tracee: tracee-ebpf: mount event missing source field
Hi, I’m using tracee-ebpf to collect mount events. However, the “source” field misses sometimes.
Here is an example (you can start a docker container a few times and see this scenario):
Also, you can notice that the “filesystem type” is also missing sometimes. The example shows that LTTng gives mount type “bind”, while tracee gives nothing.
{
"processName":"runc:2:INIT]",
"containerId":"2af0bc626525",
"eventId":"165",
"eventName":"mount",
"argsNum":3,
"returnValue":0,
"args":[{
"name":"target",
"type":"const char*",
"value":"/var/lib/docker/overlay2/6fd16b36923947538d76e6b781d08f08d64ac69f513e7b24a889fa4337a948e0/merged/etc/resolv.conf"
},{
"name":"mountflags",
"type":"unsigned long",
"value":278528
},{
"name":"data",
"type":"const void*",
"value":0}
]}
As a comparison, LTTng will output this event as:
{
"pid_ns":4026532645,
"vtid":1,
"event":"mount",
"comm":"runc:[2:INIT]",
"args":[{
"Name":"dev_name",
"Value":"/sys/fs/cgroup/devices/docker/2af0bc6265257c960d559b38134bf212b3292f226c586dd9295b42faa2945df7"
},{
"Name":"dir_name",
"Value":"/var/lib/docker/overlay2/6fd16b36923947538d76e6b781d08f08d64ac69f513e7b24a889fa4337a948e0/merged/etc/resolv.conf"
},{
"Name":"type","Value":"bind"
},{
"Name":"flags","Value":"278528"
}],
"tid":220199
}
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Comments: 19 (9 by maintainers)
docker initialization with bind mount for a single file:
$ docker run --rm -v /etc/resolv.conf:/etc/resolv.conf.host --privileged --entrypoint /bin/sh -it ubuntu:hirsutetracee (49 events)
$ sudo ./dist/tracee-ebpf --trace event=security_sb_mountlttng (49 events)
For my reproducer I can count the exact same amount of missing “dev_name” mount calls.
continuing on your buggy example:
example on how the correct operation works:
as you can see, “none” here is added by the “util-linux” package, orelse it could be empty also (like docker does).
Conclusion:
IMO, the “dev_name” being showed when executing shared subtree operation, when dev_name is “none” or empty, is likely a leftover from a previous triggered probe within LTTNG.
A couple observations while looking into this:
[1] For example:
278528=MS_REC|MS_SLAVE, according to the man page for mount, changing the propagation type of an existing mount means the source, fstype and data arguments are ignored.@yanivagman the
security_sb_mountgives 4 args, but there are empty strings:The corresponding LTTng output:
@rafaeldtinoco Here is the content of
./dist:And if I run without assigning
TRACEE_BPF_FILE, the output is like:so it’s not CO-RE.
I started the docker again with
TRACEE_BPF_FILEenv provided, the scenario was reproduced again. Sometimes the mount has 4 args, sometimes just 3.