[EDIT] --trace set=32bit_unique error: operation not permitted

[andrea-tomassi]

Hi,

I need some help to better understand if I miss something:

I'm running the Docker image:

docker image
    aquasec/tracee:latest \

We use docker with containerd.

I tryed with various commands and filtering options, all of them seems to works properly, but this one:

trace --trace set=32bit_unique --output json

error initializing Tracee: failed to initialize tail call: failed to update map sys_enter_init_tail: operation not permitted

This is the complete log with -- debug flag:

OSInfo: ID: ubuntu
OSInfo: ID_LIKE: debian
OSInfo: PRETTY_NAME: "Ubuntu 20.04.4 LTS"
OSInfo: VERSION_ID: "20.04"
OSInfo: VERSION_CODENAME: focal
OSInfo: KERNEL_RELEASE: 5.15.0-46-generic
OSInfo: ARCH: x86_64
OSInfo: VERSION: "20.04.4 LTS (Focal Fossa)"
RuntimeSockets: failed to register default crio socket:
failed to register runtime socket stat /var/run/crio/crio.sock: no such file or directory
RuntimeSockets: failed to register default podman socket:
failed to register runtime socket stat /var/run/podman/podman.sock: no such file or directory
OSInfo: Security Lockdown is ''
BTF: bpfenv = false, btfenv = false, vmlinux = true
BPF: using embedded BPF object
unpacked CO:RE bpf object file into memory
TIME             UID    COMM             PID     TID     RET              EVENT                ARGS
Enricher: error registering enricher: unsupported runtime crio

End of events stream
Stats: {EventCount:0 NetEvCount:0 ErrorCount:0 LostEvCount:0 LostWrCount:0 LostNtCount:0}
2022/09/28 10:54:34 error initializing Tracee: failed to initialize tail call: failed to update map sys_enter_init_tail: operation not permitted

EDIT

actually after more investigation I've found the problem is the subset "32bit_unique" set

At this point I tryied:

trace --debug --trace set=syscalls --trace set!=32bit_unique

but this not seems to be the right way to filter down sets.

Any idea?

[NDStrahilevitz]

Hi, first of all thanks for reporting this!
Seems to be related to recent changes we've done in sys_enter/exit eBPF logic.
@rafaeldtinoco @yanivagman I've opened an issue about it here #2202