Filter out host processes by host mntns to prevent ebpf map from fill…

…ing up during recording

internal/pkg/daemon/bpfrecorder/bpf/recorder.bpf.c

@@ -7,6 +7,7 @@
 #define MAX_ENTRIES 8 * 1024
 #define MAX_SYSCALLS 1024
 #define MAX_COMM_LEN 64
+#define MAX_MNTNS_LEN 1
 
 char LICENSE[] SEC("license") = "Dual BSD/GPL";
 
@@ -24,6 +25,13 @@ struct {
     __type(value, char[MAX_COMM_LEN]);  // command name
 } comms SEC(".maps");
 
+struct {
+    __uint(type, BPF_MAP_TYPE_HASH);
+    __uint(max_entries, MAX_MNTNS_LEN);
+    __type(key, u32);                   // PID
+    __type(value, u64);                 // mntns ID
+} system_mntns SEC(".maps");
+
 struct {
     __uint(type, BPF_MAP_TYPE_RINGBUF);
     __uint(max_entries, 1 << 24);
@@ -50,6 +58,13 @@ int sys_enter(struct trace_event_raw_sys_enter * args)
     if (mntns == 0) {
         return 0;
     }
+    // Filter mntns by hostmntns to exclude host processes
+    u32 hostPid = 1;
+    u64 * host_mntns;
+    host_mntns = bpf_map_lookup_elem(&system_mntns, &hostPid);
+    if (host_mntns != NULL && *host_mntns == mntns) {
+        return 0;
+    }
 
     // Update the command name if required
     char comm[MAX_COMM_LEN];

internal/pkg/daemon/bpfrecorder/bpfrecorder.go

@@ -24,16 +24,6 @@ import (
 	"encoding/binary"
 	"errors"
 	"fmt"
-	"os"
-	"runtime"
-	"sort"
-	"strconv"
-	"strings"
-	"sync"
-	"sync/atomic"
-	"syscall"
-	"time"
-
 	bpf "github.com/aquasecurity/libbpfgo"
 	"github.com/blang/semver/v4"
 	"github.com/go-logr/logr"
@@ -44,6 +34,15 @@ import (
 	"google.golang.org/grpc/credentials/insecure"
 	"k8s.io/apimachinery/pkg/util/wait"
 	"k8s.io/client-go/kubernetes"
+	"os"
+	"runtime"
+	"sort"
+	"strconv"
+	"strings"
+	"sync"
+	"sync/atomic"
+	"syscall"
+	"time"
 
 	api "sigs.k8s.io/security-profiles-operator/api/grpc/bpfrecorder"
 	apimetrics "sigs.k8s.io/security-profiles-operator/api/grpc/metrics"
@@ -67,6 +66,7 @@ type BpfRecorder struct {
 	startRequests            int64
 	syscalls                 *bpf.BPFMap
 	comms                    *bpf.BPFMap
+	mntns                    *bpf.BPFMap
 	btfPath                  string
 	syscallNamesForIDCache   *ttlcache.Cache[string, string]
 	containerIDCache         *ttlcache.Cache[string, string]
@@ -423,6 +423,11 @@ func (b *BpfRecorder) load(startEventProcessor bool) (err error) {
 	if err != nil {
 		return fmt.Errorf("get comms map: %w", err)
 	}
+	b.logger.Info("Getting system_mntns map")
+	mntns, err := b.GetMap(module, "system_mntns")
+	if err != nil {
+		return fmt.Errorf("get mntns_map: %w", err)
+	}
 
 	events := make(chan []byte)
 	ringbuffer, err := b.InitRingBuf(module, "events", events)
@@ -433,6 +438,11 @@ func (b *BpfRecorder) load(startEventProcessor bool) (err error) {
 
 	b.syscalls = syscalls
 	b.comms = comms
+	b.mntns = mntns
+
+	// Update mntns to system_mntns
+	b.updateSystemMntns()
+
 	if startEventProcessor {
 		go b.processEvents(events)
 	}
@@ -564,6 +574,16 @@ func (b *BpfRecorder) processEvents(events chan []byte) {
 	}
 }
 
+func (b *BpfRecorder) updateSystemMntns() {
+	mntnsByte := make([]byte, 8)
+	binary.LittleEndian.PutUint64(mntnsByte, b.systemMountNamespace)
+	var hostPid uint32 = 1
+	err := b.UpdateValue(b.mntns, hostPid, mntnsByte)
+	if err != nil {
+		b.logger.Error(err, "update system_mntns map failed")
+	}
+}
+
 func (b *BpfRecorder) handleEvent(event []byte) {
 	// Newly arrived PIDs
 	const eventLen = 16
@@ -575,15 +595,6 @@ func (b *BpfRecorder) handleEvent(event []byte) {
 	pid := binary.LittleEndian.Uint32(event)
 	mntns := binary.LittleEndian.Uint64(event[8:])
 
-	// Filter out non-containers
-	if mntns == b.systemMountNamespace {
-		b.logger.V(config.VerboseLevel).Info(
-			"Skipping PID, because it's on the system mount namespace",
-			"pid", pid, "mntns", mntns,
-		)
-		return
-	}
-
 	// Blocking from syscall retrieval when PIDs are currently being analyzed
 	b.pidLock.Lock()
 	defer b.pidLock.Unlock()