refactor(libscap): move linux metrics collection logic to scap platform

Signed-off-by: Gianmatteo Palmieri <[email protected]>

userspace/libscap/CMakeLists.txt

@@ -55,6 +55,10 @@ if (DEFINED SCAP_BPF_PROGS_TAIL_CALLED_MAX)
 	add_definitions(-DBPF_PROGS_TAIL_CALLED_MAX=${SCAP_BPF_PROGS_TAIL_CALLED_MAX})
 endif()
 
+if(NOT DEFINED SCAP_AGENT_CGROUP_MEM_PATH_ENV_VAR)
+	set(SCAP_AGENT_CGROUP_MEM_PATH_ENV_VAR "AGENT_CGROUP_MEM_PATH")
+endif()
+add_definitions(-DSCAP_AGENT_CGROUP_MEM_PATH_ENV_VAR="${SCAP_AGENT_CGROUP_MEM_PATH_ENV_VAR}")
 
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/scap_strl_config.h.in ${CMAKE_CURRENT_BINARY_DIR}/scap_strl_config.h)
 configure_file(${CMAKE_CURRENT_SOURCE_DIR}/scap_config.h.in ${CMAKE_CURRENT_BINARY_DIR}/scap_config.h)

userspace/libscap/linux/scap_linux_platform.c

@@ -30,7 +30,9 @@ limitations under the License.
 #include <sys/stat.h>
 #include <sys/utsname.h>
 #include <sys/time.h>
+#include <sys/times.h>
 #include <unistd.h>
+#include <math.h>
 
 static int32_t scap_linux_close_platform(struct scap_platform* platform)
 {
@@ -121,6 +123,246 @@ static const struct scap_platform_vtable scap_linux_platform_vtable = {
 	.free_platform = scap_linux_free_platform,
 };
 
+static void scap_linux_get_rss_vsz_pss_total_memory_and_open_fds(uint32_t *rss, uint32_t *vsz, uint32_t *pss, uint64_t *host_memory_used, uint64_t *host_open_fds)
+{
+	FILE* f;
+	char filepath[512];
+	char line[512];
+
+	/*
+	 * Get memory usage of the agent itself (referred to as calling process meaning /proc/self/)
+	*/
+
+	//  No need for scap_get_host_root since we look at the agents' own process, accessible from it's own pid namespace (if applicable)
+	f = fopen("/proc/self/status", "r");
+	if(!f)
+	{
+		return;
+	}
+
+	while(fgets(line, sizeof(line), f) != NULL)
+	{
+		if(strncmp(line, "VmSize:", 7) == 0)
+		{
+			sscanf(line, "VmSize: %" SCNu32, vsz);		/* memory size returned in kb */
+		}
+		else if(strncmp(line, "VmRSS:", 6) == 0)
+		{
+			sscanf(line, "VmRSS: %" SCNu32, rss);		/* memory size returned in kb */
+		}
+	}
+	fclose(f);
+
+	//  No need for scap_get_host_root since we look at the agents' own process, accessible from it's own pid namespace (if applicable)
+	f = fopen("/proc/self/smaps_rollup", "r");
+	if(!f)
+	{
+		return;
+	}
+
+	while(fgets(line, sizeof(line), f) != NULL)
+	{
+		if(strncmp(line, "Pss:", 4) == 0)
+		{
+			sscanf(line, "Pss: %" SCNu32, pss);		/* memory size returned in kb */
+			break;
+		}
+	}
+	fclose(f);
+
+	/*
+	 * Get total host memory usage
+	*/
+
+	// Using scap_get_host_root since we look at the memory usage of the underlying host
+	snprintf(filepath, sizeof(filepath), "%s/proc/meminfo", scap_get_host_root());
+	f = fopen(filepath, "r");
+	if(!f)
+	{
+		return;
+	}
+
+	uint64_t mem_total, mem_free, mem_buff, mem_cache = 0;
+
+	while(fgets(line, sizeof(line), f) != NULL)
+	{
+		if(strncmp(line, "MemTotal:", 9) == 0)
+		{
+			sscanf(line, "MemTotal: %" SCNu64, &mem_total);		/* memory size returned in kb */
+		}
+		else if(strncmp(line, "MemFree:", 8) == 0)
+		{
+			sscanf(line, "MemFree: %" SCNu64, &mem_free);		/* memory size returned in kb */
+		}
+		else if(strncmp(line, "Buffers:", 8) == 0)
+		{
+			sscanf(line, "Buffers: %" SCNu64, &mem_buff);		/* memory size returned in kb */
+		}
+		else if(strncmp(line, "Cached:", 7) == 0)
+		{
+			sscanf(line, "Cached: %" SCNu64, &mem_cache);		/* memory size returned in kb */
+		}
+	}
+	fclose(f);
+	*host_memory_used = mem_total - mem_free - mem_buff - mem_cache;
+
+	/*
+	 * Get total number of allocated file descriptors (not all open files!)
+	 * File descriptor is a data structure used by a program to get a handle on a file
+	*/
+
+	// Using scap_get_host_root since we look at the total open fds of the underlying host
+	snprintf(filepath, sizeof(filepath), "%s/proc/sys/fs/file-nr", scap_get_host_root());
+	f = fopen(filepath, "r");
+	if(!f)
+	{
+		return;
+	}
+	int matched_fds = fscanf(f, "%" SCNu64, host_open_fds);
+	fclose(f);
+
+	if (matched_fds != 1) {
+		return;
+	}
+}
+
+static void scap_linux_get_cpu_usage_and_total_procs(double start_time, double *cpu_usage_perc, double *host_cpu_usage_perc, uint32_t *host_procs_running)
+{
+	FILE* f;
+	char filepath[512];
+	char line[512];
+
+	struct tms time;
+	if (times (&time) == (clock_t) -1)
+	{
+		return;
+	}
+
+	/* Number of clock ticks per second, often referred to as USER_HZ / jiffies. */
+	long hz = 100;
+#ifdef _SC_CLK_TCK
+	if ((hz = sysconf(_SC_CLK_TCK)) < 0)
+	{
+		hz = 100;
+	}
+#endif
+	/* Current uptime of the host machine in seconds.
+	 * /proc/uptime offers higher precision w/ 2 decimals.
+	 */
+
+	// Using scap_get_host_root since we look at the uptime of the underlying host
+	snprintf(filepath, sizeof(filepath), "%s/proc/uptime", scap_get_host_root());
+	f = fopen(filepath, "r");
+	if(!f)
+	{
+		return;
+	}
+
+	double machine_uptime_sec = 0;
+	int matched_uptime = fscanf(f, "%lf", &machine_uptime_sec);
+	fclose(f);
+
+	if (matched_uptime != 1) {
+		return;
+	}
+
+	/*
+	 * Get CPU usage of the agent itself (referred to as calling process meaning /proc/self/)
+	*/
+
+	/* Current utime is amount of processor time in user mode of calling process. Convert to seconds. */
+	double user_sec = (double)time.tms_utime / hz;
+
+	/* Current stime is amount of time the calling process has been scheduled in kernel mode. Convert to seconds. */
+	double system_sec = (double)time.tms_stime / hz;
+
+
+	/* CPU usage as percentage is computed by dividing the time the process uses the CPU by the
+	 * currently elapsed time of the calling process. Compare to `ps` linux util. */
+	double elapsed_sec = machine_uptime_sec - start_time;
+	if (elapsed_sec > 0)
+	{
+		*cpu_usage_perc = (double)100.0 * (user_sec + system_sec) / elapsed_sec;
+		*cpu_usage_perc = round(*cpu_usage_perc * 10.0) / 10.0; // round to 1 decimal
+	}
+
+	/*
+	 * Get total host CPU usage (all CPUs) as percentage and retrieve number of procs currently running.
+	*/
+
+	// Using scap_get_host_root since we look at the total CPU usage of the underlying host
+	snprintf(filepath, sizeof(filepath), "%s/proc/stat", scap_get_host_root());
+	f = fopen(filepath, "r");
+	if(!f)
+	{
+		return;
+	}
+
+	/* Need only first 7 columns of /proc/stat cpu line */
+	uint64_t user, nice, system, idle, iowait, irq, softirq = 0;
+	while(fgets(line, sizeof(line), f) != NULL)
+	{
+		if(strncmp(line, "cpu ", 4) == 0)
+		{
+			/* Always first line in /proc/stat file, unit: jiffies */
+			sscanf(line, "cpu %" SCNu64 " %" SCNu64 " %" SCNu64 " %" SCNu64 " %" SCNu64 " %" SCNu64 " %" SCNu64, &user, &nice, &system, &idle, &iowait, &irq, &softirq);
+		}
+		else if(strncmp(line, "procs_running ", 14) == 0)
+		{
+			sscanf(line, "procs_running %" SCNu32, host_procs_running);
+			break;
+		}
+	}
+	fclose(f);
+	uint64_t sum = user + nice + system + idle + iowait + irq + softirq;
+	if (sum > 0)
+	{
+		*host_cpu_usage_perc = 100.0 - ((idle * 100.0) / sum);
+		*host_cpu_usage_perc = round(*host_cpu_usage_perc * 10.0) / 10.0; // round to 1 decimal
+	}
+}
+
+static void scap_linux_get_container_memory_used(uint64_t *container_memory_used)
+{
+	/* In Kubernetes `container_memory_working_set_bytes` is the memory measure the OOM killer uses
+	 * and values from `/sys/fs/cgroup/memory/memory.usage_in_bytes` are close enough.
+	 *
+	 * Please note that `kubectl top pod` numbers would reflect the sum of containers in a pod and
+	 * typically libs clients (e.g. Falco) pods contain sidekick containers that use memory as well.
+	 * This metric accounts only for the container with the security monitoring agent running.
+	*/
+	const char* filepath = getenv(SCAP_AGENT_CGROUP_MEM_PATH_ENV_VAR);
+	if (filepath == NULL)
+	{
+		// No need for scap_get_host_root since we look at the container pid namespace (if applicable)
+		// Known collision for VM memory usage, but this default value is configurable
+		filepath = "/sys/fs/cgroup/memory/memory.usage_in_bytes";
+	}
+
+	FILE* f = fopen(filepath, "r");
+	if(!f)
+	{
+		return;
+	}
+
+	/* memory size returned in bytes */
+	int fscanf_matched = fscanf(f, "%" SCNu64, container_memory_used);
+	if (fscanf_matched != 1)
+	{
+		*container_memory_used = 0;
+	}
+
+	fclose(f);
+
+	return;
+}
+
+struct scap_metrics_vtable scap_linux_metrics_vtable = {
+	.get_rss_vsz_pss_total_memory_and_open_fds = scap_linux_get_rss_vsz_pss_total_memory_and_open_fds,
+	.get_cpu_usage_and_total_procs = scap_linux_get_cpu_usage_and_total_procs,
+	.get_container_memory_used = scap_linux_get_container_memory_used,
+};
+
 struct scap_platform* scap_linux_alloc_platform(proc_entry_callback proc_callback, void* proc_callback_context)
 {
 	struct scap_linux_platform* platform = calloc(1, sizeof(*platform));
@@ -132,6 +374,7 @@ struct scap_platform* scap_linux_alloc_platform(proc_entry_callback proc_callbac
 
 	struct scap_platform* generic = &platform->m_generic;
 	generic->m_vtable = &scap_linux_platform_vtable;
+	generic->m_metrics_vtable = &scap_linux_metrics_vtable;
 
 	init_proclist(&generic->m_proclist, proc_callback, proc_callback_context);
 

userspace/libscap/scap_platform.c

@@ -70,6 +70,34 @@ struct scap_platform_vtable scap_generic_platform_vtable = {
 	.free_platform = scap_generic_free_platform,
 };
 
+static void scap_generic_get_rss_vsz_pss_total_memory_and_open_fds(uint32_t *rss, uint32_t *vsz, uint32_t *pss, uint64_t *host_memory_used, uint64_t *host_open_fds)
+{
+	*rss = 0;
+	*vsz = 0;
+	*pss = 0;
+	*host_memory_used = 0;
+	*host_open_fds = 0;
+}
+
+static void scap_generic_get_cpu_usage_and_total_procs(double start_time, double *cpu_usage_perc, double *host_cpu_usage_perc, uint32_t *host_procs_running)
+{
+	*cpu_usage_perc = 0;
+	*host_cpu_usage_perc = 0;
+	*host_procs_running = 0;
+}
+
+static void scap_generic_get_container_memory_used(uint64_t *container_memory_used)
+{
+	*container_memory_used = 0;
+	return;
+}
+
+struct scap_metrics_vtable scap_generic_metrics_vtable = {
+	.get_rss_vsz_pss_total_memory_and_open_fds = scap_generic_get_rss_vsz_pss_total_memory_and_open_fds,
+	.get_cpu_usage_and_total_procs = scap_generic_get_cpu_usage_and_total_procs,
+	.get_container_memory_used = scap_generic_get_container_memory_used,
+};
+
 struct scap_platform* scap_generic_alloc_platform(proc_entry_callback proc_callback, void* proc_callback_context)
 {
 	struct scap_platform* platform = calloc(1, sizeof(*platform));
@@ -80,6 +108,7 @@ struct scap_platform* scap_generic_alloc_platform(proc_entry_callback proc_callb
 	}
 
 	platform->m_vtable = &scap_generic_platform_vtable;
+	platform->m_metrics_vtable = &scap_generic_metrics_vtable;
 
 	init_proclist(&platform->m_proclist, proc_callback, proc_callback_context);
 

userspace/libscap/scap_platform_impl.h

@@ -76,6 +76,13 @@ struct scap_platform_vtable
 	void (*free_platform)(struct scap_platform* platform);
 };
 
+struct scap_metrics_vtable
+{
+	void (*get_rss_vsz_pss_total_memory_and_open_fds)(uint32_t *rss, uint32_t *vsz, uint32_t *pss, uint64_t *host_memory_used, uint64_t *host_open_fds);
+	void (*get_cpu_usage_and_total_procs)(double start_time, double *cpu_usage_perc, double *host_cpu_usage_perc, uint32_t *host_procs_running);
+	void (*get_container_memory_used)(uint64_t *container_memory_used);
+};
+
 // the parts of the platform struct shared across all implementations
 // this *must* be the first member of all implementations
 // (the pointers are cast back&forth between the two)
@@ -89,6 +96,8 @@ struct scap_platform
 	scap_agent_info m_agent_info;
 	scap_machine_info m_machine_info;
 	struct ppm_proclist_info* m_driver_procinfo;
+
+	const struct scap_metrics_vtable* m_metrics_vtable;
 };
 
 #ifdef __cplusplus

userspace/libsinsp/CMakeLists.txt

@@ -301,11 +301,6 @@ if (BUILD_LIBSINSP_EXAMPLES)
 	add_subdirectory(sinsp_debug)
 endif()
 
-if(NOT DEFINED SINSP_AGENT_CGROUP_MEM_PATH_ENV_VAR)
-	set(SINSP_AGENT_CGROUP_MEM_PATH_ENV_VAR "AGENT_CGROUP_MEM_PATH")
-endif()
-add_definitions(-DSINSP_AGENT_CGROUP_MEM_PATH_ENV_VAR="${SINSP_AGENT_CGROUP_MEM_PATH_ENV_VAR}")
-
 # Build our pkg-config "Libs:" flags. For now, loop over SINSP_PKGCONFIG_LIBRARIES. If
 # we ever start using pkg_search_module or pkg_check_modules in cmake/modules
 # we could add each module to our "Requires:" line instead. We might need to