tetragon: Add cgrouprate support for exit

Signed-off-by: Jiri Olsa <[email protected]>
cilium · Mar 25, 2024 · 401f4c5 · 401f4c5
1 parent e36b57f
commit 401f4c5
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 2 deletions.
diff --git a/bpf/process/bpf_exit.h b/bpf/process/bpf_exit.h
@@ -9,6 +9,9 @@
 
 #include "bpf_event.h"
 #include "bpf_task.h"
+#include "bpf_rate.h"
+#include "process.h"
+#include "bpf_process_event.h"
 
 struct {
 	__uint(type, BPF_MAP_TYPE_PERCPU_ARRAY);
@@ -36,6 +39,7 @@ static inline __attribute__((always_inline)) void event_exit_send(void *ctx, __u
 		struct task_struct *task = (struct task_struct *)get_current_task();
 		size_t size = sizeof(struct msg_exit);
 		struct msg_exit *exit;
+		struct msg_k8s kube;
 		int zero = 0;
 
 		exit = map_lookup_elem(&exit_heap_map, &zero);
@@ -66,7 +70,12 @@ static inline __attribute__((always_inline)) void event_exit_send(void *ctx, __u
 		probe_read(&exit->info.code, sizeof(exit->info.code),
 			   _(&task->exit_code));
 
-		perf_event_output_metric(ctx, MSG_OP_EXIT, &tcpmon_map, BPF_F_CURRENT_CPU, exit, size);
+		__event_get_cgroup_info(task, &kube);
+
+		if (cgroup_rate(kube.cgrpid, exit->common.ktime)) {
+			perf_event_output_metric(ctx, MSG_OP_EXIT, &tcpmon_map,
+						 BPF_F_CURRENT_CPU, exit, size);
+		}
 	}
 	execve_map_delete(tgid);
 }

diff --git a/pkg/testutils/sensors/load.go b/pkg/testutils/sensors/load.go
@@ -147,7 +147,7 @@ func mergeInBaseSensorMaps(t *testing.T, sensorMaps []SensorMap, sensorProgs []S
 		SensorMap{Name: "execve_map_stats", Progs: []uint{1, 2}},
 
 		// event_execve
-		SensorMap{Name: "tg_conf_map", Progs: []uint{0, 2}},
+		SensorMap{Name: "tg_conf_map", Progs: []uint{0, 1, 2}},
 
 		// event_wake_up_new_task
 		SensorMap{Name: "execve_val", Progs: []uint{2}},