Merge pull request kubearmor#722 from kloudmax/CleanUpExitedHostPids

fix CleanUpExitedHostPids

KubeArmor/monitor/processTree.go

@@ -231,32 +231,42 @@ func (mon *SystemMonitor) DeleteActivePid(containerID string, ctx SyscallContext
 	// delete execve(at) host pid
 	if pidMap, ok := ActiveHostPidMap[containerID]; ok {
 		if node, ok := pidMap[ctx.HostPID]; ok {
-			node.Exited = true
-			node.ExitedTime = now
+			newNode := node
+			newNode.Exited = true
+			newNode.ExitedTime = now
+			pidMap[ctx.HostPID] = newNode
 		}
 	}
 }
 
 // CleanUpExitedHostPids Function
 func (mon *SystemMonitor) CleanUpExitedHostPids() {
-	for range mon.Ticker.C {
-		now := time.Now()
+	ActiveHostPidMap := *(mon.ActiveHostPidMap)
+	ActivePidMapLock := *(mon.ActivePidMapLock)
 
-		ActiveHostPidMap := *(mon.ActiveHostPidMap)
-		ActivePidMapLock := *(mon.ActivePidMapLock)
+	for {
+		now := time.Now()
 
 		ActivePidMapLock.Lock()
 
-		for _, pidMap := range ActiveHostPidMap {
+		for containerID, pidMap := range ActiveHostPidMap {
 			for pid, pidNode := range pidMap {
-				if pidNode.Exited {
-					if now.After(pidNode.ExitedTime.Add(time.Second * 5)) {
-						delete(pidMap, pid)
-					}
+				if pidNode.Exited && now.After(pidNode.ExitedTime.Add(time.Second*5)) {
+					delete(pidMap, pid)
 				}
 			}
+
+			if len(pidMap) == 0 {
+				delete(ActiveHostPidMap, containerID)
+			}
 		}
 
 		ActivePidMapLock.Unlock()
+
+		if !mon.Status {
+			break
+		}
+
+		time.Sleep(10 * time.Second)
 	}
 }

KubeArmor/monitor/systemMonitor.go

@@ -141,11 +141,9 @@ type SystemMonitor struct {
 	// lists to skip
 	UntrackedNamespaces []string
 
+	Status          bool
 	UptimeTimeStamp float64
 	HostByteOrder   binary.ByteOrder
-
-	// ticker to clean up exited pids
-	Ticker *time.Ticker
 }
 
 // NewSystemMonitor Function
@@ -169,11 +167,10 @@ func NewSystemMonitor(node *tp.Node, logger *fd.Feeder, containers *map[string]t
 
 	mon.UntrackedNamespaces = []string{"kube-system", "kubearmor"}
 
+	mon.Status = true
 	mon.UptimeTimeStamp = kl.GetUptimeTimestamp()
 	mon.HostByteOrder = bcc.GetHostByteOrder()
 
-	mon.Ticker = time.NewTicker(time.Second * 10)
-
 	return mon
 }
 
@@ -324,6 +321,8 @@ func (mon *SystemMonitor) InitBPF() error {
 
 // DestroySystemMonitor Function
 func (mon *SystemMonitor) DestroySystemMonitor() error {
+	mon.Status = false
+
 	if mon.SyscallPerfMap != nil {
 		mon.SyscallPerfMap.Stop()
 	}
@@ -336,8 +335,6 @@ func (mon *SystemMonitor) DestroySystemMonitor() error {
 		close(mon.ContextChan)
 	}
 
-	mon.Ticker.Stop()
-
 	return nil
 }