tetragon: resolve uid to username for exec events from /proc fs

pkg/metrics/errormetrics/errormetrics.go

@@ -28,16 +28,23 @@ const (
 	HandlerError
 	// An event finalizer on Process failed
 	EventFinalizeProcessInfoFailed
+	// Failed to resolve Process uid to username
+	ProcessMetadataUsernameFailed
+	// The username resolution was skipped since the process is not in host
+	// namespaces.
+	ProcessMetadataUsernameIgnoredNotInHost
 )
 
 var errorTypeLabelValues = map[ErrorType]string{
-	ProcessCacheMissOnGet:          "process_cache_miss_on_get",
-	ProcessCacheEvicted:            "process_cache_evicted",
-	ProcessCacheMissOnRemove:       "process_cache_miss_on_remove",
-	ProcessPidTidMismatch:          "process_pid_tid_mismatch",
-	EventMissingProcessInfo:        "event_missing_process_info",
-	HandlerError:                   "handler_error",
-	EventFinalizeProcessInfoFailed: "event_finalize_process_info_failed",
+	ProcessCacheMissOnGet:                   "process_cache_miss_on_get",
+	ProcessCacheEvicted:                     "process_cache_evicted",
+	ProcessCacheMissOnRemove:                "process_cache_miss_on_remove",
+	ProcessPidTidMismatch:                   "process_pid_tid_mismatch",
+	EventMissingProcessInfo:                 "event_missing_process_info",
+	HandlerError:                            "handler_error",
+	EventFinalizeProcessInfoFailed:          "event_finalize_process_info_failed",
+	ProcessMetadataUsernameFailed:           "process_metadata_username_failed",
+	ProcessMetadataUsernameIgnoredNotInHost: "process_metadata_username_ignored_not_in_host_namespaces",
 }
 
 func (e ErrorType) String() string {

pkg/reader/namespace/namespace.go

@@ -157,6 +157,19 @@ func GetCurrentNamespace() *tetragon.Namespaces {
 	return retVal
 }
 
+func IsMsgNsInHostMntUser(ns *processapi.MsgNamespaces) (bool, error) {
+	hostNs, err := InitHostNamespace()
+	if err != nil {
+		return false, err
+	}
+
+	if ns.MntInum == hostNs.Mnt.Inum && ns.UserInum == hostNs.User.Inum {
+		return true, nil
+	}
+
+	return false, nil
+}
+
 func GetMsgNamespaces(ns processapi.MsgNamespaces) (*tetragon.Namespaces, error) {
 	hostNs, err := InitHostNamespace()
 	if err != nil {

pkg/sensors/exec/exec.go

@@ -18,12 +18,10 @@ import (
 	exec "github.com/cilium/tetragon/pkg/grpc/exec"
 	"github.com/cilium/tetragon/pkg/logger"
 	"github.com/cilium/tetragon/pkg/observer"
-	"github.com/cilium/tetragon/pkg/option"
 	"github.com/cilium/tetragon/pkg/process"
-	"github.com/cilium/tetragon/pkg/reader/namespace"
-	"github.com/cilium/tetragon/pkg/reader/userdb"
 	"github.com/cilium/tetragon/pkg/sensors"
 	"github.com/cilium/tetragon/pkg/sensors/exec/procevents"
+	"github.com/cilium/tetragon/pkg/sensors/exec/userinfo"
 	"github.com/cilium/tetragon/pkg/sensors/program"
 	"github.com/cilium/tetragon/pkg/strutils"
 	"github.com/sirupsen/logrus"
@@ -72,18 +70,6 @@ func msgToExecveKubeUnix(m *processapi.MsgExecveEvent, exec_id string, filename
 	return kube
 }
 
-func msgToExecveAccountUnix(m *exec.MsgExecveEventUnix) {
-	if option.Config.UsernameMetadata == int(option.USERNAME_METADATA_UNIX) {
-		if ns, err := namespace.GetMsgNamespaces(m.Unix.Msg.Namespaces); err == nil {
-			if ns.Mnt.IsHost && ns.User.IsHost {
-				if username, err := userdb.UsersCache.LookupUser(m.Unix.Process.UID); err == nil {
-					m.Unix.Process.User.Name = username
-				}
-			}
-		}
-	}
-}
-
 func execParse(reader *bytes.Reader) (processapi.MsgProcess, bool, error) {
 	proc := processapi.MsgProcess{}
 	exec := processapi.MsgExec{}
@@ -203,7 +189,14 @@ func handleExecve(r *bytes.Reader) ([]observer.Event, error) {
 		msgUnix.Unix.Process = nopMsgProcess()
 	}
 	if err == nil && !empty {
-		msgToExecveAccountUnix(msgUnix)
+		err = userinfo.MsgToExecveAccountUnix(msgUnix)
+		if err != nil {
+			logger.GetLogger().WithFields(logrus.Fields{
+				"process.pid":    msgUnix.Unix.Process.PID,
+				"process.binary": msgUnix.Unix.Process.Filename,
+				"process.uid":    msgUnix.Unix.Process.UID,
+			}).WithError(err).Trace("Resolving process uid to username record failed")
+		}
 	}
 	msgUnix.Unix.Kube = msgToExecveKubeUnix(&m, process.GetExecID(&msgUnix.Unix.Process), msgUnix.Unix.Process.Filename)
 	return []observer.Event{msgUnix}, nil

pkg/sensors/exec/procevents/proc_reader.go

@@ -29,6 +29,8 @@ import (
 	"github.com/cilium/tetragon/pkg/sensors"
 	"github.com/cilium/tetragon/pkg/sensors/base"
 	"github.com/cilium/tetragon/pkg/sensors/exec/execvemap"
+	"github.com/cilium/tetragon/pkg/sensors/exec/userinfo"
+	"github.com/sirupsen/logrus"
 )
 
 const (
@@ -279,6 +281,15 @@ func pushExecveEvents(p procs) {
 		m.Unix.Process.Filename = filename
 		m.Unix.Process.Args = args
 
+		err := userinfo.MsgToExecveAccountUnix(&m)
+		if err != nil {
+			logger.GetLogger().WithFields(logrus.Fields{
+				"process.pid":    p.pid,
+				"process.binary": filename,
+				"process.uid":    m.Unix.Process.UID,
+			}).WithError(err).Trace("Resolving process uid to username record failed")
+		}
+
 		observer.AllListeners(&m)
 	}
 }

pkg/sensors/exec/userinfo/userinfo.go

@@ -0,0 +1,53 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Authors of Tetragon
+
+package userinfo
+
+import (
+	"errors"
+
+	"github.com/cilium/tetragon/pkg/api/processapi"
+	"github.com/cilium/tetragon/pkg/grpc/exec"
+	"github.com/cilium/tetragon/pkg/metrics/errormetrics"
+	"github.com/cilium/tetragon/pkg/option"
+	"github.com/cilium/tetragon/pkg/reader/namespace"
+	"github.com/cilium/tetragon/pkg/reader/userdb"
+)
+
+// Errors
+var (
+	ErrNotInHostNs = errors.New("process is not in host namespaces")
+)
+
+func getAccountUnix(uid uint32, ns *processapi.MsgNamespaces) (string, error) {
+	inHost, err := namespace.IsMsgNsInHostMntUser(ns)
+	if err != nil {
+		return "", err
+	}
+	if inHost {
+		username, err := userdb.UsersCache.LookupUser(uid)
+		if err != nil {
+			return "", err
+		}
+		return username, nil
+	}
+	return "", ErrNotInHostNs
+}
+
+func MsgToExecveAccountUnix(m *exec.MsgExecveEventUnix) error {
+	if option.Config.UsernameMetadata == int(option.USERNAME_METADATA_UNIX) {
+		username, err := getAccountUnix(m.Unix.Process.UID, &m.Unix.Msg.Namespaces)
+		if err == nil {
+			m.Unix.Process.User.Name = username
+			return nil
+		}
+
+		if errors.Is(err, ErrNotInHostNs) {
+			errormetrics.ErrorTotalInc(errormetrics.ProcessMetadataUsernameIgnoredNotInHost)
+		} else {
+			errormetrics.ErrorTotalInc(errormetrics.ProcessMetadataUsernameFailed)
+		}
+		return err
+	}
+	return nil
+}

pkg/sensors/exec/userinfo/userinfo_test.go

@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright Authors of Tetragon
+
+package userinfo
+
+import (
+	"testing"
+
+	"github.com/cilium/tetragon/pkg/api/processapi"
+	"github.com/cilium/tetragon/pkg/reader/namespace"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAccountUnix(t *testing.T) {
+	hostNs, err := namespace.InitHostNamespace()
+	require.NoError(t, err)
+
+	ns := processapi.MsgNamespaces{}
+	name, err := getAccountUnix(0, &ns)
+	require.Equal(t, ErrNotInHostNs, err)
+	require.Empty(t, name)
+
+	ns = processapi.MsgNamespaces{
+		UserInum: hostNs.User.Inum,
+		MntInum:  hostNs.Mnt.Inum,
+	}
+
+	name, err = getAccountUnix(0, &ns)
+	require.NoError(t, err)
+	require.Equal(t, name, "root")
+
+	ns.MntInum += 0x1000
+	name, err = getAccountUnix(1, &ns)
+	require.Equal(t, ErrNotInHostNs, err)
+	require.Empty(t, name)
+}