[EBPF] Exclude Host Profiler from library uprobes

Author: Gandem

pkg/ebpf/uprobes/attacher.go

@@ -55,7 +55,7 @@ var (
 	// ErrNoMatchingRule is returned when no rule matches the shared library path.
 	ErrNoMatchingRule = errors.New("no matching rule")
 	// regex that defines internal DataDog processes
-	internalProcessRegex = regexp.MustCompile("datadog-agent/.*/((process|security|trace|otel)-agent|system-probe|agent)")
+	internalProcessRegex = regexp.MustCompile("datadog-agent/.*/((process|security|trace|otel)-agent|host-profiler|system-probe|agent)")
 )
 
 // AttachTarget defines the target to which we should attach the probes, libraries or executables
@@ -703,6 +703,29 @@ func (ua *UprobeAttacher) buildRegisterCallbacks(matchingRules []*AttachRule, pr
 	return registerCB, unregisterCB
 }
 
+func resolveExecutable(procInfo *ProcInfo) (string, error) {
+	binPath, err := procInfo.Exe()
+	if err == nil || errors.Is(err, os.ErrNotExist) || errors.Is(err, syscall.ESRCH) {
+		return binPath, err
+	}
+	return "", utils.NewUnknownAttachmentError(err)
+}
+
+func (ua *UprobeAttacher) rejectInternalProcess(procInfo *ProcInfo) error {
+	if (ua.config.ExcludeTargets & ExcludeInternal) == 0 {
+		return nil
+	}
+
+	binPath, err := resolveExecutable(procInfo)
+	if err != nil {
+		return err
+	}
+	if internalProcessRegex.MatchString(binPath) {
+		return ErrInternalDDogProcessRejected
+	}
+	return nil
+}
+
 // AttachLibrary attaches the probes to the given library, opened by a given PID
 func (ua *UprobeAttacher) AttachLibrary(path string, pid uint32) (err error) {
 	defer func() {
@@ -722,7 +745,12 @@ func (ua *UprobeAttacher) AttachLibrary(path string, pid uint32) (err error) {
 		return ErrNoMatchingRule
 	}
 
-	registerCB, unregisterCB := ua.buildRegisterCallbacks(matchingRules, NewProcInfo(ua.config.ProcRoot, pid))
+	procInfo := NewProcInfo(ua.config.ProcRoot, pid)
+	if err := ua.rejectInternalProcess(procInfo); err != nil {
+		return err
+	}
+
+	registerCB, unregisterCB := ua.buildRegisterCallbacks(matchingRules, procInfo)
 
 	return ua.fileRegistry.Register(path, pid, registerCB, unregisterCB, utils.IgnoreCB)
 }
@@ -751,15 +779,6 @@ func (ua *UprobeAttacher) getRulesForExecutable(path string, procInfo *ProcInfo)
 	return matchedRules
 }
 
-// getExecutablePath resolves the executable of the given PID looking in procfs.
-// Will return an error if the path cannot be resolved
-func (ua *UprobeAttacher) getExecutablePath(pid uint32) (string, error) {
-	pidAsStr := strconv.FormatUint(uint64(pid), 10)
-	exePath := filepath.Join(ua.config.ProcRoot, pidAsStr, "exe")
-
-	return os.Readlink(exePath)
-}
-
 const optionAttachToLibs = true
 
 // AttachPID attaches the corresponding probes to a given pid
@@ -781,28 +800,17 @@ func (ua *UprobeAttacher) AttachPIDWithOptions(pid uint32, attachToLibs bool) (e
 	}
 
 	procInfo := NewProcInfo(ua.config.ProcRoot, pid)
+	if err := ua.rejectInternalProcess(procInfo); err != nil {
+		return err
+	}
 
-	// Only compute the binary path if we are going to need it. It's better to do these two checks
-	// (which are cheap, the handlesExecutables function is cached) than to do the syscall
-	// every time
 	var binPath string
-	if ua.handlesExecutables() || (ua.config.ExcludeTargets&ExcludeInternal) != 0 {
-		binPath, err = procInfo.Exe()
+	if ua.handlesExecutables() {
+		binPath, err = resolveExecutable(procInfo)
 		if err != nil {
-			// procfs can return ESRCH if the process exits while the kernel is
-			// resolving /proc/<pid>/exe, even after path lookup has found it.
-			if !errors.Is(err, os.ErrNotExist) && !errors.Is(err, syscall.ESRCH) {
-				return utils.NewUnknownAttachmentError(err)
-			}
 			return err
 		}
-	}
 
-	if (ua.config.ExcludeTargets&ExcludeInternal) != 0 && internalProcessRegex.MatchString(binPath) {
-		return ErrInternalDDogProcessRejected
-	}
-
-	if ua.handlesExecutables() {
 		matchingRules := ua.getRulesForExecutable(binPath, procInfo)
 		if len(matchingRules) != 0 {
 			registerCB, unregisterCB := ua.buildRegisterCallbacks(matchingRules, procInfo)

pkg/ebpf/uprobes/attacher_test.go

@@ -51,6 +51,91 @@ func TestInternalProcessesRegex(t *testing.T) {
 	require.True(t, internalProcessRegex.MatchString("datadog-agent/bin/process-agent"))
 	require.True(t, internalProcessRegex.MatchString("datadog-agent/bin/security-agent"))
 	require.True(t, internalProcessRegex.MatchString("datadog-agent/bin/otel-agent"))
+	require.True(t, internalProcessRegex.MatchString("/opt/datadog-agent/embedded/bin/host-profiler"))
+	require.False(t, internalProcessRegex.MatchString("/opt/customer/bin/host-profiler"))
+}
+
+func TestAttachLibraryHonorsExcludeInternal(t *testing.T) {
+	const (
+		pid     = uint32(1)
+		libPath = "/usr/lib/libssl.so.3"
+	)
+
+	tests := []struct {
+		name               string
+		exe                string
+		excludeTargets     ExcludeMode
+		createProcess      bool
+		expectedError      error
+		expectRegistration bool
+	}{
+		{
+			name:           "host profiler is excluded",
+			exe:            "/opt/datadog-agent/embedded/bin/host-profiler",
+			excludeTargets: ExcludeInternal,
+			createProcess:  true,
+			expectedError:  ErrInternalDDogProcessRejected,
+		},
+		{
+			name:               "non-internal process is registered",
+			exe:                "/usr/bin/curl",
+			excludeTargets:     ExcludeInternal,
+			createProcess:      true,
+			expectRegistration: true,
+		},
+		{
+			name:               "internal exclusion is opt-in",
+			exe:                "/opt/datadog-agent/embedded/bin/host-profiler",
+			createProcess:      true,
+			expectRegistration: true,
+		},
+		{
+			name:           "process no longer exists",
+			excludeTargets: ExcludeInternal,
+			expectedError:  os.ErrNotExist,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var entries []kernel.FakeProcFSEntry
+			if tt.createProcess {
+				entries = append(entries, kernel.FakeProcFSEntry{Pid: pid, Cmdline: tt.exe, Command: tt.exe, Exe: tt.exe})
+			}
+			procRoot := kernel.CreateFakeProcFS(t, entries)
+
+			config := AttacherConfig{
+				ProcRoot:       procRoot,
+				ExcludeTargets: tt.excludeTargets,
+				Rules: []*AttachRule{
+					{
+						Targets:          AttachToSharedLibraries,
+						LibraryNameRegex: regexp.MustCompile(`libssl\.so`),
+					},
+				},
+				SharedLibsLibsets: []sharedlibraries.Libset{sharedlibraries.LibsetCrypto},
+			}
+			ua, err := NewUprobeAttacher(testModuleName, testAttacherName, config, &MockManager{}, nil, AttacherDependencies{ProcessMonitor: newMockProcessMonitor()})
+			require.NoError(t, err)
+
+			registry := &MockFileRegistry{}
+			if tt.expectRegistration {
+				registry.On("Register", libPath, pid, mock.Anything, mock.Anything).Return(nil).Once()
+			}
+			ua.fileRegistry = registry
+
+			err = ua.AttachLibrary(libPath, pid)
+			if tt.expectedError == nil {
+				require.NoError(t, err)
+			} else {
+				require.ErrorIs(t, err, tt.expectedError)
+			}
+			registry.AssertExpectations(t)
+			if !tt.expectRegistration {
+				registry.AssertNotCalled(t, "Register", mock.Anything, mock.Anything, mock.Anything, mock.Anything)
+			}
+		})
+	}
 }
 
 func TestAttachPidReturnsCorrectErrors(t *testing.T) {
@@ -413,25 +498,6 @@ func TestAttachToBinaryContainerdTmpReturnsErrEnvironment(t *testing.T) {
 	require.ErrorIs(t, err, utils.ErrEnvironment)
 }
 
-func TestGetExecutablePath(t *testing.T) {
-	exe := "/bin/bash"
-	procRoot := kernel.CreateFakeProcFS(t, []kernel.FakeProcFSEntry{{Pid: 1, Cmdline: "", Command: exe, Exe: exe}})
-	config := AttacherConfig{
-		ProcRoot: procRoot,
-	}
-	ua, err := NewUprobeAttacher(testModuleName, testAttacherName, config, &MockManager{}, nil, AttacherDependencies{ProcessMonitor: newMockProcessMonitor()})
-	require.NoError(t, err)
-	require.NotNil(t, ua)
-
-	path, err := ua.getExecutablePath(1)
-	require.NoError(t, err, "failed to get executable path for existing PID")
-	require.Equal(t, path, exe)
-
-	path, err = ua.getExecutablePath(404)
-	require.Error(t, err, "should fail to get executable path for non-existing PID")
-	require.Empty(t, path, "should return empty path for non-existing PID")
-}
-
 const mapsFileSample = `
 08048000-08049000 r-xp 00000000 03:00 8312       /opt/test
 08049000-0804a000 rw-p 00001000 03:00 8312       /opt/test