Enable clone3

Originally we've excluded clone3, which wasn't present on some older
platforms. But now it's getting used by newer glibc, which means that
we're missing information about threads. It plays some visible role only
when threads are exiting, e.g. in a weird situation if a thread will do
exec, all the threads in the thread group are going to be stopped,
leaving only one running exec. This is visible in the resolved file path
for the event.

collector/CMakeLists.txt

@@ -97,6 +97,6 @@ set(SCAP_HOST_ROOT_ENV_VAR_NAME "COLLECTOR_HOST_ROOT" CACHE STRING "Host root en
 set(BUILD_LIBSCAP_MODERN_BPF ON CACHE BOOL "Enable modern bpf engine" FORCE)
 set(MODERN_BPF_DEBUG_MODE ${BPF_DEBUG_MODE} CACHE BOOL "Enable BPF debug prints" FORCE)
 
-set(MODERN_BPF_EXCLUDE_PROGS "^(openat2|ppoll|setsockopt|clone3|io_uring_setup|nanosleep)$" CACHE STRING "Set of syscalls to exclude from modern bpf engine " FORCE)
+set(MODERN_BPF_EXCLUDE_PROGS "^(openat2|ppoll|setsockopt|io_uring_setup|nanosleep)$" CACHE STRING "Set of syscalls to exclude from modern bpf engine " FORCE)
 
 add_subdirectory(${FALCO_DIR} falco)

collector/lib/CollectorConfig.h

@@ -35,6 +35,7 @@ class CollectorConfig {
       "accept4",
       "chdir",
       "clone",
+      "clone3",
       "close",
       "connect",
       "execve",

integration-tests/container/QA_TAG

@@ -1 +1 @@
-2.0.0
+2.0.1

integration-tests/container/thread_exec/Dockerfile

@@ -0,0 +1,8 @@
+FROM ubuntu:jammy
+
+COPY thread_exec.c /thread_exec.c
+
+RUN apt update -y && apt install gcc -y && \
+    gcc -lpthread thread_exec.c -o thread_exec
+
+ENTRYPOINT /thread_exec

integration-tests/container/thread_exec/Makefile

@@ -0,0 +1,24 @@
+BASE_PAT = .
+include ../Makefile-constants.mk
+
+.DEFAULT_GOAL = all
+
+COLLECTOR_QA_THREAD_EXEC := collector-thread-exec
+
+ifneq ($(COLLECTOR_QA_TAG),)
+COLLECTOR_QA_THREAD_EXEC=collector-thread-exec-$(COLLECTOR_QA_TAG)
+endif
+
+.PHONY: all
+all: build
+
+.PHONY: build
+build:
+	@docker buildx build --load --platform $(PLATFORM) \
+                -t quay.io/rhacs-eng/qa-multi-arch:$(COLLECTOR_QA_THREAD_EXEC) .
+
+.PHONY: build-and-push
+build-and-push:
+	@docker buildx build --push --platform $(PLATFORM) \
+		-t quay.io/rhacs-eng/qa-multi-arch:$(COLLECTOR_QA_THREAD_EXEC) .
+

integration-tests/container/thread_exec/thread_exec.c

@@ -0,0 +1,29 @@
+#include <pthread.h>
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+
+/*
+ * Spawn a thread, then exec an arbitrary binary from it. Depending on glibc
+ * version, this will produce clone + exec or clone3 + exec. Exec from a thread
+ * will tear down any other threads and reassign the thread group leader pid to
+ * this thread (it's nicely explained in "map ptrace", section "execve(2) under
+ * ptrace". This should cause threads cleanup logic in Falco, and produce
+ * visible effect: the recorder process should have "thread_exec" file path,
+ * rather than ls (coreutils).
+ */
+
+void* threadTest(void* vargp) {
+  sleep(5);
+  char* argument_list[] = {"/bin/ls", NULL};
+  execvp(*argument_list, argument_list);
+  return NULL;
+}
+
+int main() {
+  pthread_t thread_id;
+  pthread_create(&thread_id, NULL, threadTest, NULL);
+  while (1) {
+  };
+  exit(0);
+}

integration-tests/images.yml

@@ -14,6 +14,7 @@ qa:
   qa-alpine-curl: quay.io/rhacs-eng/qa-multi-arch:alpine-curl
   qa-perf-event-open: quay.io/rhacs-eng/qa-multi-arch:collector-perf-event-open
   qa-udp: quay.io/rhacs-eng/qa-multi-arch:udp
+  qa-thread-exec: quay.io/rhacs-eng/qa-multi-arch:collector-thread-exec
 
 non_qa:
   nginx: nginx:1.14-alpine

integration-tests/integration_test.go

@@ -529,3 +529,7 @@ func TestUdpNetworkFlow(t *testing.T) {
 	}
 	suite.Run(t, new(suites.UdpNetworkFlow))
 }
+
+func TestThreads(t *testing.T) {
+	suite.Run(t, new(suites.ThreadsTestSuite))
+}

integration-tests/suites/threads.go

@@ -0,0 +1,62 @@
+package suites
+
+import (
+	"fmt"
+	"time"
+
+	"github.com/stackrox/collector/integration-tests/pkg/config"
+	"github.com/stackrox/collector/integration-tests/pkg/types"
+	"github.com/stretchr/testify/assert"
+)
+
+type ThreadsTestSuite struct {
+	IntegrationTestSuiteBase
+}
+
+func (s *ThreadsTestSuite) SetupSuite() {
+	s.RegisterCleanup("thread-exec")
+	s.StartCollector(false, nil)
+}
+
+func (s *ThreadsTestSuite) TearDownSuite() {
+	s.StopCollector()
+	s.cleanupContainers("thread-exec")
+}
+
+// Verify that Collector correctly traces threads, even if created via clone3.
+// This should lead to a correct file path, when doing exec from a thread --
+// instead of an exec target we should see the parent file path.
+func (s *ThreadsTestSuite) TestThreadExec() {
+	image := config.Images().QaImageByKey("qa-thread-exec")
+	containerID, err := s.Executor().StartContainer(
+		config.ContainerStartConfig{
+			Name:  "thread-exec",
+			Image: image,
+		})
+	s.Require().NoError(err)
+
+	if finished, _ := s.waitForContainerToExit("thread-exec", containerID, 10*time.Second, 0); finished {
+		expectedProcesses := []types.ProcessInfo{
+			types.ProcessInfo{
+				Name:    "thread_exec",
+				ExePath: "/thread_exec",
+				Uid:     0,
+				Gid:     0,
+				Args:    "",
+			},
+		}
+
+		s.Sensor().ExpectProcesses(s.T(), containerID, 10*time.Second,
+			expectedProcesses...)
+
+		logs, err := s.containerLogs("perf-event-open")
+		if err != nil {
+			fmt.Println(logs)
+		}
+
+	} else {
+		assert.FailNow(s.T(), "Timeout waiting for thread-exec")
+	}
+
+	s.cleanupContainers(containerID)
+}