fix(proc/scan): scan all existing threads

By scanning only /proc we missed the threads of a given process. It scans all threads under a given process in /proc/pid/task. Signed-off-by: Aldo Lacuku <[email protected]>
falcosecurity · Nov 6, 2024 · 455daa6 · 455daa6
1 parent 2e570d1
commit 455daa6
Showing 1 changed file with 55 additions and 36 deletions.
diff --git a/plugins/k8smeta/src/plugin.cpp b/plugins/k8smeta/src/plugin.cpp
@@ -302,42 +302,61 @@ void my_plugin::do_initial_proc_scan()
             continue;
         }
 
-        // Example of the path: `/proc/1/cgroup`
-        proc_path = std::string(proc_root)
-                            .append("/")
-                            .append(file_name.c_str())
-                            .append("/cgroup");
-
-        std::ifstream file(proc_path);
-
-        if(file.is_open())
-        {
-            // Read the first line from the file
-            if(std::getline(file, cgroup_line))
-            {
-                std::string pod_uid =
-                        get_pod_uid_from_cgroup_string(cgroup_line);
-                if(!pod_uid.empty())
-                {
-                    m_thread_id_pod_uid_map[tid] = pod_uid;
-                    SPDLOG_TRACE("Found thread with tid '{}' and pod uid '{}'",
-                                 tid, pod_uid);
-                }
-            }
-            else
-            {
-                SPDLOG_WARN("cannot retrieve the cgroup first line for '{}'. "
-                            "Error: {}. Skip it",
-                            proc_path,
-                            file.eof() ? "Empty file" : strerror(errno));
-            }
-            file.close();
-        }
-        else
-        {
-            SPDLOG_WARN("cannot open '{}'. Error: {}. Skip it.", proc_path,
-                        strerror(errno));
-        }
+        // Now scan /proc/pid/task for threads
+        std::string task_dir = proc_root + "/" + file_name.c_str() + "/task";
+        std::filesystem::directory_iterator task_iter(task_dir);
+
+       for (const auto& task_entry : task_iter){
+           auto task_file_name = task_entry.path().filename();
+           tid = strtol(task_file_name.c_str(), NULL, 10);
+
+           if (tid == 0 || !task_entry.is_directory())
+           {
+               SPDLOG_WARN("Found task entry `{}` in process `{}` that is not a number",
+                           task_file_name.c_str(), file_name.c_str());
+               continue; // skip if not a thread id directory
+           }
+           // Example of the path: `/proc/1/task/200/cgroup`
+           proc_path = std::string(proc_root)
+                   .append("/")
+                   .append(file_name.c_str())
+                   .append("/task/")
+                   .append(task_file_name.c_str())
+                   .append("/cgroup");
+
+           std::ifstream file(proc_path);
+
+           if(file.is_open())
+           {
+               // Read the first line from the file
+               if(std::getline(file, cgroup_line))
+               {
+                   std::string pod_uid =
+                           get_pod_uid_from_cgroup_string(cgroup_line);
+                   if(!pod_uid.empty())
+                   {
+                       m_thread_id_pod_uid_map[tid] = pod_uid;
+                       SPDLOG_TRACE("Found thread with tid '{}' and pod uid '{}'",
+                                    tid, pod_uid);
+                   }
+               }
+               else
+               {
+                   SPDLOG_WARN("Cannot retrieve the cgroup first line for '{}'. "
+                               "Error: {}. Skip it",
+                               proc_path,
+                               file.eof() ? "Empty file" : strerror(errno));
+               }
+               file.close();
+           }
+           else
+           {
+               SPDLOG_WARN("Cannot open '{}'. Error: {}. Skip it.", proc_path,
+                           strerror(errno));
+           }
+       }
+        SPDLOG_DEBUG("Thread scan correctly completed for process `{}`",
+                file_name.c_str());
     }
     SPDLOG_INFO(
             "Process scan correctly completed. Found '{}' threads inside pods.",