cleanup(scap): remove proc (re)scan from dump open path

Signed-off-by: Grzegorz Nosek <[email protected]>
falcosecurity · Nov 7, 2023 · ec188eb · ec188eb
1 parent 53f1ddd
commit ec188eb
Show file tree

Hide file tree

Showing 3 changed files with 7 additions and 66 deletions.
diff --git a/userspace/libscap/scap_savefile.c b/userspace/libscap/scap_savefile.c
@@ -1115,21 +1115,6 @@ static int32_t scap_setup_dump(scap_dumper_t* d, struct scap_platform *platform,
 	return SCAP_SUCCESS;
 }
 
-static inline int32_t scap_dump_rescan_proc(struct scap_platform* platform)
-{
-	int32_t ret = SCAP_SUCCESS;
-#ifdef __linux__
-	if(platform && platform->m_vtable && platform->m_vtable->refresh_proc_table)
-	{
-		proc_entry_callback tcb = platform->m_proclist.m_proc_callback;
-		platform->m_proclist.m_proc_callback = NULL;
-		ret = platform->m_vtable->refresh_proc_table(platform, &platform->m_proclist);
-		platform->m_proclist.m_proc_callback = tcb;
-	}
-#endif
-	return ret;
-}
-
 // fname is only used for log messages in scap_setup_dump
 static scap_dumper_t *scap_dump_open_gzfile(struct scap_platform* platform, gzFile gzfile, const char *fname, char* lasterr)
 {
@@ -1153,12 +1138,12 @@ static scap_dumper_t *scap_dump_open_gzfile(struct scap_platform* platform, gzFi
 //
 // Open a "savefile" for writing.
 //
-scap_dumper_t *scap_dump_open(struct scap_platform* platform, const char *fname, compression_mode compress, bool skip_proc_scan, char* lasterr)
+scap_dumper_t *scap_dump_open(struct scap_platform *platform, const char *fname, compression_mode compress,
+			      char *lasterr)
 {
 	gzFile f = NULL;
 	int fd = -1;
 	const char* mode;
-	scap_dumper_t* res;
 
 	switch(compress)
 	{
@@ -1205,37 +1190,14 @@ scap_dumper_t *scap_dump_open(struct scap_platform* platform, const char *fname,
 		return NULL;
 	}
 
-	//
-	// If we're dumping in live mode, refresh the process tables list
-	// so we don't lose information about processes created in the interval
-	// between opening the handle and starting the dump
-	//
-	if(!skip_proc_scan)
-	{
-		if(scap_dump_rescan_proc(platform) != SCAP_SUCCESS)
-		{
-			return NULL;
-		}
-	}
-
-	res = scap_dump_open_gzfile(platform, f, fname, lasterr);
-	//
-	// If the user doesn't need the thread table, free it
-	//
-	if(platform->m_proclist.m_proc_callback != NULL)
-	{
-		scap_proc_free_table(&platform->m_proclist);
-	}
-
-	return res;
+	return scap_dump_open_gzfile(platform, f, fname, lasterr);
 }
 
 //
 // Open a savefile for writing, using the provided fd
 scap_dumper_t* scap_dump_open_fd(struct scap_platform* platform, int fd, compression_mode compress, bool skip_proc_scan, char* lasterr)
 {
 	gzFile f = NULL;
-	scap_dumper_t* res;
 
 	switch(compress)
 	{
@@ -1257,29 +1219,7 @@ scap_dumper_t* scap_dump_open_fd(struct scap_platform* platform, int fd, compres
 		return NULL;
 	}
 
-	//
-	// If we're dumping in live mode, refresh the process tables list
-	// so we don't lose information about processes created in the interval
-	// between opening the handle and starting the dump
-	//
-	if(!skip_proc_scan)
-	{
-		if(scap_dump_rescan_proc(platform) != SCAP_SUCCESS)
-		{
-			return NULL;
-		}
-	}
-
-	res = scap_dump_open_gzfile(platform, f, "", lasterr);
-
-	//
-	// If the user doesn't need the thread table, free it
-	//
-	if(platform->m_proclist.m_proc_callback != NULL)
-	{
-		scap_proc_free_table(&platform->m_proclist);
-	}
-	return res;
+	return scap_dump_open_gzfile(platform, f, "", lasterr);
 }
 
 //

diff --git a/userspace/libscap/scap_savefile_api.h b/userspace/libscap/scap_savefile_api.h
@@ -91,7 +91,8 @@ int32_t scap_write_proclist_entry_bufs(scap_dumper_t *d, struct scap_threadinfo
 
   \return Dump handle that can be used to identify this specific dump instance.
 */
-scap_dumper_t *scap_dump_open(struct scap_platform* platform, const char *fname, compression_mode compress, bool skip_proc_scan, char* lasterr);
+scap_dumper_t *scap_dump_open(struct scap_platform *platform, const char *fname, compression_mode compress,
+			      char *lasterr);
 
 /*!
   \brief Open a trace file for writing, using the provided fd.

diff --git a/userspace/libsinsp/dumper.cpp b/userspace/libsinsp/dumper.cpp
@@ -59,7 +59,7 @@ void sinsp_dumper::open(sinsp* inspector, const std::string& filename, bool comp
 	else
 	{
 		auto compress_mode = compress ? SCAP_COMPRESSION_GZIP : SCAP_COMPRESSION_NONE;
-		m_dumper = scap_dump_open(inspector->get_scap_platform(), filename.c_str(), compress_mode, true, error);
+		m_dumper = scap_dump_open(inspector->get_scap_platform(), filename.c_str(), compress_mode, error);
 	}
 
 	if(m_dumper == nullptr)