From 1a361a7a0a7d17eb91d043d9842a13f03c84ed15 Mon Sep 17 00:00:00 2001
From: We-unite <3205135446@qq.com>
Date: Thu, 15 Aug 2024 16:01:48 +0800
Subject: Fix rootfs by cgroup, clean file name, etc.

**1. about root fs**

The setns is used by a process(for example, process 12345), to enter
a namespace of another process(also, process 12000). Process 12345
opens visual file /proc/12000/ns/xxx, gets a fd, then setns(fd, nstype).
Here xxx represents for special type of namespace such as mnt/ipc.
Param nstype can be found out in manual.

In short, switching namespace uses not fileName but file descriptor,
which makes it too hard to listen to setns, because the fd info may
have been lost on the road, or it's still on road, not in db. This
would make significant error!

So, in this commit, I check /proc/pid/cgroup. Although it has nothing
to do with root filesystem, it contains docker id. Record it, and
deal with it in the filter: For each process that has pivot_root, it
records its docker id, we remember the map from docker id to rootfs;
then check all processes on the tree, if it has docker id, add the
corresponding rootfs.

**2. Exit time of pids to be zero**

Besides, I fix the exit time of pid in this commit. After merging
the same processes, sort them in ascending order, so that in each
tgid node, the main pid is always the first thread. Then, check
other pids' exit time, if is zero, assumpt that exit time is the
same as main pid, which means the process exit while the thread is
running.

**3. Wrong parent**

I fix the ppid of threads. For example, process 10 has a child
process 20, 20 has threads 20 and 23. When pid 20 is recvd, the ppid
and parentTgid in message must be 10. But then, 10 exits, and the parent
process of 20 comes to be 1, then 20 makes thread 23. When pid 23 is
recvd, the ppid and parentTgid is 1, that's totally wrong!

Also, using the sorted process array, we can easily find the main
thread, so get the real parent, and check the ppid of other threads.

**4. Clean file name**

The original file name in database may be complex(such as
"/1/2/./../3"). Clean it with go pkg "path"

**5. Next step**

TODO: Fix the netlink connector, may it usable immediately after
powering on. Then the view.
---
 filter/global.go | 25 ++++++++++++++++++++-----
 1 file changed, 20 insertions(+), 5 deletions(-)

(limited to 'filter/global.go')

diff --git a/filter/global.go b/filter/global.go
index 37af52b..bade895 100644
--- a/filter/global.go
+++ b/filter/global.go
@@ -22,6 +22,7 @@ type Process struct {
 	RootFS         string    `bson:"rootfs"`
 	Cwd            string    `bson:"cwd"`
 	Children       []int     `bson:"children"`
+	DockerId       string    `bson:"docker_id"`
 	Execve         []Exec    `bson:"execve"`
 	ExitCode       int       `bson:"exit_code"`
 	ExitSignal     int       `bson:"exit_signal"`
@@ -44,26 +45,40 @@ func (p Process) String() string {
 	for i := 0; i < len(p.Args); i++ {
 		res += fmt.Sprintf("%s ", p.Args[i])
 	}
-	res += fmt.Sprintf("\ncomm\t%s\ncwd\t%s\n", p.Comm, p.Cwd)
+	res += fmt.Sprintf("\ncomm\t%s\ncwd\t%s\nrootfs\t%s\ndocker_id\t%s\n", p.Comm, p.Cwd, p.RootFS, p.DockerId)
 	if len(p.Execve) != 0 {
-		res += fmt.Sprintf("exec:\n")
+		res += "exec:\n"
 		for i := 0; i < len(p.Execve); i++ {
 			res += fmt.Sprintf("\ttimestamp: %v\n\texecArgs:\t", p.Execve[i].Timestamp)
 			for j := 0; j < len(p.Execve[i].ExecArgs); j++ {
 				res += fmt.Sprintf("%s ", p.Execve[i].ExecArgs[j])
 			}
-			res += fmt.Sprintf("\n")
+			res += "\n"
 		}
 	}
-	res += fmt.Sprintf("children: ")
+	res += "children: "
 	for i := 0; i < len(p.Children); i++ {
 		res += fmt.Sprintf("%d ", p.Children[i])
 	}
-	res += fmt.Sprintf("\n")
+	res += "\n"
 	res += fmt.Sprintf("exit_timestamp:\t%v\nexit_code:\t%d\nexit_signal:\t%d\n", p.ExitTimestamp, p.ExitCode, p.ExitSignal)
 	return res
 }
 
+func (node tgidNode) String() string {
+	var res string
+	res += fmt.Sprintf("==============================\ntgid: %6d, size: %6d, children: ", node.Tgid, len(node.Threads))
+	for _, child := range node.ChildTgid {
+		res += fmt.Sprintf("%7d", child)
+	}
+	res += "\n"
+	for _, process := range node.Threads {
+		res += fmt.Sprintf("%v\n", process)
+	}
+	res += "\n"
+	return res
+}
+
 type File struct {
 	OpenTimestamp  time.Time   `bson:"timestamp"`
 	FileName       string      `bson:"fileName"`
-- 
cgit v1.2.3-70-g09d2