tetragon: add matchCurrentCred filter to match current tasks based on their process credentials #3845

tixxdz · 2025-06-23T23:11:36Z

Description

Adds new matchCurrentCred selector to match current running task credentials. For now it supports real and effective UIDs.

Changelog

Add matchCurrentCred to match current task UIDs/GIDs credentials. Works on kernels >= 5.3.

pkg/selectors/kernel.go

netlify · 2025-07-07T23:48:01Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`4bb933b`
🔍 Latest deploy log	https://app.netlify.com/projects/tetragon/deploys/68714aa3f980a900082ef7af
😎 Deploy Preview	https://deploy-preview-3845--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

pkg/selectors/kernel.go

kkourt

Thanks!

Please find some comments below.

pkg/k8s/apis/cilium.io/v1alpha1/types.go

bpf/process/pfilter.h

pkg/selectors/kernel.go

pkg/selectors/kernel_test.go

bpf/process/pfilter.h

olsajiri · 2025-07-15T13:26:55Z

bpf/process/pfilter.h

+
+	/* Here we are at the beginning of matching credentials */
+
+	if (flags & PF_CRED_RUID) {


it seems like the code below this condition and the code under PF_CRED_EUID could be in the function that has the uid argument?

Ok I tried but it propagated PFILTER_ERROR inside, let me know what you think? since we still need to handle in that generic calls the PFILTER_ERROR, IIRC right now PFILTER_ERROR could be PFILTER_ACCEPT in top callers.

@olsajiri ok pushed let's see if tests pass, but also what you think about above

Adds matchCurrentCred selector to match against credentials of current running task. For now we support only real and effective uids [1] on current task. matchCurrentCred is against current task credentials, it will always be able to track the real current credentials. Tetragon shadow state of tasks as of today does not save full uids/gids credentials. They are fetched during execve but cached in userspace when we report process.process_credentials fields in json, even if they are cached right now we are more interested in the real current credentials. So how matchCurrentCred will work: 1. When a process executes Tetragon captures full creds and send it to userspace process cache. These are the cached process.process_credentials that are reported for process_exec, process_kprobe and so on, they never change since they are cached in userspace. 2. If a process changes its credentials since the execve snapshot, tetragon userspace cache won't change. 3. matchCurrentCred will always match against current task real time credentials. So if a task changes its credentials in kernel matchCurrentCred will always be able to track that change. Changes: make crds && make -C install/kubernetes [1] https://tetragon.io/docs/reference/grpc-api/#processcredentials Signed-off-by: Djalal Harouni <[email protected]>

Add first matchCurrentCred selector logic to match real and effective UIDs. matchCurrentCred is against current task credentials, it will always be able to track the real current credentials. Tetragon shadow state of tasks as of today does not save full uids/gids credentials. They are fetched during execve but cached in userspace when we report process.process_credentials fields in json, even if they are cached right now we are more interested in the real current credentials. So how matchCurrentCred will work: 1. When a process executes Tetragon captures full creds and send it to userspace process cache. These are the cached process.process_credentials that are reported for process_exec, process_kprobe and so on, they never change since they are cached in userspace. 2. If a process changes its credentials since the execve snapshot, tetragon userspace cache won't change. 3. matchCurrentCred will always match against current task real time credentials. So if a task changes its credentials in kernel matchCurrentCred will always be able to track that change. Signed-off-by: Djalal Harouni <[email protected]>

Signed-off-by: Djalal Harouni <[email protected]>

tixxdz · 2025-07-16T13:49:47Z

Thanks!

Please find some comments below.

Much appreciated for the review, all comments handled let's see if tests pass.

Signed-off-by: Djalal Harouni <[email protected]>

1. Tests starts with root uid 0 2. Tests executes drop-privileges, in Tetragon userspace cached process credentials are euid == 0 3. drop-privileges changes its reuid to 1879048188 but cached state is still uid/euid == 0 since execve snapshot. But in kernel, current credentials are uid/euid == 1879048188. These are the ones that we use for matching. 4. drop-privileges executes /usr/bin/echo In tetragon userspace uid == 0, but in kernel current uid == 1879048188 In tracing policy we match against current credentials 1879048188 In Process json output checker we match against cached userspace state credentials uid/euid == 0. 5. /usr/bin/echo starts with uid/euid == 1879048188 In tetragon uid == 1879048188 same in kernel current uid == 1879048188 Signed-off-by: Djalal Harouni <[email protected]>

Signed-off-by: Djalal Harouni <[email protected]>

kkourt

Thanks!

Please find some comments below.

kkourt · 2025-07-18T13:07:29Z

pkg/k8s/apis/cilium.io/v1alpha1/types.go

+type CredentialsSelector struct {
+	// +kubebuilder:validation:Optional
+	// Real UIDs to match.
+	RUIDs []CredIDValues `json:"uid,omitempty"`


I'm not sure what's the point of this being a list.

For example, if a user specifies:

- uid: - operator: Equal values: - "10" - "30" - operator: Equal values: - "20"

Then this either means: (uid == 10 OR uid == 30) AND (uid == 20) which will never match if the values are different.

Or it means (uid == 10 OR uid == 30) OR (uid == 20) which can just be written as a single selector:

- uid: - operator: Equal values: - "10" - "20" - "30"

Also, is there a reason why the JSON field different? uid vs RUIDs?

Hmm I was thinking an AND , I intended to disable it for now and open it later. To combine Equal and NotEqual

- uid: - operator: Equal values: - "0:999" # system users - operator: NotEqual values: - "102" # syslog - "995:998" # systemd tools on ubuntu

Or let's say Equal "1000:65535" users but NotEqual "2000" . Of course we can make it in single Equal and use ranges but it is also easier if you use one or two single ranges, and exclude the special ones, so some flexibility for the future, especially if you have cases running with UIDs ranges...

I already check if we have already parsed uid field, let me add another check to ensure we have only one operator, and we can activate later. Will add code comments for it.

Also, is there a reason why the JSON field different? uid vs RUIDs?

To be consistent with https://tetragon.io/docs/reference/grpc-api/#processcredentials

Or let's say Equal "1000:65535" users but NotEqual "2000"

OK, above makes sense to me, thanks!. Let's document that it's an AND, add a test-case for it.

To be consistent with https://tetragon.io/docs/reference/grpc-api/#processcredentials

They are consistent at the JSON level, but not at the gRPC level. I would suggest to name the JSON field ruid to make the mapping between gRPC and JSON fields obvious as we do in all other cases.

kkourt · 2025-07-18T13:08:35Z

pkg/k8s/apis/cilium.io/v1alpha1/types.go

+	RUIDs []CredIDValues `json:"uid,omitempty"`
+	// +kubebuilder:validation:Optional
+	// Effective UIDs to match.
+	EUIDs []CredIDValues `json:"euid,omitempty"`


same as above

kkourt · 2025-07-18T13:11:19Z

bpf/process/pfilter.h

+} __attribute__((packed));
+
+struct cred_filter {
+	__u64 ty; /* credentials type flags */


What are the values of these flags?

Are they used somewhere?
The only thing I'm seeing is:

if (!cred_f->ty) return PFILTER_REJECT;

so it seems to me that this can be omitted.
If they are used at a later patch, please introduce them there.

Good catch, it should be used since we can't predict the order of passed credentials filters uid,euid,x,y or x,uid,y,euid... in the tracing policy, so every time we iterate to the next one we should check it to know which field we are parsing... I intended to use it for that, will fix it, thanks!

kkourt · 2025-07-18T13:14:20Z

pkg/sensors/tracing/kprobe_process_credentials_test.go

+			Operator: "Equal",
+			Values:   []string{"0:0"},
+		},
+	}


This test is hard to read.
I would suggest an array of test cases, each with the filter and the expected result to make it easier to read and understand.

Sure will do, missed it.

kkourt · 2025-07-18T13:15:01Z

pkg/selectors/kernel_test.go

+		cred     []v1alpha1.CredentialsSelector
+		expected []byte
+		err      error
+	}{


kkourt · 2025-07-18T13:17:07Z

pkg/selectors/kernel_test.go

+		})
+	}
+
+	/* Extra tests */


Can you please use a similar structure as above? That is, something like:

tests := map[string]struct { cred []v1alpha1.CredentialsSelector expected []byte err error

Will try otherwise I separate them in different test, since they are a bit special...

kkourt · 2025-07-18T13:18:08Z

pkg/sensors/tracing/kprobe_process_credentials_test.go

+	// Restore all gids to 0
+	if err := syscall.Setgid(0); err != nil {
+		t.Fatalf("setgid(0) error: %s", err)
+	}


Is this a fix for an existing test? Please have it as a separate patch.

kkourt · 2025-07-18T13:18:32Z

pkg/sensors/tracing/kprobe_process_credentials_test.go

+	// Restore all gids to 0
+	if err := syscall.Setgid(0); err != nil {
+		t.Fatalf("setgid(0) error: %s", err)
+	}


Similar as above: if this is a fix on an existing test, please add it as a separate patch.

tixxdz requested a review from a team as a code owner June 23, 2025 23:11

tixxdz requested a review from tpapagian June 23, 2025 23:11

tixxdz marked this pull request as draft June 23, 2025 23:13

github-advanced-security bot found potential problems Jun 23, 2025

View reviewed changes

pkg/selectors/kernel.go Fixed Show fixed Hide fixed

tixxdz force-pushed the pr/tixxdz/2025-06-creds branch from 7725d54 to 8e55321 Compare July 7, 2025 23:47

tixxdz added the release-note/major This PR introduces major new functionality label Jul 7, 2025

tixxdz force-pushed the pr/tixxdz/2025-06-creds branch 2 times, most recently from 69da199 to 96c8c80 Compare July 8, 2025 00:18

github-advanced-security bot found potential problems Jul 8, 2025

View reviewed changes

pkg/selectors/kernel.go Fixed Show resolved Hide resolved

tixxdz force-pushed the pr/tixxdz/2025-06-creds branch 13 times, most recently from 82ce367 to d14a5d3 Compare July 11, 2025 00:08

tixxdz changed the title ~~WIP~~ tetragon: add matchCurrentCred filter to match current tasks based on their process credentials Jul 11, 2025

tixxdz force-pushed the pr/tixxdz/2025-06-creds branch 5 times, most recently from 6160277 to 4bb933b Compare July 11, 2025 17:32

tixxdz marked this pull request as ready for review July 11, 2025 17:34

tixxdz requested review from kkourt and olsajiri July 11, 2025 17:34

tixxdz marked this pull request as draft July 13, 2025 00:01

tixxdz force-pushed the pr/tixxdz/2025-06-creds branch from 4bb933b to 212e198 Compare July 14, 2025 11:22

tixxdz marked this pull request as ready for review July 14, 2025 11:27

kkourt reviewed Jul 14, 2025

View reviewed changes

This comment was marked as resolved.

Sign in to view

olsajiri reviewed Jul 15, 2025

View reviewed changes

tixxdz added 3 commits July 16, 2025 13:50

tests:sensors: test policies with MatchCurrentCred fields

b9db622

Signed-off-by: Djalal Harouni <[email protected]>

tixxdz force-pushed the pr/tixxdz/2025-06-creds branch from 212e198 to 81f576b Compare July 16, 2025 13:48

tixxdz mentioned this pull request Jul 16, 2025

feature: filter: add selectors to filter auid (login uid) and rest of credentials #1943

Open

2 tasks

tixxdz added 3 commits July 17, 2025 00:51

tests:selectors: add selector test fields for matchCurrentCred selector

f920331

Signed-off-by: Djalal Harouni <[email protected]>

tests:tracing test NotEqual matchCurrentCred

dba3bdf

Signed-off-by: Djalal Harouni <[email protected]>

tixxdz force-pushed the pr/tixxdz/2025-06-creds branch from 81f576b to dba3bdf Compare July 16, 2025 23:53

kkourt reviewed Jul 18, 2025

View reviewed changes


		/* Here we are at the beginning of matching credentials */

		if (flags & PF_CRED_RUID) {

tetragon: add matchCurrentCred filter to match current tasks based on their process credentials #3845

Are you sure you want to change the base?

tetragon: add matchCurrentCred filter to match current tasks based on their process credentials #3845

Conversation

tixxdz commented Jun 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changelog

Uh oh!

Uh oh!

netlify bot commented Jul 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for tetragon ready!

Uh oh!

Uh oh!

kkourt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

tixxdz commented Jul 16, 2025

Uh oh!

kkourt left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

tixxdz commented Jun 23, 2025 •

edited

Loading

netlify bot commented Jul 7, 2025 •

edited

Loading