tetragon: Setup execve_map max entries #3279
Conversation
olsajiri
added
the
release-note/minor
olsajiri
force-pushed
the
pr/olsajiri/harden
branch
3 times, most recently
from
7b664dd to
ab3513b
Compare
pkg/sensors/base/base.go
Outdated
| threads := readFileDefault("/proc/sys/kernel/threads-max", 32768) | ||
| ExecveMap.SetMaxEntries(int(threads)) |
There was a problem hiding this comment.
Why do we need this? It seems it will make the size of the execve_map even larger as threads-max is often well above 32K. This will take significant space while running threads-max threads is pretty rare nop?
There was a problem hiding this comment.
I tried this as mitigation for https://github.com/isovalent/security/issues/88 .. I think we need some combination of this change (with some reasonable size for execve_map) and other ways mentioned in the issue
There was a problem hiding this comment.
ah I see, maybe this is one of the cases where NO_PREALLOC could help so that we can dynamically size to a very large map. But I could see how this can lead to memory issues in the future. That's not an easy problem :/
olsajiri
force-pushed
the
pr/olsajiri/harden
branch
from
ab3513b to
c64e7e4
Compare
Signed-off-by: Jiri Olsa <[email protected]>
Move '!enter' early in the function which will help following changes to be more readable. There's no functional change. Signed-off-by: Jiri Olsa <[email protected]>
Passing execve_map_value directly to match_binaries to eliminate superfluous event_find_curr in it. Signed-off-by: Jiri Olsa <[email protected]>
Signed-off-by: Jiri Olsa <[email protected]>
Moving SizeWithSuffix to strutils package, so we can use it from other places. Signed-off-by: Jiri Olsa <[email protected]>
Signed-off-by: Jiri Olsa <[email protected]>
Signed-off-by: Jiri Olsa <[email protected]>
olsajiri
force-pushed
the
pr/olsajiri/harden
branch
from
c64e7e4 to
fcfa0a9
Compare
✅ Deploy Preview for tetragon ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
| @@ -416,4 +419,6 @@ func AddFlags(flags *pflag.FlagSet) { | |||
| flags.Int(KeyEventCacheRetryDelay, defaults.DefaultEventCacheRetryDelay, "Delay in seconds between event cache retries") | |||
|
|
|||
| flags.Bool(KeyCompatibilitySyscall64SizeType, false, "syscall64 type will produce output of type size (compatibility flag, will be removed in v1.4)") | |||
|
|
|||
| flags.String(KeyExecveMapEntries, "", "Set entries for execve_map table (default 32768)") | |||
There was a problem hiding this comment.
Can we have the default from the actual default value here? If we ever change it, the change should be reflected in help.
No description provided.