Skip to content

Commit 8a5ef87

Browse files
spikatFlorentClarret
spikat
and
FlorentClarret
authored
[CWS] Revert: handle subrepears on exit (#51316)
### What does this PR do? It reverts #46318 ### Motivation ### Describe how you validated your changes ### Additional Notes Co-authored-by: florent.clarret <florent.clarret@datadoghq.com>
1 parent 86af1e4 commit 8a5ef87

35 files changed

Lines changed: 372 additions & 1797 deletions

‎docs/cloud-workload-security/linux_expressions.md‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,7 @@ The *file.rights* attribute can now be used in addition to *file.mode*. *file.mo
284284
| [`process.ancestors.mntns`](#common-pidcontext-mntns-doc) | MNTNS ID of the process |
285285
| [`process.ancestors.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
286286
| [`process.ancestors.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
287-
| [`process.ancestors.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
287+
| [`process.ancestors.ppid`](#common-process-ppid-doc) | Parent process ID |
288288
| [`process.ancestors.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
289289
| [`process.ancestors.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
290290
| [`process.ancestors.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -489,7 +489,7 @@ The *file.rights* attribute can now be used in addition to *file.mode*. *file.mo
489489
| [`process.parent.mntns`](#common-pidcontext-mntns-doc) | MNTNS ID of the process |
490490
| [`process.parent.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
491491
| [`process.parent.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
492-
| [`process.parent.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
492+
| [`process.parent.ppid`](#common-process-ppid-doc) | Parent process ID |
493493
| [`process.parent.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
494494
| [`process.parent.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
495495
| [`process.parent.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -508,7 +508,7 @@ The *file.rights* attribute can now be used in addition to *file.mode*. *file.mo
508508
| [`process.parent.user_session.ssh_public_key`](#common-sshsessioncontext-ssh_public_key-doc) | SSH public key used for authentication (if applicable) |
509509
| [`process.parent.user_session.ssh_session_id`](#common-sshsessioncontext-ssh_session_id-doc) | Unique identifier of the SSH user session on the host |
510510
| [`process.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
511-
| [`process.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
511+
| [`process.ppid`](#common-process-ppid-doc) | Parent process ID |
512512
| [`process.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
513513
| [`process.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
514514
| [`process.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -898,7 +898,7 @@ A process was executed (does not trigger on fork syscalls).
898898
| [`exec.mntns`](#common-pidcontext-mntns-doc) | MNTNS ID of the process |
899899
| [`exec.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
900900
| [`exec.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
901-
| [`exec.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
901+
| [`exec.ppid`](#common-process-ppid-doc) | Parent process ID |
902902
| [`exec.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
903903
| [`exec.syscall.path`](#exec-syscall-path-doc) | path argument of the syscall |
904904
| [`exec.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
@@ -1020,7 +1020,7 @@ A process was terminated
10201020
| [`exit.mntns`](#common-pidcontext-mntns-doc) | MNTNS ID of the process |
10211021
| [`exit.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
10221022
| [`exit.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
1023-
| [`exit.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
1023+
| [`exit.ppid`](#common-process-ppid-doc) | Parent process ID |
10241024
| [`exit.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
10251025
| [`exit.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
10261026
| [`exit.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -1487,7 +1487,7 @@ A ptrace command was executed
14871487
| [`ptrace.tracee.ancestors.mntns`](#common-pidcontext-mntns-doc) | MNTNS ID of the process |
14881488
| [`ptrace.tracee.ancestors.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
14891489
| [`ptrace.tracee.ancestors.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
1490-
| [`ptrace.tracee.ancestors.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
1490+
| [`ptrace.tracee.ancestors.ppid`](#common-process-ppid-doc) | Parent process ID |
14911491
| [`ptrace.tracee.ancestors.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
14921492
| [`ptrace.tracee.ancestors.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
14931493
| [`ptrace.tracee.ancestors.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -1692,7 +1692,7 @@ A ptrace command was executed
16921692
| [`ptrace.tracee.parent.mntns`](#common-pidcontext-mntns-doc) | MNTNS ID of the process |
16931693
| [`ptrace.tracee.parent.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
16941694
| [`ptrace.tracee.parent.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
1695-
| [`ptrace.tracee.parent.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
1695+
| [`ptrace.tracee.parent.ppid`](#common-process-ppid-doc) | Parent process ID |
16961696
| [`ptrace.tracee.parent.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
16971697
| [`ptrace.tracee.parent.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
16981698
| [`ptrace.tracee.parent.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -1711,7 +1711,7 @@ A ptrace command was executed
17111711
| [`ptrace.tracee.parent.user_session.ssh_public_key`](#common-sshsessioncontext-ssh_public_key-doc) | SSH public key used for authentication (if applicable) |
17121712
| [`ptrace.tracee.parent.user_session.ssh_session_id`](#common-sshsessioncontext-ssh_session_id-doc) | Unique identifier of the SSH user session on the host |
17131713
| [`ptrace.tracee.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
1714-
| [`ptrace.tracee.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
1714+
| [`ptrace.tracee.ppid`](#common-process-ppid-doc) | Parent process ID |
17151715
| [`ptrace.tracee.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
17161716
| [`ptrace.tracee.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
17171717
| [`ptrace.tracee.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -1996,7 +1996,7 @@ A setrlimit command was executed
19961996
| [`setrlimit.target.ancestors.mntns`](#common-pidcontext-mntns-doc) | MNTNS ID of the process |
19971997
| [`setrlimit.target.ancestors.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
19981998
| [`setrlimit.target.ancestors.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
1999-
| [`setrlimit.target.ancestors.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
1999+
| [`setrlimit.target.ancestors.ppid`](#common-process-ppid-doc) | Parent process ID |
20002000
| [`setrlimit.target.ancestors.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
20012001
| [`setrlimit.target.ancestors.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
20022002
| [`setrlimit.target.ancestors.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -2201,7 +2201,7 @@ A setrlimit command was executed
22012201
| [`setrlimit.target.parent.mntns`](#common-pidcontext-mntns-doc) | MNTNS ID of the process |
22022202
| [`setrlimit.target.parent.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
22032203
| [`setrlimit.target.parent.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
2204-
| [`setrlimit.target.parent.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
2204+
| [`setrlimit.target.parent.ppid`](#common-process-ppid-doc) | Parent process ID |
22052205
| [`setrlimit.target.parent.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
22062206
| [`setrlimit.target.parent.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
22072207
| [`setrlimit.target.parent.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -2220,7 +2220,7 @@ A setrlimit command was executed
22202220
| [`setrlimit.target.parent.user_session.ssh_public_key`](#common-sshsessioncontext-ssh_public_key-doc) | SSH public key used for authentication (if applicable) |
22212221
| [`setrlimit.target.parent.user_session.ssh_session_id`](#common-sshsessioncontext-ssh_session_id-doc) | Unique identifier of the SSH user session on the host |
22222222
| [`setrlimit.target.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
2223-
| [`setrlimit.target.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
2223+
| [`setrlimit.target.ppid`](#common-process-ppid-doc) | Parent process ID |
22242224
| [`setrlimit.target.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
22252225
| [`setrlimit.target.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
22262226
| [`setrlimit.target.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -2410,7 +2410,7 @@ A signal was sent
24102410
| [`signal.target.ancestors.mntns`](#common-pidcontext-mntns-doc) | MNTNS ID of the process |
24112411
| [`signal.target.ancestors.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
24122412
| [`signal.target.ancestors.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
2413-
| [`signal.target.ancestors.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
2413+
| [`signal.target.ancestors.ppid`](#common-process-ppid-doc) | Parent process ID |
24142414
| [`signal.target.ancestors.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
24152415
| [`signal.target.ancestors.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
24162416
| [`signal.target.ancestors.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -2615,7 +2615,7 @@ A signal was sent
26152615
| [`signal.target.parent.mntns`](#common-pidcontext-mntns-doc) | MNTNS ID of the process |
26162616
| [`signal.target.parent.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
26172617
| [`signal.target.parent.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
2618-
| [`signal.target.parent.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
2618+
| [`signal.target.parent.ppid`](#common-process-ppid-doc) | Parent process ID |
26192619
| [`signal.target.parent.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
26202620
| [`signal.target.parent.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
26212621
| [`signal.target.parent.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -2634,7 +2634,7 @@ A signal was sent
26342634
| [`signal.target.parent.user_session.ssh_public_key`](#common-sshsessioncontext-ssh_public_key-doc) | SSH public key used for authentication (if applicable) |
26352635
| [`signal.target.parent.user_session.ssh_session_id`](#common-sshsessioncontext-ssh_session_id-doc) | Unique identifier of the SSH user session on the host |
26362636
| [`signal.target.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
2637-
| [`signal.target.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
2637+
| [`signal.target.ppid`](#common-process-ppid-doc) | Parent process ID |
26382638
| [`signal.target.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
26392639
| [`signal.target.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
26402640
| [`signal.target.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
@@ -3581,7 +3581,7 @@ Definition: Port number
35813581
`accept.addr` `bind.addr` `connect.addr` `network.destination` `network.source` `network_flow_monitor.flows.destination` `network_flow_monitor.flows.source` `packet.destination` `packet.source`
35823582

35833583

3584-
### `*.ppid` {#common-pidcontext-ppid-doc}
3584+
### `*.ppid` {#common-process-ppid-doc}
35853585
Type: int
35863586

35873587
Definition: Parent process ID

‎docs/cloud-workload-security/secl_linux.json‎

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -530,7 +530,7 @@
530530
{
531531
"name": "process.ancestors.ppid",
532532
"definition": "Parent process ID",
533-
"property_doc_link": "common-pidcontext-ppid-doc"
533+
"property_doc_link": "common-process-ppid-doc"
534534
},
535535
{
536536
"name": "process.ancestors.sid",
@@ -1555,7 +1555,7 @@
15551555
{
15561556
"name": "process.parent.ppid",
15571557
"definition": "Parent process ID",
1558-
"property_doc_link": "common-pidcontext-ppid-doc"
1558+
"property_doc_link": "common-process-ppid-doc"
15591559
},
15601560
{
15611561
"name": "process.parent.sid",
@@ -1650,7 +1650,7 @@
16501650
{
16511651
"name": "process.ppid",
16521652
"definition": "Parent process ID",
1653-
"property_doc_link": "common-pidcontext-ppid-doc"
1653+
"property_doc_link": "common-process-ppid-doc"
16541654
},
16551655
{
16561656
"name": "process.sid",
@@ -3268,7 +3268,7 @@
32683268
{
32693269
"name": "exec.ppid",
32703270
"definition": "Parent process ID",
3271-
"property_doc_link": "common-pidcontext-ppid-doc"
3271+
"property_doc_link": "common-process-ppid-doc"
32723272
},
32733273
{
32743274
"name": "exec.sid",
@@ -3852,7 +3852,7 @@
38523852
{
38533853
"name": "exit.ppid",
38543854
"definition": "Parent process ID",
3855-
"property_doc_link": "common-pidcontext-ppid-doc"
3855+
"property_doc_link": "common-process-ppid-doc"
38563856
},
38573857
{
38583858
"name": "exit.sid",
@@ -5865,7 +5865,7 @@
58655865
{
58665866
"name": "ptrace.tracee.ancestors.ppid",
58675867
"definition": "Parent process ID",
5868-
"property_doc_link": "common-pidcontext-ppid-doc"
5868+
"property_doc_link": "common-process-ppid-doc"
58695869
},
58705870
{
58715871
"name": "ptrace.tracee.ancestors.sid",
@@ -6890,7 +6890,7 @@
68906890
{
68916891
"name": "ptrace.tracee.parent.ppid",
68926892
"definition": "Parent process ID",
6893-
"property_doc_link": "common-pidcontext-ppid-doc"
6893+
"property_doc_link": "common-process-ppid-doc"
68946894
},
68956895
{
68966896
"name": "ptrace.tracee.parent.sid",
@@ -6985,7 +6985,7 @@
69856985
{
69866986
"name": "ptrace.tracee.ppid",
69876987
"definition": "Parent process ID",
6988-
"property_doc_link": "common-pidcontext-ppid-doc"
6988+
"property_doc_link": "common-process-ppid-doc"
69896989
},
69906990
{
69916991
"name": "ptrace.tracee.sid",
@@ -8254,7 +8254,7 @@
82548254
{
82558255
"name": "setrlimit.target.ancestors.ppid",
82568256
"definition": "Parent process ID",
8257-
"property_doc_link": "common-pidcontext-ppid-doc"
8257+
"property_doc_link": "common-process-ppid-doc"
82588258
},
82598259
{
82608260
"name": "setrlimit.target.ancestors.sid",
@@ -9279,7 +9279,7 @@
92799279
{
92809280
"name": "setrlimit.target.parent.ppid",
92819281
"definition": "Parent process ID",
9282-
"property_doc_link": "common-pidcontext-ppid-doc"
9282+
"property_doc_link": "common-process-ppid-doc"
92839283
},
92849284
{
92859285
"name": "setrlimit.target.parent.sid",
@@ -9374,7 +9374,7 @@
93749374
{
93759375
"name": "setrlimit.target.ppid",
93769376
"definition": "Parent process ID",
9377-
"property_doc_link": "common-pidcontext-ppid-doc"
9377+
"property_doc_link": "common-process-ppid-doc"
93789378
},
93799379
{
93809380
"name": "setrlimit.target.sid",
@@ -10220,7 +10220,7 @@
1022010220
{
1022110221
"name": "signal.target.ancestors.ppid",
1022210222
"definition": "Parent process ID",
10223-
"property_doc_link": "common-pidcontext-ppid-doc"
10223+
"property_doc_link": "common-process-ppid-doc"
1022410224
},
1022510225
{
1022610226
"name": "signal.target.ancestors.sid",
@@ -11245,7 +11245,7 @@
1124511245
{
1124611246
"name": "signal.target.parent.ppid",
1124711247
"definition": "Parent process ID",
11248-
"property_doc_link": "common-pidcontext-ppid-doc"
11248+
"property_doc_link": "common-process-ppid-doc"
1124911249
},
1125011250
{
1125111251
"name": "signal.target.parent.sid",
@@ -11340,7 +11340,7 @@
1134011340
{
1134111341
"name": "signal.target.ppid",
1134211342
"definition": "Parent process ID",
11343-
"property_doc_link": "common-pidcontext-ppid-doc"
11343+
"property_doc_link": "common-process-ppid-doc"
1134411344
},
1134511345
{
1134611346
"name": "signal.target.sid",
@@ -14648,7 +14648,7 @@
1464814648
},
1464914649
{
1465014650
"name": "*.ppid",
14651-
"link": "common-pidcontext-ppid-doc",
14651+
"link": "common-process-ppid-doc",
1465214652
"type": "int",
1465314653
"definition": "Parent process ID",
1465414654
"prefixes": [

‎pkg/security/ebpf/c/include/constants/offsets/process.h‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -21,18 +21,6 @@ u64 __attribute__((always_inline)) get_sizeof_upid() {
2121
return sizeof_upid;
2222
}
2323

24-
u64 __attribute__((always_inline)) get_task_struct_real_parent_offset() {
25-
u64 offset;
26-
LOAD_CONSTANT("task_struct_real_parent_offset", offset);
27-
return offset;
28-
}
29-
30-
u64 __attribute__((always_inline)) get_task_struct_tgid_offset() {
31-
u64 offset;
32-
LOAD_CONSTANT("task_struct_tgid_offset", offset);
33-
return offset;
34-
}
35-
3624
u64 __attribute__((always_inline)) get_task_struct_pid_offset() {
3725
u64 kernel_has_pid_link_struct;
3826
LOAD_CONSTANT("kernel_has_pid_link_struct", kernel_has_pid_link_struct);

‎pkg/security/ebpf/c/include/helpers/approvers.h‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -438,7 +438,11 @@ enum SYSCALL_STATE __attribute__((always_inline)) approve_open_sample(struct den
438438
return DISCARDED;
439439
}
440440

441-
u32 ppid = get_current_ppid();
441+
u32 ppid = 0;
442+
struct pid_cache_t *pid_entry = (struct pid_cache_t *)bpf_map_lookup_elem(&pid_cache, &pid);
443+
if (pid_entry != NULL) {
444+
ppid = pid_entry->ppid;
445+
}
442446

443447
struct process_path_key_t key = {
444448
.ppid = ppid,

‎pkg/security/ebpf/c/include/helpers/process.h‎

Lines changed: 1 addition & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ void __attribute__((always_inline)) copy_proc_entry(struct process_entry_t *src,
3939
void __attribute__((always_inline)) copy_pid_cache_except_exit_ts(struct pid_cache_t *src, struct pid_cache_t *dst) {
4040
dst->cookie = src->cookie;
4141
dst->user_session_id = src->user_session_id;
42+
dst->ppid = src->ppid;
4243
dst->fork_timestamp = src->fork_timestamp;
4344
dst->fork_flags = src->fork_flags;
4445
dst->sid = src->sid;
@@ -67,21 +68,6 @@ struct proc_cache_t *__attribute__((always_inline)) get_proc_cache(u32 tgid) {
6768
return get_proc_from_cookie(pid_entry->cookie);
6869
}
6970

70-
static u32 __attribute__((always_inline)) get_current_ppid(void) {
71-
u32 ppid = 0;
72-
u64 real_parent_offset = get_task_struct_real_parent_offset();
73-
u64 tgid_offset = get_task_struct_tgid_offset();
74-
if (real_parent_offset > 0 && tgid_offset > 0) {
75-
struct task_struct *cur_task = (struct task_struct *)bpf_get_current_task();
76-
struct task_struct *parent = NULL;
77-
bpf_probe_read_kernel(&parent, sizeof(parent), (void *)cur_task + real_parent_offset);
78-
if (parent) {
79-
bpf_probe_read_kernel(&ppid, sizeof(ppid), (void *)parent + tgid_offset);
80-
}
81-
}
82-
return ppid;
83-
}
84-
8571
static struct proc_cache_t *__attribute__((always_inline)) fill_process_context_with_pid_tgid(struct process_context_t *data, u64 pid_tgid) {
8672
u32 tgid = pid_tgid >> 32;
8773

@@ -100,12 +86,6 @@ static struct proc_cache_t *__attribute__((always_inline)) fill_process_context_
10086
data->is_kworker = 1;
10187
}
10288

103-
// Read the live ppid from real_parent->tgid. Only valid when called
104-
// from the actual task context (not for stored pid_tgid from io_uring).
105-
if (pid_tgid == bpf_get_current_pid_tgid()) {
106-
data->ppid = get_current_ppid();
107-
}
108-
10989
struct pid_cache_t *pid_entry = get_pid_cache(tgid);
11090
if (!pid_entry) {
11191
return NULL;

‎pkg/security/ebpf/c/include/hooks/exec.h‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -226,12 +226,10 @@ int __attribute__((always_inline)) sched_process_fork_common(void *ctx, u32 pid,
226226
return 0;
227227
}
228228

229-
// sched::sched_process_fork is triggered from the parent process, update the pid / tid to the child value.
230-
// Override ppid: fill_process_context set it to the grandparent (parent's real_parent), but for
231-
// the child the ppid is the parent PID.
229+
event->pid_entry.ppid = ppid;
230+
// sched::sched_process_fork is triggered from the parent process, update the pid / tid to the child value
232231
event->process.pid = pid;
233232
event->process.tid = pid;
234-
event->process.ppid = ppid;
235233

236234
event->pid_entry.fork_flags = syscall->fork.flags;
237235

‎pkg/security/ebpf/c/include/structs/events_context.h‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,7 @@ struct process_context_t {
3030
u32 netns;
3131
u32 mntns;
3232
u32 is_kworker;
33-
u32 ppid;
3433
u32 sid;
35-
u32 padding_sid;
3634
u64 inode;
3735
u64 user_session_id;
3836
};

0 commit comments

Comments
 (0)