Skip to content

Commit 7969638

Browse files
puwunmtardy
authored andcommitted
docs: document socket tracking limitations
Add documentation for socket tracking limitations as requested in issue #3493. The new 'Limitations' section covers: - LRU map overflow risks: Socket mappings use a fixed-size LRU hash that can evict old entries when full, potentially causing events to be attributed to the wrong process. - Socket sharing behavior: Sockets can be shared between processes via fork() or IPC, and Tetragon attributes activity to the creating process which may lead to stale mappings. Fixes: #3493 Signed-off-by: Pavan More <[email protected]>
1 parent 0216d27 commit 7969638

File tree

1 file changed

+24
-1
lines changed
  • docs/content/en/docs/concepts/tracing-policy

1 file changed

+24
-1
lines changed

docs/content/en/docs/concepts/tracing-policy/hooks.md

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -769,7 +769,30 @@ See [`TrackSock`](/docs/concepts/tracing-policy/selectors/#tracksock-action) and
769769
returnArgAction: TrackSock
770770
```
771771

772-
Socket tracking is only available on kernels >=5.3.
772+
#### Limitations
773+
774+
Socket tracking has the following limitations:
775+
776+
- Kernel version: socket tracking is only available on kernels >=5.3.
777+
778+
- LRU map overflow: socket mappings are stored in an LRU (Least Recently Used)
779+
hash map in the kernel with a fixed upper limit for entries. When the map is
780+
full, old entries are evicted to make space for new ones. If many sockets are
781+
created in a short period, older socket mappings may be lost and network
782+
events may be attributed to the wrong process.
783+
784+
- Socket sharing between processes: sockets are not strictly owned by a single
785+
process—they can be shared via `fork()` (when both parent and child keep the
786+
file descriptor open) or via IPC file descriptor passing. Tetragon attributes
787+
all socket activity to the process that originally created the socket. If that
788+
process exits while another continues using the socket, the mapping references
789+
a process that no longer exists.
790+
791+
{{< warning >}}
792+
The LRU map overflow and socket sharing limitations have security implications.
793+
An adversary could overflow the map to evade attribution, or exploit socket
794+
sharing to obscure the true source of network activity.
795+
{{< /warning >}}
773796

774797

775798
## Lists

0 commit comments

Comments
 (0)