Skip to content

Commit

Permalink
feat(events): change log level in hooked_syscall
Browse files Browse the repository at this point in the history
When unable to locate a syscall symbol, instead of printing an error and
terminate the hook checker goroutine, be more graceful: print a
warning and skip hook check only for the specific syscall
  • Loading branch information
OriGlassman authored and randomname21 committed Oct 28, 2024
1 parent ab6344f commit eead40d
Showing 1 changed file with 8 additions and 2 deletions.
10 changes: 8 additions & 2 deletions pkg/ebpf/hooked_syscall_table.go
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@ package ebpf

import (
gocontext "context"
"fmt"
"runtime"
"strings"
"time"
Expand Down Expand Up @@ -189,8 +190,13 @@ func (t *Tracee) populateExpectedSyscallTableArray(tableMap *bpf.BPFMap) error {

kernelSymbol, err := t.kernelSymbols.GetSymbolByOwnerAndName("system", events.SyscallPrefix+syscallName)
if err != nil {
logger.Errorw("hooked_syscall: syscall symbol not found", "id", index)
return err
logger.Warnw(fmt.Sprintf("hooked_syscall: Unable to locate syscall symbol... permanently skipping hook check for syscall ID %d", index))
zero := 0
err = tableMap.Update(unsafe.Pointer(&index), unsafe.Pointer(&zero))
if err != nil {
return err
}
continue
}

var expectedAddress = kernelSymbol[0].Address
Expand Down

0 comments on commit eead40d

Please sign in to comment.