ROX-33217: Instrument inode tracking on directory being created path mkdir by JoukoVirtanen · Pull Request #465 · stackrox/fact

JoukoVirtanen · 2026-04-01T17:54:05Z

Description

Directory creation events need to be handled correctly. When a directory is created in a tracked directory its inode should be added to a hash set in kernel space. In user space an entry needs to be added into a map with the inode as the key and file path as the value.

An alternative approach can be found at #449

Checklist

Investigated and inspected CI test results
Updated documentation accordingly

Automated testing

Added unit tests
Added integration tests
Added regression tests

If any of these don't apply, please comment below.

Testing Performed

Checked metrics

$ grep path_mkdir */metrics 
test_mkdir_ignored/metrics:# HELP stackrox_fact_kernel_path_mkdir_events Events processed by the path_mkdir LSM hook.
test_mkdir_ignored/metrics:# TYPE stackrox_fact_kernel_path_mkdir_events counter
test_mkdir_ignored/metrics:stackrox_fact_kernel_path_mkdir_events_total{label="RingbufferFull"} 0
test_mkdir_ignored/metrics:stackrox_fact_kernel_path_mkdir_events_total{label="Added"} 0
test_mkdir_ignored/metrics:stackrox_fact_kernel_path_mkdir_events_total{label="Error"} 0
test_mkdir_ignored/metrics:stackrox_fact_kernel_path_mkdir_events_total{label="Ignored"} 2
test_mkdir_ignored/metrics:stackrox_fact_kernel_path_mkdir_events_total{label="Total"} 3
test_mkdir_nested/metrics:# HELP stackrox_fact_kernel_path_mkdir_events Events processed by the path_mkdir LSM hook.
test_mkdir_nested/metrics:# TYPE stackrox_fact_kernel_path_mkdir_events counter
test_mkdir_nested/metrics:stackrox_fact_kernel_path_mkdir_events_total{label="RingbufferFull"} 0
test_mkdir_nested/metrics:stackrox_fact_kernel_path_mkdir_events_total{label="Added"} 0
test_mkdir_nested/metrics:stackrox_fact_kernel_path_mkdir_events_total{label="Total"} 3
test_mkdir_nested/metrics:stackrox_fact_kernel_path_mkdir_events_total{label="Ignored"} 0
test_mkdir_nested/metrics:stackrox_fact_kernel_path_mkdir_events_total{label="Error"} 0

$ grep d_instantiate */metrics 
test_mkdir_ignored/metrics:# HELP stackrox_fact_kernel_d_instantiate_events Events processed by the d_instantiate LSM hook.
test_mkdir_ignored/metrics:# TYPE stackrox_fact_kernel_d_instantiate_events counter
test_mkdir_ignored/metrics:stackrox_fact_kernel_d_instantiate_events_total{label="Error"} 0
test_mkdir_ignored/metrics:stackrox_fact_kernel_d_instantiate_events_total{label="Added"} 2
test_mkdir_ignored/metrics:stackrox_fact_kernel_d_instantiate_events_total{label="Ignored"} 36
test_mkdir_ignored/metrics:stackrox_fact_kernel_d_instantiate_events_total{label="RingbufferFull"} 0
test_mkdir_ignored/metrics:stackrox_fact_kernel_d_instantiate_events_total{label="Total"} 37
test_mkdir_nested/metrics:# HELP stackrox_fact_kernel_d_instantiate_events Events processed by the d_instantiate LSM hook.
test_mkdir_nested/metrics:# TYPE stackrox_fact_kernel_d_instantiate_events counter
test_mkdir_nested/metrics:stackrox_fact_kernel_d_instantiate_events_total{label="RingbufferFull"} 0
test_mkdir_nested/metrics:stackrox_fact_kernel_d_instantiate_events_total{label="Added"} 6
test_mkdir_nested/metrics:stackrox_fact_kernel_d_instantiate_events_total{label="Error"} 0
test_mkdir_nested/metrics:stackrox_fact_kernel_d_instantiate_events_total{label="Total"} 115
test_mkdir_nested/metrics:stackrox_fact_kernel_d_instantiate_events_total{label="Ignored"} 112

fact-ebpf/src/bpf/main.c

Molter73 · 2026-04-02T17:07:18Z

fact-ebpf/src/bpf/main.c

+  umode_t mode = BPF_CORE_READ(inode, i_mode);
+  if (!S_ISDIR(mode)) {
+    bpf_map_delete_elem(&mkdir_context, &pid_tgid);
+    m->d_instantiate.ignored++;
+    return 0;
+  }


We should check if m->d_instantiate.ignored actually increases, I have a feeling this condition should never be met.

m->d_instantiate.ignored increases, but I don't know if it is due to this or other locations with m->d_instantiate.ignored++;.

fact-ebpf/src/bpf/main.c

fact-ebpf/src/bpf/events.h

fact-ebpf/src/bpf/maps.h

fact/src/metrics/kernel_metrics.rs

tests/test_path_mkdir.py

fact-ebpf/src/bpf/maps.h

fact/src/event/mod.rs

JoukoVirtanen · 2026-04-08T18:11:51Z

/retest

Molter73

Just a couple small comments, we should be good to merge soon.

Molter73 · 2026-04-09T12:23:45Z

fact-ebpf/src/bpf/main.c

+  if (inode == NULL) {
+    m->d_instantiate.ignored++;
+    goto cleanup;
+  }


Probably should move this check a bit higher, there is no point in getting the context if there is no inode to work upon. You can still jump to cleanup, bpf_map_delete_elem will fail if there is no context to remove from the map, but we are already silently ignoring it.

Molter73 · 2026-04-09T12:26:05Z

fact/src/event/mod.rs

    process: Process,
    file: FileData,
+    #[serde(skip)]
+    event_type: file_activity_type_t,


What is the point of this field? FileData already encodes this same information in its type, doesn't it?

Remove. I also went with your suggestion below.

Molter73 · 2026-04-09T12:32:14Z

fact/src/host_scanner.rs

-                            self.metrics.events.dropped();
-                            warn!("Failed to send event: {e}");
+                        // Skip directory creation events - we track them internally but don't send to sensor
+                        if event.event_type() != fact_ebpf::file_activity_type_t::DIR_ACTIVITY_CREATION {


Ok, I see now why you added event_type, don't do this, add a MkDir variant to FileData and let the information be encoded in the enum. You will need to add a is_mkdir() method or something of the sort, but that's is more idiomatic anyways.

tests/test_path_mkdir.py

Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>

Molter73

LGTM! Just a few small comments I would like to see addressed, but they shouldn't block merging. Thanks for the effort on this one!

fact/src/event/mod.rs

fact/src/host_scanner.rs

fact/src/event/mod.rs

Co-authored-by: Mauro Ezequiel Moltrasio <moltrasiom@hotmail.com>

JoukoVirtanen marked this pull request as ready for review April 1, 2026 23:30

JoukoVirtanen requested a review from a team as a code owner April 1, 2026 23:30

JoukoVirtanen commented Apr 1, 2026

View reviewed changes

fact-ebpf/src/bpf/main.c Show resolved Hide resolved

JoukoVirtanen mentioned this pull request Apr 1, 2026

WIP ROX-33217: Instrument inode tracking on directory being created #449

Draft

5 tasks

Molter73 reviewed Apr 2, 2026

View reviewed changes

Molter73 reviewed Apr 6, 2026

View reviewed changes

fact-ebpf/src/bpf/maps.h Outdated Show resolved Hide resolved

fact/src/event/mod.rs Outdated Show resolved Hide resolved

JoukoVirtanen force-pushed the jv-ROX-33217-instrument-inode-tracking-on-directory-being-created-path_mkdir branch from 4a6a257 to b0ef4fe Compare April 6, 2026 15:39

JoukoVirtanen requested a review from Molter73 April 8, 2026 21:57

Molter73 reviewed Apr 9, 2026

View reviewed changes

Molter73 mentioned this pull request Apr 9, 2026

cleanup: refactor submit event functions #476

Open

5 tasks

JoukoVirtanen and others added 19 commits April 9, 2026 10:13

X-Smart-Branch-Parent: main

fd0fd1c

Added integration tests

5b2167e

Instrument inode tracking on directory being created

12f602e

Only tracking directories if the parent is monitored

8406a5a

Removed some comments

03bd26e

Combined two uses of BPF_CORE_READ

b1fc6f5

Added DIR_ACTIVITY_CREATION

dbea1a7

Added permalink to linux/stat.h

d1b4136

Removing map entry in case of early return in lsm/d_instantiate

a120084

Using os.makedirs instead of os.mkdir three times

fb7ce80

Accumulate m.path_mkdir and m.d_instantiate

60f96eb

Checking pid_tgid earlier so if inode is null we still cleanup

651edd4

Not using BPF_F_NO_PREALLOC

a57baf7

Switched from BPF_MAP_TYPE_HASH to BPF_MAP_TYPE_LRU_HASH

1fa3c77

Apply suggestion from @Molter73

0d1929d

Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>

Parameterized test

e9634e5

Fixed verifier issue. Not sending directory creation events

11eba2e

make format

008b580

Improved test Event constructor

e86fa4e

JoukoVirtanen and others added 4 commits April 9, 2026 10:27

Remove is_dir_creation

fd6bcbb

Removed unneeded S_ISDIR

5f83efa

make format

b97f03e

Update tests/test_path_mkdir.py

0874869

Co-authored-by: Mauro Ezequiel Moltrasio <mmoltras@redhat.com>

JoukoVirtanen force-pushed the jv-ROX-33217-instrument-inode-tracking-on-directory-being-created-path_mkdir branch from 3fd3840 to 0874869 Compare April 9, 2026 17:45

JoukoVirtanen added 5 commits April 9, 2026 10:51

Fixes after rebase

ba14b12

Moved the check for null inode up

e4cd882

Not adding a new event type field to Event struct

34f8ff4

make format

db4645b

Empty commit

c4ef0ac

JoukoVirtanen requested a review from Molter73 April 10, 2026 04:50

Molter73 approved these changes Apr 10, 2026

View reviewed changes

fact/src/event/mod.rs Outdated Show resolved Hide resolved

fact/src/host_scanner.rs Outdated Show resolved Hide resolved

fact/src/event/mod.rs Outdated Show resolved Hide resolved

Apply suggestions from code review

616720d

Co-authored-by: Mauro Ezequiel Moltrasio <moltrasiom@hotmail.com>

Conversation

JoukoVirtanen commented Apr 1, 2026 • edited by Molter73 Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Testing Performed

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

JoukoVirtanen commented Apr 8, 2026

Uh oh!

Molter73 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Molter73 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

JoukoVirtanen commented Apr 1, 2026 •

edited by Molter73

Loading