feat(userspace/libsinsp): improve recvmsg SCM_RIGHTS cmsg handling

userspace/libscap/engine/gvisor/gvisor.cpp

@@ -124,6 +124,7 @@ const scap_platform_vtable scap_gvisor_platform_vtable = {
         .get_global_pid = NULL,
         .get_threadlist = gvisor_get_threadlist,
         .get_fdlist = NULL,
+        .get_fdinfo = NULL,
 
         .close_platform = scap_gvisor_close_platform,
         .free_platform = scap_gvisor_free_platform,

userspace/libscap/linux/scap_fds.c

@@ -1156,6 +1156,48 @@ char *decode_st_mode(struct stat *sb) {
 		break;
 	}
 }
+
+static int32_t handle_file(struct scap_proclist *proclist,
+                           char *f_name,
+                           scap_threadinfo *tinfo,
+                           scap_fdinfo *fdi,
+                           char *procdir,
+                           struct stat const *const sb,
+                           uint64_t const net_ns,
+                           struct scap_ns_socket_list **sockets_by_ns,
+                           char *error) {
+	switch(sb->st_mode & S_IFMT) {
+	case S_IFIFO:
+		fdi->type = SCAP_FD_FIFO;
+		return scap_fd_handle_pipe(proclist, f_name, tinfo, fdi, error);
+	case S_IFREG:
+	case S_IFBLK:
+	case S_IFCHR:
+	case S_IFLNK:
+		fdi->type = SCAP_FD_FILE_V2;
+		fdi->ino = sb->st_ino;
+		return scap_fd_handle_regular_file(proclist, f_name, tinfo, fdi, procdir, error);
+	case S_IFDIR:
+		fdi->type = SCAP_FD_DIRECTORY;
+		fdi->ino = sb->st_ino;
+		return scap_fd_handle_regular_file(proclist, f_name, tinfo, fdi, procdir, error);
+	case S_IFSOCK:
+		fdi->type = SCAP_FD_UNKNOWN;
+		return scap_fd_handle_socket(proclist,
+		                             f_name,
+		                             tinfo,
+		                             fdi,
+		                             procdir,
+		                             net_ns,
+		                             sockets_by_ns,
+		                             error);
+	default:
+		fdi->type = SCAP_FD_UNSUPPORTED;
+		fdi->ino = sb->st_ino;
+		return scap_fd_handle_regular_file(proclist, f_name, tinfo, fdi, procdir, error);
+	}
+}
+
 //
 // Scan the directory containing the fd's of a proc /proc/x/fd
 //
@@ -1171,97 +1213,54 @@ int32_t scap_fd_scan_fd_dir(struct scap_linux_platform *linux_platform,
 	int32_t res = SCAP_SUCCESS;
 	char fd_dir_name[SCAP_MAX_PATH_SIZE];
 	char f_name[SCAP_MAX_PATH_SIZE];
-	char link_name[SCAP_MAX_PATH_SIZE];
 	struct stat sb;
 	uint64_t fd;
 	scap_fdinfo fdi = {};
 	uint64_t net_ns;
-	ssize_t r;
 	uint32_t fd_added = 0;
 
 	if(num_fds_ret != NULL) {
 		*num_fds_ret = 0;
 	}
 
-	snprintf(fd_dir_name, SCAP_MAX_PATH_SIZE, "%sfd", procdir);
+	snprintf(fd_dir_name, sizeof(fd_dir_name), "%sfd", procdir);
 	dir_p = opendir(fd_dir_name);
 	if(dir_p == NULL) {
 		snprintf(error, SCAP_LASTERR_SIZE, "error opening the directory %s", fd_dir_name);
 		return SCAP_NOTFOUND;
 	}
 
-	//
-	// Get the network namespace of the process
-	//
+	// Get the network namespace of the process.
 	snprintf(f_name, sizeof(f_name), "%sns/net", procdir);
-	r = readlink(f_name, link_name, sizeof(link_name) - 1);
-	if(r <= 0) {
-		//
-		// No network namespace available. Assume global
-		//
+	if(stat(f_name, &sb) == -1) {
+		// Assume default network namespace.
 		net_ns = 0;
 	} else {
-		link_name[r] = '\0';
-		sscanf(link_name, "net:[%" PRIi64 "]", &net_ns);
+		net_ns = sb.st_ino;
 	}
 
 	while((dir_entry_p = readdir(dir_p)) != NULL &&
 	      (linux_platform->m_fd_lookup_limit == 0 ||
 	       fd_added < linux_platform->m_fd_lookup_limit)) {
-		snprintf(f_name, SCAP_MAX_PATH_SIZE, "%s/%s", fd_dir_name, dir_entry_p->d_name);
+		snprintf(f_name, sizeof(f_name), "%s/%s", fd_dir_name, dir_entry_p->d_name);
 
 		if(-1 == stat(f_name, &sb) || 1 != sscanf(dir_entry_p->d_name, "%" PRIu64, &fd)) {
 			continue;
 		}
 		fdi.fd = fd;
 
 		// In no driver mode to limit cpu usage we just parse sockets
-		// because we are interested only on them
+		// because we are interested only on them.
 		if(linux_platform->m_minimal_scan && !S_ISSOCK(sb.st_mode)) {
 			continue;
 		}
 
-		switch(sb.st_mode & S_IFMT) {
-		case S_IFIFO:
-			fdi.type = SCAP_FD_FIFO;
-			res = scap_fd_handle_pipe(proclist, f_name, tinfo, &fdi, error);
-			break;
-		case S_IFREG:
-		case S_IFBLK:
-		case S_IFCHR:
-		case S_IFLNK:
-			fdi.type = SCAP_FD_FILE_V2;
-			fdi.ino = sb.st_ino;
-			res = scap_fd_handle_regular_file(proclist, f_name, tinfo, &fdi, procdir, error);
-			break;
-		case S_IFDIR:
-			fdi.type = SCAP_FD_DIRECTORY;
-			fdi.ino = sb.st_ino;
-			res = scap_fd_handle_regular_file(proclist, f_name, tinfo, &fdi, procdir, error);
-			break;
-		case S_IFSOCK:
-			fdi.type = SCAP_FD_UNKNOWN;
-			res = scap_fd_handle_socket(proclist,
-			                            f_name,
-			                            tinfo,
-			                            &fdi,
-			                            procdir,
-			                            net_ns,
-			                            sockets_by_ns,
-			                            error);
-			break;
-		default:
-			fdi.type = SCAP_FD_UNSUPPORTED;
-			fdi.ino = sb.st_ino;
-			res = scap_fd_handle_regular_file(proclist, f_name, tinfo, &fdi, procdir, error);
+		if(handle_file(proclist, f_name, tinfo, &fdi, procdir, &sb, net_ns, sockets_by_ns, error) !=
+		   SCAP_SUCCESS) {
 			break;
 		}
 
-		if(SCAP_SUCCESS != res) {
-			break;
-		} else {
-			++fd_added;
-		}
+		++fd_added;
 	}
 	closedir(dir_p);
 
@@ -1271,3 +1270,40 @@ int32_t scap_fd_scan_fd_dir(struct scap_linux_platform *linux_platform,
 
 	return res;
 }
+
+int32_t scap_fd_get_fdinfo(struct scap_linux_platform const *const linux_platform,
+                           struct scap_proclist *proclist,
+                           char *procdir,
+                           scap_threadinfo *tinfo,
+                           int const fd,
+                           struct scap_ns_socket_list **sockets_by_ns,
+                           char *error) {
+	char f_name[SCAP_MAX_PATH_SIZE];
+	struct stat sb;
+	uint64_t net_ns;
+	scap_fdinfo fdi = {};
+
+	// Get the network namespace of the process.
+	snprintf(f_name, sizeof(f_name), "%sns/net", procdir);
+	if(stat(f_name, &sb) == -1) {
+		// Assume default network namespace.
+		net_ns = 0;
+	} else {
+		net_ns = sb.st_ino;
+	}
+
+	// Get file descriptor stat.
+	snprintf(f_name, sizeof(f_name), "%sfd/%d", procdir, fd);
+	if(stat(f_name, &sb) == -1) {
+		return SCAP_NOTFOUND;
+	}
+	fdi.fd = fd;
+
+	// In no driver mode to limit cpu usage we just parse sockets
+	// because we are interested only on them.
+	if(linux_platform->m_minimal_scan && !S_ISSOCK(sb.st_mode)) {
+		return EXIT_SUCCESS;
+	}
+
+	return handle_file(proclist, f_name, tinfo, &fdi, procdir, &sb, net_ns, sockets_by_ns, error);
+}

userspace/libscap/linux/scap_linux_int.h

@@ -65,6 +65,10 @@ int32_t scap_linux_get_threadlist(struct scap_platform* platform,
 int32_t scap_linux_get_fdlist(struct scap_platform* platform,
                               struct scap_threadinfo* tinfo,
                               char* lasterr);
+int32_t scap_linux_get_fdinfo(struct scap_platform* platform,
+                              struct scap_threadinfo* tinfo,
+                              int fd,
+                              char* lasterr);
 
 // read all sockets and add them to the socket table hashed by their ino
 int32_t scap_fd_read_sockets(char* procdir, struct scap_ns_socket_list* sockets, char* error);
@@ -77,3 +81,11 @@ int32_t scap_fd_scan_fd_dir(struct scap_linux_platform* linux_platform,
                             struct scap_ns_socket_list** sockets_by_ns,
                             uint64_t* num_fds_ret,
                             char* error);
+// read the file descriptor info for a given process directory
+int32_t scap_fd_get_fdinfo(struct scap_linux_platform const* linux_platform,
+                           struct scap_proclist* proclist,
+                           char* procdir,
+                           scap_threadinfo* tinfo,
+                           int fd,
+                           struct scap_ns_socket_list** sockets_by_ns,
+                           char* error);

userspace/libscap/linux/scap_linux_platform.c

@@ -117,6 +117,7 @@ static const struct scap_platform_vtable scap_linux_platform_vtable = {
         .get_global_pid = scap_linux_getpid_global,
         .get_threadlist = scap_linux_get_threadlist,
         .get_fdlist = scap_linux_get_fdlist,
+        .get_fdinfo = scap_linux_get_fdinfo,
         .close_platform = scap_linux_close_platform,
         .free_platform = scap_linux_free_platform,
 };

userspace/libscap/linux/scap_procs.c

@@ -1328,3 +1328,28 @@ int32_t scap_linux_get_fdlist(struct scap_platform* platform,
 	}
 	return res;
 }
+
+int32_t scap_linux_get_fdinfo(struct scap_platform* platform,
+                              struct scap_threadinfo* tinfo,
+                              int const fd,
+                              char* lasterr) {
+	int res = SCAP_SUCCESS;
+	char proc_dir[SCAP_MAX_PATH_SIZE];
+	struct scap_ns_socket_list* sockets_by_ns = NULL;
+	struct scap_linux_platform* linux_platform = (struct scap_linux_platform*)platform;
+
+	// We get file descriptor info from the main thread
+	snprintf(proc_dir, sizeof(proc_dir), "%s/proc/%lu/", scap_get_host_root(), tinfo->pid);
+
+	res = scap_fd_get_fdinfo(linux_platform,
+	                         &platform->m_proclist,
+	                         proc_dir,
+	                         tinfo,
+	                         fd,
+	                         &sockets_by_ns,
+	                         lasterr);
+	if(sockets_by_ns != NULL && sockets_by_ns != (void*)-1) {
+		scap_fd_free_ns_sockets_list(&sockets_by_ns);
+	}
+	return res;
+}

userspace/libscap/scap_platform_api.c

@@ -149,3 +149,15 @@ int32_t scap_get_fdlist(struct scap_platform* platform,
 	snprintf(error, SCAP_LASTERR_SIZE, "operation not supported");
 	return SCAP_FAILURE;
 }
+
+int32_t scap_get_fdinfo(struct scap_platform* platform,
+                        struct scap_threadinfo* tinfo,
+                        int const fd,
+                        char* error) {
+	if(platform && platform->m_vtable->get_fdinfo) {
+		return platform->m_vtable->get_fdinfo(platform, tinfo, fd, error);
+	}
+
+	snprintf(error, SCAP_LASTERR_SIZE, "operation not supported");
+	return SCAP_FAILURE;
+}

userspace/libscap/scap_platform_api.h

@@ -113,6 +113,14 @@ struct ppm_proclist_info* scap_get_threadlist(struct scap_platform* platform, ch
 */
 int32_t scap_get_fdlist(struct scap_platform* platform, struct scap_threadinfo* tinfo, char* error);
 
+/*!
+  \brief Get the file descriptor info for a given pid.
+*/
+int32_t scap_get_fdinfo(struct scap_platform* platform,
+                        struct scap_threadinfo* tinfo,
+                        int fd,
+                        char* error);
+
 #ifdef __cplusplus
 };
 #endif

userspace/libscap/scap_platform_impl.h

@@ -72,6 +72,10 @@ struct scap_platform_vtable {
 	int32_t (*get_fdlist)(struct scap_platform* platform,
 	                      struct scap_threadinfo* tinfo,
 	                      char* lasterr);
+	int32_t (*get_fdinfo)(struct scap_platform* platform,
+	                      struct scap_threadinfo* tinfo,
+	                      int fd,
+	                      char* lasterr);
 
 	// close the platform structure
 	// clean up all data, make it ready for another call to `init_platform`