[Auditbeat] Socket: Support maxactive in kretprobes

[adriansr]

Kretprobes (kprobes that fire on function return) have one parameter called maxactive:

maxactive - The maximum number of instances of the probed function
that can be active concurrently. For example, if the function is non-
recursive and is called with a spinlock or mutex held, maxactive = 1
should be enough. If the function is non-recursive and can never
relinquish the CPU (e.g., via a semaphore or preemption), NR_CPUS should
be enough. maxactive is used to determine how many kretprobe_instance
objects to allocate for this particular probed function. If maxactive
<= 0, it is set to a default value (if CONFIG_PREEMPT
maxactive=max(10, 2 * NR_CPUS) else maxactive=NR_CPUS)

Originally this parameter was only available to kprobes set by the kernel. Starting in Linux v4.12+, it is exposed in the kprobe_events file (commit).

The socket dataset is not aware of this parameter, so it's using the default value for it. As a side effect of this value being exposed in kprobe_events, Auditbeat is unable to uninstall it's own kretprobes, because it's expecting the entries to start with r: while they are rNN: where NN is the maxactive value.

We should:

• Set a value different to the default where it makes sense.
• Update the kprobe-listing code to take the maxactive parameter into account. (x-pack/auditbeat/tracing: fix regexp for kprobe description line #28609)

[elasticmachine]

Pinging @elastic/siem (Team:SIEM)

[botelastic]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[botelastic]

Hi!
We just realized that we haven't looked into this issue in a while. We're sorry!

We're labeling this issue as Stale to make it hit our filters and make sure we get back to it as soon as possible. In the meantime, it'd be extremely helpful if you could take a look at it as well and confirm its relevance. A simple comment with a nice emoji will be enough :+1.
Thank you for your contribution!