tracee
tracee copied to clipboard
[BUG] Missing existing containers mount ns in cache
Prerequisites
- [x] This affects latest released version.
- [x] This affects current development tree (origin/HEAD).
- [x] There isn't an issue describing the bug.
Select one OR another:
- [x] I'm going to create a PR to solve this (assign to yourself).
- [ ] Someone else should solve this.
Bug description
Tracee has the member pidsInMntns
which cache PIDs in each mount namespace, where the first one is the entry-point process.
Using this cache we access files inside the different mount namespaces using procfs
.
However, the cache is filled using the sched_process_exec
event alone.
As a result, it's missing mount namespaces which existed before tracee initialization (as long as no process was executed there).
This result to many errors and reduction in tracee reliability.
See #2036 for the source discussion resulted this issue.
Can be extracted from the ExistingContainer
event