Add Go tests for memfd and friends #186
Conversation
stanek-michal
force-pushed
the
memfd_probes_tests
branch
2 times, most recently
from
f3d4e40
to
c8f17a0
Compare
stanek-michal
force-pushed
the
memfd_probes_tests
branch
2 times, most recently
from
a36eaf7
to
244b7ee
Compare
testing/kernel_builder/.config
Outdated
There was a problem hiding this comment.
It looks like this file doesn't need to be commited? It's generated in testing/kernel_builder/build.sh. It also contains the same content repeatedly. I guess because it's not cleaned up between running build.sh
There was a problem hiding this comment.
removed in latest version
| @@ -2,10 +2,11 @@ from debian:bullseye | |||
|
|
|||
| RUN dpkg --add-architecture arm64 | |||
| RUN apt-get -y update | |||
| RUN apt-get -y install xz-utils | |||
There was a problem hiding this comment.
Why did this need to be in a separate command?
There was a problem hiding this comment.
I moved it to the next command with all installs
testing/kernel_builder/Makefile
Outdated
| ${CONTAINER_ENGINE} run -v ${PWD}:/work ${IMAGE}-new:${TAG} | ||
|
|
||
| image: | ||
| ${CONTAINER_ENGINE} build -f Dockerfile.old -t ${IMAGE}-old:${TAG} | ||
| ${CONTAINER_ENGINE} build -f Dockerfile.new -t ${IMAGE}-new:${TAG} | ||
| ${CONTAINER_ENGINE} build -f Dockerfile.new -t ${IMAGE}-new:${TAG} . |
There was a problem hiding this comment.
I think you could rename Dockerfile.new to just Dockerfile now
There was a problem hiding this comment.
yep, its one Dockerfile now
| int key = 0x0afebabe; | ||
| int size = 1024; | ||
| long int shmflg = 0666 |IPC_CREAT; | ||
| int shmid = shmget(key, size, shmflg); |
There was a problem hiding this comment.
Should this check for an error from shmget?
There was a problem hiding this comment.
not necessary I think, currently we only monitor the attempt to shmget, regardless if it failed or not - shmid does not go into ECS (we can think about logging return values later but that would be more probes)
stanek-michal
force-pushed
the
memfd_probes
branch
from
341211f
to
57ac1d2
Compare
stanek-michal
force-pushed
the
memfd_probes_tests
branch
from
db88ffc
to
84bdd93
Compare
stanek-michal
force-pushed
the
memfd_probes
branch
from
bab76d7
to
cd2f5bb
Compare
stanek-michal
force-pushed
the
memfd_probes_tests
branch
from
73461e2
to
bf24044
Compare
Those are partially imported source files that are best to leave unchanged.
Co-authored-by: Nicholas Berlin <[email protected]>
stanek-michal
force-pushed
the
memfd_probes_tests
branch
from
c572c2c
to
1847b17
Compare
Add Go tests for all probes except
load_kernel_module(this one will come in the next PR).Test for
shm_openwas not integrated because of complicated dependencies (libraries) of that glibc API that are difficult to integrate into the busybox of the kernel_testerStandalone versions of the
poc_*C tests can be viewed here:https://github.com/elastic/linux-fileless-execution