Filter out host processes by host mntns to prevent ebpf map from filling up during recording

internal/pkg/daemon/bpfrecorder/bpf/recorder.bpf.c

@@ -7,6 +7,7 @@
 #define MAX_ENTRIES 8 * 1024
 #define MAX_SYSCALLS 1024
 #define MAX_COMM_LEN 64
+#define MAX_MNTNS_LEN 1
 
 char LICENSE[] SEC("license") = "Dual BSD/GPL";
 
@@ -24,6 +25,13 @@ struct {
     __type(value, char[MAX_COMM_LEN]);  // command name
 } comms SEC(".maps");
 
+struct {
+    __uint(type, BPF_MAP_TYPE_HASH);
+    __uint(max_entries, MAX_MNTNS_LEN);
+    __type(key, u32);                   // PID
+    __type(value, u64);                 // mntns ID
+} system_mntns SEC(".maps");
+
 struct {
     __uint(type, BPF_MAP_TYPE_RINGBUF);
     __uint(max_entries, 1 << 24);
@@ -50,6 +58,13 @@ int sys_enter(struct trace_event_raw_sys_enter * args)
     if (mntns == 0) {
         return 0;
     }
+    // Filter mntns by hostmntns to exclude host processes
+    u32 hostPid = 1;
+    u64 * host_mntns;
+    host_mntns = bpf_map_lookup_elem(&system_mntns, &hostPid);
+    if (host_mntns != NULL && *host_mntns == mntns) {
+        return 0;
+    }
 
     // Update the command name if required
     char comm[MAX_COMM_LEN];

internal/pkg/daemon/bpfrecorder/bpfrecorder.go

@@ -57,6 +57,8 @@ const (
 	maxMsgSize          int           = 16 * 1024 * 1024
 	defaultCacheTimeout time.Duration = time.Hour
 	maxCacheItems       uint64        = 1000
+	defaultHostPid      uint32        = 1
+	defaultByteNum      int           = 8
 )
 
 // BpfRecorder is the main structure of this package.
@@ -67,6 +69,7 @@ type BpfRecorder struct {
 	startRequests            int64
 	syscalls                 *bpf.BPFMap
 	comms                    *bpf.BPFMap
+	mntns                    *bpf.BPFMap
 	btfPath                  string
 	syscallNamesForIDCache   *ttlcache.Cache[string, string]
 	containerIDCache         *ttlcache.Cache[string, string]
@@ -423,6 +426,11 @@ func (b *BpfRecorder) load(startEventProcessor bool) (err error) {
 	if err != nil {
 		return fmt.Errorf("get comms map: %w", err)
 	}
+	b.logger.Info("Getting system_mntns map")
+	mntns, err := b.GetMap(module, "system_mntns")
+	if err != nil {
+		return fmt.Errorf("get mntns_map: %w", err)
+	}
 
 	events := make(chan []byte)
 	ringbuffer, err := b.InitRingBuf(module, "events", events)
@@ -433,6 +441,11 @@ func (b *BpfRecorder) load(startEventProcessor bool) (err error) {
 
 	b.syscalls = syscalls
 	b.comms = comms
+	b.mntns = mntns
+
+	// Update mntns to system_mntns
+	b.updateSystemMntns()
+
 	if startEventProcessor {
 		go b.processEvents(events)
 	}
@@ -564,6 +577,15 @@ func (b *BpfRecorder) processEvents(events chan []byte) {
 	}
 }
 
+func (b *BpfRecorder) updateSystemMntns() {
+	mntnsByte := make([]byte, defaultByteNum)
+	binary.LittleEndian.PutUint64(mntnsByte, b.systemMountNamespace)
+	err := b.UpdateValue(b.mntns, defaultHostPid, mntnsByte)
+	if err != nil {
+		b.logger.Error(err, "update system_mntns map failed")
+	}
+}
+
 func (b *BpfRecorder) handleEvent(event []byte) {
 	// Newly arrived PIDs
 	const eventLen = 16
@@ -575,15 +597,6 @@ func (b *BpfRecorder) handleEvent(event []byte) {
 	pid := binary.LittleEndian.Uint32(event)
 	mntns := binary.LittleEndian.Uint64(event[8:])
 
-	// Filter out non-containers
-	if mntns == b.systemMountNamespace {
-		b.logger.V(config.VerboseLevel).Info(
-			"Skipping PID, because it's on the system mount namespace",
-			"pid", pid, "mntns", mntns,
-		)
-		return
-	}
-
 	// Blocking from syscall retrieval when PIDs are currently being analyzed
 	b.pidLock.Lock()
 	defer b.pidLock.Unlock()

internal/pkg/daemon/bpfrecorder/bpfrecorder_test.go

@@ -725,30 +725,6 @@ func TestProcessEvents(t *testing.T) {
 				require.True(t, success)
 			},
 		},
-		{ // system mount namespace
-			prepare: func(sut *BpfRecorder, mock *bpfrecorderfakes.FakeImpl) []byte {
-				mntns := binary.LittleEndian.Uint64([]byte{1, 0, 0, 0, 0, 0, 0, 0})
-				sut.systemMountNamespace = mntns
-				sut.profileForMountNamespace.Store(mntns, "profile.json")
-				return []byte{
-					1, 0, 0, 0, 0, 0, 0, 0,
-					1, 0, 0, 0, 0, 0, 0, 0,
-				}
-			},
-			assert: func(sut *BpfRecorder, logger *Logger) {
-				success := false
-				for i := 0; i < 100; i++ {
-					logger.mutex.RLock()
-					success = util.Contains(logger.messages, "Skipping PID, because it's on the system mount namespace")
-					logger.mutex.RUnlock()
-					if success {
-						break
-					}
-					time.Sleep(100 * time.Millisecond)
-				}
-				require.True(t, success)
-			},
-		},
 		{ // invalid event length
 			prepare: func(sut *BpfRecorder, mock *bpfrecorderfakes.FakeImpl) []byte {
 				return []byte{1, 0, 0}