[procmgr] Show profile and user in list and describe - #53568
[procmgr] Show profile and user in list and describe#53568jose-manuel-almaza wants to merge 35 commits into
Conversation
jose-manuel-almaza
added
the
qa/done
jose-manuel-almaza
changed the title
jose-manuel-almaza
changed the title
|
🎯 Code Coverage (details) 🔗 Commit SHA: f72fd4e | Docs | Datadog PR Page | Give us feedback! |
Files inventory check summaryFile checks results against ancestor 92f6b05c: Results for datadog-agent_7.84.0~devel.git.339.b199222.pipeline.131292680-1_amd64.deb:No change detected Results for datadog-iot-agent_7.84.0~devel.git.339.b199222.pipeline.131292680-1_amd64.deb:No change detected |
Static quality checks✅ Please find below the results from static quality gates Successful checksInfo
15 successful checks with minimal change (< 2 KiB)
|
Regression DetectorRegression Detector ResultsMetrics dashboard Baseline: 92f6b05 Optimization Goals: ✅ No significant changes detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | quality_gate_metrics_logs | memory utilization | +1.38 | [+1.13, +1.63] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle | memory utilization | +0.09 | [-0.02, +0.21] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_no_fs_load | memory utilization | -0.02 | [-0.16, +0.12] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_private_action_runner | memory utilization | -0.09 | [-0.21, +0.03] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_idle_all_features | memory utilization | -0.11 | [-0.16, -0.07] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_idle | memory utilization | -0.20 | [-0.30, -0.09] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_security_mean_fs_load | memory utilization | -0.26 | [-0.33, -0.19] | 1 | Logs bounds checks dashboard |
| ➖ | quality_gate_logs | % cpu utilization | -2.41 | [-3.26, -1.56] | 1 | Logs bounds checks dashboard |
Bounds Checks: ✅ Passed
| perf | experiment | bounds_check_name | replicates_passed | observed_value | links |
|---|---|---|---|---|---|
| ✅ | quality_gate_idle | intake_connections | 10/10 | 4 = 4 | bounds checks dashboard |
| ✅ | quality_gate_idle | memory_usage | 10/10 | 174.41MiB ≤ 178MiB | bounds checks dashboard |
| ✅ | quality_gate_idle | total_bytes_received | 10/10 | 741.99KiB ≤ 819.20KiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | intake_connections | 10/10 | 4 = 4 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | memory_usage | 10/10 | 532.36MiB ≤ 538MiB | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | total_bytes_received | 10/10 | 1.13MiB ≤ 1.25MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | intake_connections | 10/10 | 17 ≤ 40 | bounds checks dashboard |
| ✅ | quality_gate_logs | memory_usage | 10/10 | 203.78MiB ≤ 229MiB | bounds checks dashboard |
| ✅ | quality_gate_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_logs | total_bytes_received | 10/10 | 263.82MiB ≤ 292MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | cpu_usage | 10/10 | 361.23 ≤ 2000 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | intake_connections | 10/10 | 18 ≤ 40 | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | memory_usage | 10/10 | 396.10MiB ≤ 439MiB | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | missed_bytes | 10/10 | 0B = 0B | bounds checks dashboard |
| ✅ | quality_gate_metrics_logs | total_bytes_received | 10/10 | 0.94GiB ≤ 1.04GiB | bounds checks dashboard |
| ✅ | quality_gate_private_action_runner | memory_usage | 10/10 | 72.13MiB ≤ 76MiB | bounds checks dashboard |
| ✅ | quality_gate_security_idle | cpu_usage | 10/10 | 26.73 ≤ 100 | bounds checks dashboard |
| ✅ | quality_gate_security_idle | memory_usage | 10/10 | 323.50MiB ≤ 335MiB | bounds checks dashboard |
| ✅ | quality_gate_security_mean_fs_load | cpu_usage | 10/10 | 61.07 ≤ 200 | bounds checks dashboard |
| ✅ | quality_gate_security_mean_fs_load | memory_usage | 10/10 | 301.64MiB ≤ 314MiB | bounds checks dashboard |
| ✅ | quality_gate_security_no_fs_load | cpu_usage | 10/10 | 20.27 ≤ 100 | bounds checks dashboard |
| ✅ | quality_gate_security_no_fs_load | memory_usage | 10/10 | 309.72MiB ≤ 343MiB | bounds checks dashboard |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
CI Pass/Fail Decision
✅ Passed. All Quality Gates passed.
- quality_gate_private_action_runner, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_security_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_idle, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_security_mean_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_mean_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check missed_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check total_bytes_received: 10/10 replicas passed. Gate passed.
- quality_gate_metrics_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_security_no_fs_load, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_security_no_fs_load, bounds check cpu_usage: 10/10 replicas passed. Gate passed.
62de8ac to
ecaae11
Compare
|
@codex review |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ecaae11608
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
b86fae9 to
97ec53f
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 97ec53f84d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
7201101 to
db797bd
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 612d3b6af8
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 320eb43e6a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
74a98e3 to
e76680b
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 74a98e3902
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Use geteuid instead of getuid so list/describe User matches the account Unix children inherit when real and effective UIDs differ.
LookupAccountSidW returns the computer name as the domain for local SAM accounts, while intended user display uses an empty domain (.\user). Clear the domain when the SID is local so describe does not report a false intended-vs-runtime mismatch.
LookupAccountSidW returns LOCAL SERVICE and NETWORK SERVICE for built-in service SIDs while intended user display uses LocalService and NetworkService. Map well-known SIDs to the same canonical AccountName as spawn/registry output so describe does not report false mismatches.
/proc/<pid>/status lists real and effective UIDs separately. Runtime User should reflect the effective identity, especially for setuid children where real and effective differ. Align e2e expectations with geteuid().
Skip the normalization test for domain logons and use COMPUTERNAME instead of USERDOMAIN so Windows CI containers match LookupAccountSidW behavior.
Use the built-in Administrator account for local SAM display normalization so domain-joined runners do not skip or mis-lookup USERNAME, and give the Bazel target a large timeout for Windows ping-based sleeps.
Move size = "large" after name so bazel run //:gazelle -mode=diff passes in CI.
Bare spawn:: paths fail to compile on Linux CI because spawn is a private sibling module; use crate::spawn imports like the rest of the crate.
Use 5s ping-based sleep helpers and a 2s stop timeout so parallel lib tests finish quickly when ping ignores CTRL_BREAK. Skip Administrator lookup test when the built-in account is unavailable on CI hosts.
Apply rustfmt to reload test helpers and stop asserting PID changes after config reload, since Windows can reuse PIDs right after TerminateProcess. Make mark_stopped idempotent to avoid debug panics on duplicate stop paths.
…rd_test Restore 60s ping sleeps and default stop timeout in lib tests. The 2s stop timeout and 5s sleeps caused flaky reload races on Windows CI under parallel test execution.
Resolve built-in Administrator via the local SAM (.\Administrator) instead of COMPUTERNAME\Administrator, which can block on domain-joined CI hosts.
Use lookup_account_name on a local Administrator SID instead of injecting COMPUTERNAME as a fake domain, and skip when the account is not local SAM.
Apply rustfmt so Bazel rustfmt_checks pass in CI.
Derive expected Runtime User from runtime_user_for_pid on the described PID instead of USERDOMAIN/USERNAME so local SAM normalization matches describe output on Windows.
Clear the domain for local SAM PasswordLogon and ServiceAccountLogon accounts when building list/describe User output so it matches runtime user display when the MSI stored the machine name as installedDomain.
Describe output for agent-profile children should show the same local SAM account in User and Runtime User when the MSI stored the machine name as installedDomain.
Move refresh_intended_user ahead of platform spawn so a slow account lookup cannot hold the manager lock while a new child is still unwatched.
Move writeProcessesDYamlContent and process-owner helpers here where the agent-profile E2E tests use them, after dropping them from spawn-profiles.
Add procmgr_win_helpers_test.go and the testing/components dep so bazel run //:gazelle -mode=diff passes in CI.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6b60435183
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Document the new profile, user, and runtime user fields in dd-procmgr list and describe output for operators.
Base psRemote/path helpers stay in procmgr_win_test.go per the spawn-profiles stack split; procmgr_win_helpers_test.go keeps only agent-profile helpers.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 13a7db67a6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
The one-shot PowerShell child writes USERPROFILE and exits immediately, so polling describe for Running is flaky on fast hosts. Assert the marker file directly, which is what validates agent-profile USERPROFILE.
|
@codex review |
|
Codex Review: Didn't find any major issues. Keep them coming! Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
8 participants
What does this PR do?
Expose spawn identity in the process manager API and
dd-procmgrCLI:list: addsprofileandusercolumns (table + JSON)describe: addsProfile,User, andRuntime User(only when the process is running and lookup succeeds)Proto changes:
Process:profile,userProcessDetail:profile,user,runtime_userImplementation notes:
profileis derived from the process name (agent/privileged)useris the intended / last-spawn account, stored onManagedProcessand refreshed on spawnruntime_useris resolved from the OS at describe time (Windows token owner / Linux/proc+getpwuid)AccountNameMotivation
After Windows spawn profiles land, operators need a simple way to see how each managed child is spawned without reading code or registry state. Showing
profileanduserinlist/describemakes SCM migration behavior visible (e.g. process-agent asprivileged/NT AUTHORITY\SYSTEMvs other children asagent/ installer user).runtime_userindescribehelps debug cases where the running PID differs from the intended spawn account.Describe how you validated your changes
cargo test --lib --bin dd-procmgr(procmgr Rust unit tests)dda inv test --targets=./pkg/procmgr/coat/...profile/user/runtime_useroutputAdditional Notes
userreflects spawn policy (intended or last used), not a live registry re-read on every queryruntime_useris omitted fromlistand fromdescribewhen PID is unset or lookup fails (debug log only)