Skip to content

Comments

[8.19](backport #45950) Fix file_integrity kprobe filters, use BTF values where possible#46065

Open
mergify[bot] wants to merge 6 commits into8.19from
mergify/bp/8.19/pr-45950
Open

[8.19](backport #45950) Fix file_integrity kprobe filters, use BTF values where possible#46065
mergify[bot] wants to merge 6 commits into8.19from
mergify/bp/8.19/pr-45950

Conversation

@mergify
Copy link
Contributor

@mergify mergify bot commented Aug 18, 2025

Proposed commit message

See #45897
This fixes a bug in recent kernels where a change to the fsnotify_data_type enum broke the kprobe filters, which were hard-coding the enum values. This changes the kprobe setup so we use the BTF values for the fsnotify_data_type enum where possible, and only fall back to hard-coding the data type values on older kernels.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Related issues

This is an automatic backport of pull request #45950 done by [Mergify](https://mergify.com).

@fearful-symmetry @mergify
Fix file_integrity kprobe filters, use BTF values where possible (#45950
ff0246b 
)

* fix FIM kprobe filters

* linter

* add extra checks to BTF logic, clarify docs

* clean up loop

(cherry picked from commit 9773649)

# Conflicts:
#	NOTICE.txt
#	go.mod
#	go.sum
@mergify mergify bot added backport conflicts There is a conflict in the backported pull request labels Aug 18, 2025
@mergify mergify bot requested review from a team as code owners August 18, 2025 17:01
@mergify mergify bot added backport conflicts There is a conflict in the backported pull request labels Aug 18, 2025
@mergify
Copy link
Contributor Author

mergify bot commented Aug 18, 2025

Cherry-pick of 9773649 has failed:

On branch mergify/bp/8.19/pr-45950
Your branch is up to date with 'origin/8.19'.

You are currently cherry-picking commit 97736493a.
  (fix conflicts and run "git cherry-pick --continue")
  (use "git cherry-pick --skip" to skip this patch)
  (use "git cherry-pick --abort" to cancel the cherry-pick operation)

Changes to be committed:
	modified:   auditbeat/module/file_integrity/kprobes/monitor_test.go
	modified:   auditbeat/module/file_integrity/kprobes/probes_fsnotify.go
	modified:   auditbeat/module/file_integrity/kprobes/probes_fsnotify_test.go

Unmerged paths:
  (use "git add <file>..." to mark resolution)
	both modified:   NOTICE.txt
	both modified:   go.mod
	both modified:   go.sum

To fix up this pull request, you can check it out locally. See documentation: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/checking-out-pull-requests-locally

@botelastic botelastic bot added the needs_team Indicates that the issue/PR needs a Team:* label label Aug 18, 2025
@github-actions github-actions bot added :integrations Team:Security-Linux Platform Linux Platform Team in Security Solution labels Aug 18, 2025
@botelastic botelastic bot removed the needs_team Indicates that the issue/PR needs a Team:* label label Aug 18, 2025
@elasticmachine
Copy link
Contributor

elasticmachine commented Aug 18, 2025

Pinging @elastic/sec-linux-platform (Team:Security-Linux Platform)

@mergify
Copy link
Contributor Author

mergify bot commented Aug 25, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

7 similar comments
@mergify
Copy link
Contributor Author

mergify bot commented Sep 1, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Sep 8, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Sep 15, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Sep 22, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Sep 29, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Oct 6, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Oct 13, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@pierrehilbert
Copy link
Contributor

pierrehilbert commented Oct 13, 2025

@fearful-symmetry could you please resolve the conflicts?

@mergify
Copy link
Contributor Author

mergify bot commented Oct 20, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

4 similar comments
@mergify
Copy link
Contributor Author

mergify bot commented Oct 27, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Nov 3, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Nov 10, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Nov 17, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Nov 17, 2025

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b mergify/bp/8.19/pr-45950 upstream/mergify/bp/8.19/pr-45950
git merge upstream/8.19
git push upstream mergify/bp/8.19/pr-45950

@mergify
Copy link
Contributor Author

mergify bot commented Nov 24, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@jlind23
Copy link
Contributor

jlind23 commented Nov 24, 2025

@nfritts @fearful-symmetry could you please make sure this is reviewed / fixed?

@mergify
Copy link
Contributor Author

mergify bot commented Dec 1, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

1 similar comment
@mergify
Copy link
Contributor Author

mergify bot commented Dec 8, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@pierrehilbert
Copy link
Contributor

pierrehilbert commented Dec 8, 2025

@nfritts / @fearful-symmetry FF is tomorrow so if we want this in the next 8.19 release, we should take care of merging that one soon.

@mergify
Copy link
Contributor Author

mergify bot commented Dec 15, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

9 similar comments
@mergify
Copy link
Contributor Author

mergify bot commented Dec 22, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Dec 29, 2025

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Jan 5, 2026

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Jan 12, 2026

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Jan 19, 2026

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Jan 26, 2026

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Feb 2, 2026

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Feb 9, 2026

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@mergify
Copy link
Contributor Author

mergify bot commented Feb 16, 2026

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

@fearful-symmetry
Copy link
Contributor

fearful-symmetry commented Feb 19, 2026

Sorry about that, looks like it got lost during the holidays

@mergify
Copy link
Contributor Author

mergify bot commented Feb 23, 2026

This pull request has not been merged yet. Could you please review and merge it @fearful-symmetry? 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

@fearful-symmetry fearful-symmetry

Labels

backport conflicts There is a conflict in the backported pull request :integrations Team:Security-Linux Platform Linux Platform Team in Security Solution

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@elasticmachine @pierrehilbert @jlind23 @fearful-symmetry