aquasecurity · yanivagman · Nov 22, 2021 · Nov 2, 2021 · Nov 11, 2021 · Nov 21, 2021
diff --git a/tracee-ebpf/printer.go b/tracee-ebpf/printer.go
@@ -90,13 +90,13 @@ func (p tableEventPrinter) Init() error { return nil }
 func (p tableEventPrinter) Preamble() {
 	if p.verbose {
 		if p.containerMode {
-			fmt.Fprintf(p.out, "%-16s %-16s %-16s %-12s %-12s %-6s %-16s %-15s %-15s %-15s %-16s %-20s %s", "TIME", "UTS_NAME", "CONTAINER_ID", "MNT_NS", "PID_NS", "UID", "COMM", "PID/host", "TID/host", "PPID/host", "RET", "EVENT", "ARGS")
+			fmt.Fprintf(p.out, "%-16s %-16s %-13s %-12s %-12s %-6s %-16s %-15s %-15s %-15s %-16s %-20s %s", "TIME", "UTS_NAME", "CONTAINER_ID", "MNT_NS", "PID_NS", "UID", "COMM", "PID/host", "TID/host", "PPID/host", "RET", "EVENT", "ARGS")
 		} else {
-			fmt.Fprintf(p.out, "%-16s %-16s %-16s %-12s %-12s %-6s %-16s %-7s %-7s %-7s %-16s %-20s %s", "TIME", "UTS_NAME", "CONTAINER_ID", "MNT_NS", "PID_NS", "UID", "COMM", "PID", "TID", "PPID", "RET", "EVENT", "ARGS")
+			fmt.Fprintf(p.out, "%-16s %-16s %-13s %-12s %-12s %-6s %-16s %-7s %-7s %-7s %-16s %-20s %s", "TIME", "UTS_NAME", "CONTAINER_ID", "MNT_NS", "PID_NS", "UID", "COMM", "PID", "TID", "PPID", "RET", "EVENT", "ARGS")
 		}
 	} else {
 		if p.containerMode {
-			fmt.Fprintf(p.out, "%-16s %-16s %-16s %-6s %-16s %-15s %-15s %-16s %-20s %s", "TIME", "UTS_NAME", "CONTAINER_ID", "UID", "COMM", "PID/host", "TID/host", "RET", "EVENT", "ARGS")
+			fmt.Fprintf(p.out, "%-16s %-13s %-6s %-16s %-15s %-15s %-16s %-20s %s", "TIME", "CONTAINER_ID", "UID", "COMM", "PID/host", "TID/host", "RET", "EVENT", "ARGS")
 		} else {
 			fmt.Fprintf(p.out, "%-16s %-6s %-16s %-7s %-7s %-16s %-20s %s", "TIME", "UID", "COMM", "PID", "TID", "RET", "EVENT", "ARGS")
 		}
@@ -110,15 +110,21 @@ func (p tableEventPrinter) Print(event external.Event) {
 		ut = ut.UTC()
 	}
 	timestamp := fmt.Sprintf("%02d:%02d:%02d:%06d", ut.Hour(), ut.Minute(), ut.Second(), ut.Nanosecond()/1000)
+
+	containerId := event.ContainerID
+	if len(containerId) > 12 {
+		containerId = containerId[:12]
+	}
+
 	if p.verbose {
 		if p.containerMode {
-			fmt.Fprintf(p.out, "%-16s %-16s %-16s %-12d %-12d %-6d %-16s %-7d/%-7d %-7d/%-7d %-7d/%-7d %-16d %-20s ", timestamp, event.HostName, event.ContainerID, event.MountNS, event.PIDNS, event.UserID, event.ProcessName, event.ProcessID, event.HostProcessID, event.ThreadID, event.HostThreadID, event.ParentProcessID, event.ParentProcessID, event.ReturnValue, event.EventName)
+			fmt.Fprintf(p.out, "%-16s %-16s %-13s %-12d %-12d %-6d %-16s %-7d/%-7d %-7d/%-7d %-7d/%-7d %-16d %-20s ", timestamp, event.HostName, containerId, event.MountNS, event.PIDNS, event.UserID, event.ProcessName, event.ProcessID, event.HostProcessID, event.ThreadID, event.HostThreadID, event.ParentProcessID, event.ParentProcessID, event.ReturnValue, event.EventName)
 		} else {
-			fmt.Fprintf(p.out, "%-16s %-16s %-16s %-12d %-12d %-6d %-16s %-7d %-7d %-7d %-16d %-20s ", timestamp, event.HostName, event.ContainerID, event.MountNS, event.PIDNS, event.UserID, event.ProcessName, event.ProcessID, event.ThreadID, event.ParentProcessID, event.ReturnValue, event.EventName)
+			fmt.Fprintf(p.out, "%-16s %-16s %-13s %-12d %-12d %-6d %-16s %-7d %-7d %-7d %-16d %-20s ", timestamp, event.HostName, containerId, event.MountNS, event.PIDNS, event.UserID, event.ProcessName, event.ProcessID, event.ThreadID, event.ParentProcessID, event.ReturnValue, event.EventName)
 		}
 	} else {
 		if p.containerMode {
-			fmt.Fprintf(p.out, "%-16s %-16s %-16s %-6d %-16s %-7d/%-7d %-7d/%-7d %-16d %-20s ", timestamp, event.HostName, event.ContainerID, event.UserID, event.ProcessName, event.ProcessID, event.HostProcessID, event.ThreadID, event.HostThreadID, event.ReturnValue, event.EventName)
+			fmt.Fprintf(p.out, "%-16s %-13s %-6d %-16s %-7d/%-7d %-7d/%-7d %-16d %-20s ", timestamp, containerId, event.UserID, event.ProcessName, event.ProcessID, event.HostProcessID, event.ThreadID, event.HostThreadID, event.ReturnValue, event.EventName)
 		} else {
 			fmt.Fprintf(p.out, "%-16s %-6d %-16s %-7d %-7d %-16d %-20s ", timestamp, event.UserID, event.ProcessName, event.ProcessID, event.ThreadID, event.ReturnValue, event.EventName)
 		}

diff --git a/tracee-ebpf/tracee/consts.go b/tracee-ebpf/tracee/consts.go
@@ -41,6 +41,7 @@ const (
 	configDebugNet
 	configProcTreeFilter
 	configCaptureModules
+	configCgroupV1
 )
 
 const (
@@ -165,6 +166,8 @@ const (
 	SwitchTaskNSEventID
 	MagicWriteEventID
 	CgroupAttachTaskEventID
+	CgroupMkdirEventID
+	CgroupRmdirEventID
 	SecurityBprmCheckEventID
 	SecurityFileOpenEventID
 	SecurityInodeUnlinkEventID
@@ -568,7 +571,9 @@ var EventsIDToEvent = map[int32]EventConfig{
 	CommitCredsEventID:            {ID: CommitCredsEventID, ID32Bit: sys32undefined, Name: "commit_creds", Probes: []probe{{event: "commit_creds", attach: kprobe, fn: "trace_commit_creds"}}, Sets: []string{}},
 	SwitchTaskNSEventID:           {ID: SwitchTaskNSEventID, ID32Bit: sys32undefined, Name: "switch_task_ns", Probes: []probe{{event: "switch_task_namespaces", attach: kprobe, fn: "trace_switch_task_namespaces"}}, Sets: []string{}},
 	MagicWriteEventID:             {ID: MagicWriteEventID, ID32Bit: sys32undefined, Name: "magic_write", Probes: []probe{}, Sets: []string{}},
-	CgroupAttachTaskEventID:       {ID: CgroupAttachTaskEventID, ID32Bit: sys32undefined, Name: "cgroup_attach_task", Probes: []probe{{event: "cgroup:cgroup_attach_task", attach: rawTracepoint, fn: "tracepoint__cgroup__cgroup_attach_task"}}, EssentialEvent: true, Sets: []string{}},
+	CgroupAttachTaskEventID:       {ID: CgroupAttachTaskEventID, ID32Bit: sys32undefined, Name: "cgroup_attach_task", Probes: []probe{{event: "cgroup:cgroup_attach_task", attach: rawTracepoint, fn: "tracepoint__cgroup__cgroup_attach_task"}}, Sets: []string{}},
+	CgroupMkdirEventID:            {ID: CgroupMkdirEventID, ID32Bit: sys32undefined, Name: "cgroup_mkdir", Probes: []probe{{event: "cgroup:cgroup_mkdir", attach: rawTracepoint, fn: "tracepoint__cgroup__cgroup_mkdir"}}, EssentialEvent: true, Sets: []string{}},
+	CgroupRmdirEventID:            {ID: CgroupRmdirEventID, ID32Bit: sys32undefined, Name: "cgroup_rmdir", Probes: []probe{{event: "cgroup:cgroup_rmdir", attach: rawTracepoint, fn: "tracepoint__cgroup__cgroup_rmdir"}}, EssentialEvent: true, Sets: []string{}},
 	SecurityBprmCheckEventID:      {ID: SecurityBprmCheckEventID, ID32Bit: sys32undefined, Name: "security_bprm_check", Probes: []probe{{event: "security_bprm_check", attach: kprobe, fn: "trace_security_bprm_check"}}, Sets: []string{"default", "lsm_hooks", "proc", "proc_life"}},
 	SecurityFileOpenEventID:       {ID: SecurityFileOpenEventID, ID32Bit: sys32undefined, Name: "security_file_open", Probes: []probe{{event: "security_file_open", attach: kprobe, fn: "trace_security_file_open"}}, Sets: []string{"default", "lsm_hooks", "fs", "fs_file_ops"}},
 	SecurityInodeUnlinkEventID:    {ID: SecurityInodeUnlinkEventID, ID32Bit: sys32undefined, Name: "security_inode_unlink", Probes: []probe{{event: "security_inode_unlink", attach: kprobe, fn: "trace_security_inode_unlink"}}, Sets: []string{"default", "lsm_hooks", "fs", "fs_file_ops"}},
@@ -944,7 +949,9 @@ var EventsIDToParams = map[int32][]external.ArgMeta{
 	CommitCredsEventID:            {{Type: "slim_cred_t", Name: "old_cred"}, {Type: "slim_cred_t", Name: "new_cred"}, {Type: "int", Name: "syscall"}},
 	SwitchTaskNSEventID:           {{Type: "pid_t", Name: "pid"}, {Type: "u32", Name: "new_mnt"}, {Type: "u32", Name: "new_pid"}, {Type: "u32", Name: "new_uts"}, {Type: "u32", Name: "new_ipc"}, {Type: "u32", Name: "new_net"}, {Type: "u32", Name: "new_cgroup"}},
 	MagicWriteEventID:             {{Type: "const char*", Name: "pathname"}, {Type: "bytes", Name: "bytes"}, {Type: "dev_t", Name: "dev"}, {Type: "unsigned long", Name: "inode"}},
-	CgroupAttachTaskEventID:       {{Type: "const char*", Name: "cgroup_path"}},
+	CgroupAttachTaskEventID:       {{Type: "const char*", Name: "cgroup_path"}, {Type: "const char*", Name: "comm"}, {Type: "pid_t", Name: "pid"}},
+	CgroupMkdirEventID:            {{Type: "u64", Name: "cgroup_id"}, {Type: "const char*", Name: "cgroup_path"}},
+	CgroupRmdirEventID:            {{Type: "u64", Name: "cgroup_id"}, {Type: "const char*", Name: "cgroup_path"}},
 	SecurityBprmCheckEventID:      {{Type: "const char*", Name: "pathname"}, {Type: "dev_t", Name: "dev"}, {Type: "unsigned long", Name: "inode"}},
 	SecurityFileOpenEventID:       {{Type: "const char*", Name: "pathname"}, {Type: "int", Name: "flags"}, {Type: "dev_t", Name: "dev"}, {Type: "unsigned long", Name: "inode"}, {Type: "int", Name: "syscall"}},
 	SecurityInodeUnlinkEventID:    {{Type: "const char*", Name: "pathname"}},

diff --git a/tracee-ebpf/tracee/containers.go b/tracee-ebpf/tracee/containers.go
@@ -4,62 +4,48 @@ import (
 	"bufio"
 	"fmt"
 	"io/fs"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"regexp"
 	"strings"
+	"syscall"
 )
 
 // Containers contain information about host running containers in the host.
 type Containers struct {
-	cgroupv1   bool
-	cgroupv1mp string
-	cgroupv2   bool
-	cgroupv2mp string
-	mapContIds map[string][]int32
+	cgroupV1     bool
+	cgroupMP     string
+	cgroupContId map[uint32]string
 }
 
 // InitContainers initializes a Containers object and returns a pointer to it.
 // User should further call "Populate" and iterate with Containers data.
 func InitContainers() *Containers {
+	cgroupV1 := false
+	if _, err := os.Stat("/sys/fs/cgroup/cgroup.controllers"); os.IsNotExist(err) {
+		cgroupV1 = true
+	}
+
 	return &Containers{
-		mapContIds: make(map[string][]int32, 0),
-		cgroupv1:   false,
-		cgroupv2:   false,
-		cgroupv1mp: "",
-		cgroupv2mp: "",
+		cgroupV1:     cgroupV1,
+		cgroupMP:     "",
+		cgroupContId: make(map[uint32]string),
 	}
 }
 
-// addContainer adds a container given its uuid.
-func (c *Containers) addContainer(contId string) {
-	_, ok := c.mapContIds[contId]
-	if !ok {
-		c.mapContIds[contId] = make([]int32, 0)
-	}
+func (c *Containers) IsCgroupV1() bool {
+	return c.cgroupV1
 }
 
 // GetContainers provides a list of all added containers by their uuid.
 func (c *Containers) GetContainers() []string {
 	var conts []string
-	for k := range c.mapContIds {
-		conts = append(conts, k)
+	for _, v := range c.cgroupContId {
+		conts = append(conts, v)
 	}
 	return conts
 }
 
-// addPid will add a given pid string to an existing container by given uuid.
-// It will also create the container if given container uuid does not exist.
-func (c *Containers) addPid(contId string, pid int32) {
-	c.addContainer(contId)
-	c.mapContIds[contId] = append(c.mapContIds[contId], pid)
-}
-
-func (c *Containers) GetPids(contId string) []int32 {
-	return c.mapContIds[contId]
-}
-
 // Populate will populate all Containers information by reading mounted proc
 // and cgroups filesystems.
 func (c *Containers) Populate() error {
@@ -82,104 +68,119 @@ func (c *Containers) procMountsCgroups() error {
 	if err != nil {
 		return err
 	}
+	defer file.Close()
+
 	scanner := bufio.NewScanner(file)
 	for i := 1; scanner.Scan(); i++ {
 		sline := strings.Split(scanner.Text(), " ")
 		mountpoint := sline[1]
 		fstype := sline[2]
-		if fstype == "cgroup" {
-			if strings.Contains(mountpoint, "cgroup/pids") {
-				c.cgroupv1 = true
-				c.cgroupv1mp = mountpoint
+		if c.cgroupV1 {
+			if fstype == "cgroup" && strings.Contains(mountpoint, "cpuset") {
+				c.cgroupMP = mountpoint
 			}
 		} else if fstype == "cgroup2" {
-			c.cgroupv2 = true
-			c.cgroupv2mp = mountpoint
+			c.cgroupMP = mountpoint
 		}
 	}
-	_ = file.Close()
 
 	return nil
 }
 
-// populate prepares the regex(es) to be used for the population to be done in
-// proc walk.
+// populate walks through cgroups (v1 & v2) filesystems and
+// finds directories based on known container runtimes patterns.
+// it then extracts containers information and saves it by their uuid
 func (c *Containers) populate() error {
+	fn := func(path string, d fs.DirEntry, err error) error {
+		if !d.IsDir() {
+			return nil
+		}
 
-	if c.cgroupv1 {
-		var r []string
-		// docker:  <cgroupv1mp>/<random>/docker/<id>/tasks
-		r = append(r, ".*docker.*(.{64})/tasks$")
-		// podman:  <cgroupv1mp>/<random>/libpod-<id>.scope/tasks
-		r = append(r, ".*libpod.*(.{64})\\.scope/tasks$")
-		// generic: <cgroupv1mp>/<random>/<id>.scope/tasks
-		r = append(r, ".*(.{64})\\.scope/tasks$")
-
-		err := c.populateProcWalk(c.cgroupv1mp, r)
 		if err != nil {
-			return err
+			_, _ = fmt.Fprintln(os.Stderr, err)
+			return nil
 		}
+
+		// The lower 32 bits of the cgroup id are the inode number of the matching cgroupfs entry
+		var stat syscall.Stat_t
+		if err := syscall.Stat(path, &stat); err != nil {
+			return nil
+		}
+
+		return c.CgroupUpdate(stat.Ino, path)
 	}
-	if c.cgroupv2 {
-		var r []string
-		// docker:  <cgroupv2mp>/<random>/docker-<id>.scope/cgroup.procs
-		r = append(r, ".*docker.*(.{64})\\.scope/cgroup.procs$")
-		// podman:  <cgroupv2mp>/<random>/libpod-<id>.scope/cgroup.procs
-		r = append(r, ".*libpod.*(.{64})\\.scope/cgroup.procs$")
-		// generic: <cgroupv2mp>/<random>/<id>.scope/cgroup.procs
-		r = append(r, ".*(.{64})\\.scope/cgroup.procs$")
-
-		err := c.populateProcWalk(c.cgroupv2mp, r)
-		if err != nil {
-			return err
+
+	if c.cgroupMP == "" {
+		return fmt.Errorf("could not determine cgroup mount point")
+	}
+
+	err := filepath.WalkDir(c.cgroupMP, fn)
 	if err != nil {
+		return err
+	}
+
+	return nil
+}
+
+// check if path belongs to a known container runtime and
+// add cgroupId with a matching container id, extracted from path
+func (c *Containers) CgroupUpdate(cgroupId uint64, path string) error {
+	pathComponents := strings.Split(path, "/")
+
+	for _, pc := range pathComponents {
+		if len(pc) < 64 {
+			continue
+		}
+		containerId, _ := c.getContainerIdFromCgroup(pc)
+		if containerId == "" {
+			continue
 		}
+		c.cgroupContId[uint32(cgroupId)] = containerId
+
+		return nil
 	}
 
 	return nil
 }
 
-// populateProcWalk walks through procfs for cgroups (v1 & v2) filesystems and
-// find files based on given regex(es). It also extracts containers
-// information from found files and creates containers by their uuid AND adds
-// running pids to those containers.
-func (c *Containers) populateProcWalk(basedir string, allstr []string) error {
+// extract container id and container runtime from path
+func (c *Containers) getContainerIdFromCgroup(pathComponent string) (string, string) {
+	runtime := "unknown"
+	path := strings.TrimSuffix(pathComponent, ".scope")
 
-	var allres []*regexp.Regexp
-	allres = make([]*regexp.Regexp, len(allstr))
-	for j := 0; j < len(allstr); j++ {
-		allres[j] = regexp.MustCompile(basedir + allstr[j])
+	if strings.HasPrefix(path, "docker-") {
+		runtime = "docker"
+		path = strings.TrimPrefix(path, "docker-")
+		goto check
 	}
-	err := filepath.WalkDir(basedir,
-		func(fn string, fi fs.DirEntry, err error) error {
-			if err != nil {
-				_, _ = fmt.Fprintln(os.Stderr, err)
-				return nil
-			}
-			for l := 0; l < len(allres); l++ {
-				res := allres[l].FindStringSubmatch(fn)
-				if len(res) == 0 {
-					continue
-				}
-				contId := res[1] // 1st regexp match (Id)
-				c.addContainer(contId)
-				buf, e := ioutil.ReadFile(fn) // res[0] or fn == .tasks or .procs file
-				if e != nil {
-					return e // error if can't read pids file
-				}
-				for _, pid := range strings.Split(string(buf), "\n") {
-					if len(pid) > 0 {
-						var pidInt int32
-						_, err = fmt.Sscanf(pid, "%d", &pidInt)
-						if err != nil {
-							continue // ignore sscanf errors
-						}
-						c.addPid(contId, pidInt)
-					}
-				}
-				break // a single match is enough
-			}
-			return nil
-		})
+	if strings.HasPrefix(path, "crio-") {
+		runtime = "crio"
+		path = strings.TrimPrefix(path, "crio-")
+		goto check
+	}
+	if strings.HasPrefix(path, "cri-containerd-") {
+		runtime = "containerd"
+		path = strings.TrimPrefix(path, "cri-containerd-")
+		goto check
+	}
+	if strings.HasPrefix(path, "libpod-") {
+		runtime = "podman"
+		path = strings.TrimPrefix(path, "libpod-")
+		goto check
+	}
+
+check:
+	if matched, _ := regexp.MatchString(`^[A-Fa-f0-9]{64}$`, path); !matched {
+		return "", ""
+	}
+
+	return path, runtime
+}
+
+func (c *Containers) CgroupRemove(cgroupId uint64) {
+	delete(c.cgroupContId, uint32(cgroupId))
+}
 
-	return err
+func (c *Containers) GetContainerId(cgroupId uint64) string {
+	return c.cgroupContId[uint32(cgroupId)]
 }
diff --git a/tracee-ebpf/tracee/events.go b/tracee-ebpf/tracee/events.go
@@ -16,6 +16,7 @@ import (
 // keep the 1-byte 'Argnum' as the final parameter before the padding (if padding is needed).
 type context struct {
 	Ts       uint64
+	CgroupID uint64
 	Pid      uint32
 	Tid      uint32
 	Ppid     uint32
@@ -27,7 +28,6 @@ type context struct {
 	PidID    uint32
 	Comm     [16]byte
 	UtsName  [16]byte
-	ContID   [16]byte
 	EventID  int32
 	Retval   int64
 	StackID  uint32
@@ -117,7 +117,7 @@ func (t *Tracee) processEvents(done <-chan struct{}) error {
 			PIDNS:               int(ctx.PidID),
 			ProcessName:         string(bytes.TrimRight(ctx.Comm[:], "\x00")),
 			HostName:            string(bytes.TrimRight(ctx.UtsName[:], "\x00")),
-			ContainerID:         string(bytes.TrimRight(ctx.ContID[:], "\x00")),
+			ContainerID:         t.containers.GetContainerId(ctx.CgroupID),
 			EventID:             int(ctx.EventID),
 			EventName:           EventsIDToEvent[int32(ctx.EventID)].Name,
 			ArgsNum:             int(ctx.Argnum),