx, 10); diff --git a/testing/scripts/invoke_qemu.sh b/testing/scripts/invoke_qemu.sh index 6f9364e6..e4b64a47 100755 --- a/testing/scripts/invoke_qemu.sh +++ b/testing/scripts/invoke_qemu.sh @@ -100,6 +100,7 @@ main() { qemu-system-${arch} \ -nographic -m 1G \ + -smp 8 \ -kernel $kernel \ -initrd $initramfs \ -append "$bootparams" \ diff --git a/testing/test_bins/create_rename_delete_file.c b/testing/test_bins/create_rename_delete_file.c index 549ee881..83e7b81f 100644 --- a/testing/test_bins/create_rename_delete_file.c +++ b/testing/test_bins/create_rename_delete_file.c @@ -7,9 +7,11 @@ * License 2.0. */ +#include #include #include #include +#include #include #include "common.h" @@ -24,14 +26,40 @@ int main() printf("{ \"pid_info\": %s, \"filename_orig\": \"%s\", \"filename_new\": \"%s\"}\n", pid_info, filename_orig, filename_new); - FILE *f; - CHECK(f = fopen(filename_orig, "w"), NULL); + int fd; + // create + CHECK(fd = open(filename_orig, O_WRONLY | O_CREAT | O_TRUNC, 0644), -1); + + // rename CHECK(rename(filename_orig, filename_new), -1); + + // modify(permissions) CHECK(chmod(filename_new, S_IRWXU | S_IRWXG | S_IRWXO), -1); - CHECK(fprintf(f, "test"), -1); - CHECK(ftruncate(fileno(f), 0), -1); - CHECK(fclose(f), EOF); + + // modify(content) + if (write(fd, "test", 4) != 4) { + perror("write failed"); + return -1; + } + + // modify(content) + struct iovec iov[2]; + iov[0].iov_base = "test2"; + iov[0].iov_len = 5; + iov[1].iov_base = "test3"; + iov[1].iov_len = 5; + if (writev(fd, iov, 2) != 10) { + perror("writev failed"); + return -1; + } + + // modify(content) + CHECK(ftruncate(fd, 0), -1); + + close(fd); + + // delete CHECK(unlink(filename_new), -1); return 0; diff --git a/testing/testrunner/tests.go b/testing/testrunner/tests.go index 71ab9476..a8a45710 100644 --- a/testing/testrunner/tests.go +++ b/testing/testrunner/tests.go @@ -215,7 +215,7 @@ func TestFileDelete(et *EventsTraceInstance) { AssertStringsEqual(fileDeleteEvent.Finfo.Type, "FILE") AssertUint64NotEqual(fileDeleteEvent.Finfo.Inode, 0) AssertUint64Equal(fileDeleteEvent.Finfo.Mode, 100777) - AssertUint64Equal(fileDeleteEvent.Finfo.Size, 4) + AssertUint64Equal(fileDeleteEvent.Finfo.Size, 0) AssertUint64Equal(fileDeleteEvent.Finfo.Uid, 0) AssertUint64Equal(fileDeleteEvent.Finfo.Gid, 0) } @@ -401,7 +401,7 @@ func TestFileModify(et *EventsTraceInstance) { TestFail("failed to unmarshal json", err) } - eventsCount := 3 // chmod, write, truncate + eventsCount := 4 // chmod, write, writev, truncate events := make([]FileModifyEvent, 0, eventsCount) for { var event FileModifyEvent @@ -427,12 +427,17 @@ func TestFileModify(et *EventsTraceInstance) { // write AssertStringsEqual(events[1].Path, binOutput.FileNameNew) AssertStringsEqual(events[1].ChangeType, "CONTENT") + AssertUint64Equal(events[1].Finfo.Size, 4) - // truncate + // writev AssertStringsEqual(events[2].Path, binOutput.FileNameNew) AssertStringsEqual(events[2].ChangeType, "CONTENT") + AssertUint64Equal(events[2].Finfo.Size, 4+5+5) - AssertTrue(events[1].Finfo.Size != events[2].Finfo.Size) + // truncate + AssertStringsEqual(events[3].Path, binOutput.FileNameNew) + AssertStringsEqual(events[3].ChangeType, "CONTENT") + AssertUint64Equal(events[3].Finfo.Size, 0) } func TestTtyWrite(et *EventsTraceInstance) { diff --git a/testing/testrunner/utils.go b/testing/testrunner/utils.go index 248ccbdc..ffdfbd84 100644 --- a/testing/testrunner/utils.go +++ b/testing/testrunner/utils.go @@ -343,7 +343,7 @@ func RunTest(f func()) { func RunEventsTest(f func(*EventsTraceInstance), args ...string) { testFuncName := runtime.FuncForPC(reflect.ValueOf(f).Pointer()).Name() - ctx, cancel := context.WithTimeout(context.TODO(), 30*time.Second) + ctx, cancel := context.WithTimeout(context.TODO(), 90*time.Second) et := NewEventsTrace(ctx, args...) et.Start(ctx)