Permission field in file argument doesn't have file type letter in Tetragon 1.4.0

[oyashiro-chama]

What happened?

Hello! In Tetragon 1.3.0 and below we use file type letter in permission field of file argument to detect some suspicious behavior in one of ours policy (do_dup2 intercept):

apiVersion: cilium.io/v1alpha1
kind: TracingPolicy
metadata:
  name: "dup"
spec:
  kprobes:
  - call: "do_dup2"
    syscall: false
    return: true
    args:
    - index: 1
      type: "file"
    - index: 2
      type: "int"
      label: "fd"
    returnArg:
      index: 0
      type: "int"
    selectors:
    - matchArgs:
      - index: 2
        operator: "Equal"
        values:
        - "0" # stdin

As result we have required letter in event (some data omitted):

"args":[
   {
      "file_arg":{
         "permission":"srwxrwxrwx"
      }
   },
   {
      "int_arg":0,
      "label":"fd"
   }
]

In Tetragon 1.4.0 this letter is gone (some data omitted):

"args":[
   {
      "file_arg":{
         "permission":"-wxrwxrwx"
      }
   },
   {
      "int_arg":0,
      "label":"fd"
   }
]

Above-mentioned file is socket so we can distinguish one only from file letter in permission field. Looks like a bug.

Tetragon Version

1.4.0

Kernel Version

Linux syft 6.1.0-31-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.128-1 (2025-02-07) x86_64 GNU/Linux

Kubernetes Version

No kubernetes installed.

Bugtool

No response

Relevant log output

Anything else?

No response

[mtardy]

Thanks for opening this report, I see that this feature was added by #2222. Maybe @Jianlin-lv or @tpapagian could take a look at this and see what changed?

I imagine the step to replicate this is to hook into some file manipulation operation and target a socket with tetragon v1.3 and v1.4 to see the difference.

[olsajiri]

I think I fixed something related ad5c2b0, I don't see it in 1.3, I'll check the backport

edit: nah, it's already in 1.3.. will check ;-)

[kkourt]

Just for my understanding, is your expectation that for a socket there will be an s in the permissions field?
Because that does not sound right to me.

[kkourt]

Just for my understanding, is your expectation that for a socket there will be an s in the permissions field? Because that does not sound right to me.

But seems to be the case anyhow:

tetragon/pkg/reader/path/path.go

Line 65 in c3243d0

func FilePathModeToStr(mode uint16) string {

So I guess the field is actually "mode" rather than "permissions".

[oyashiro-chama]

Yeah, maybe more correct name for this field is mode, but in event it's called "permission". I make some more tests with other function (security_file_permission) and got strange results. In Tetragon 1.3.0 event has expected value:

"args":[
   {
      "file_arg":{
         "path":"/etc/shadow",
         "permission":"-rw-r-----"
      }
   },
   {
      "int_arg":4
   }
]

But in Tetragon 1.4.0 same policy generate events like this:

"args":[
   {
      "file_arg":{
         "path":"/etc/shadow",
         "permission":"b-wSr-S---"
      }
   },
   {
      "int_arg":4
   }
]

"args":[
   {
      "file_arg":{
         "path":"/etc/shadow",
         "permission":"-w-r----T"
      }
   },
   {
      "int_arg":4
   }
]

It's different VMs and one of them have Kubernetes (1.4.0 one), but /etc/shadow permissions same (640). They should be same in terms of event fields. Maybe I'll do some more tests with other policies.

[mtardy]

So you need patch ad5c2b0 that has already been backported to the v1.4 branch on April 15th (in the form of a5f39c9). So you can solve your situation with this:

• Wait for a new patch release on v1.4 containing that patch (I'll see if we could just cut a new patch release for you)
• Use a CI image of tetragon containing that patch, with upstream ad5c2b0 (or like latest on main, even if that will include a lot of others patches)
• Build yourself images from a5f39c9

The thing I don't fully get is that the fix is not present in v1.3.0 either 🤔 it was merged in v1.3 after v1.3.0 was cut. So I imagine something broke this between v1.3.0 and v1.4.0 that needed the a5f39c9 backport (not sure it's worth investigating). So the conclusion is that the patch is needed for this to work on v1.4, but on v1.3 it seems fine.

[mtardy]

fyi I'm releasing v1.4.1 so that you have a fixed patched version :) #3892

[mtardy]

Please try https://github.com/cilium/tetragon/releases/tag/v1.4.1, it should be fixing your problem! Closing this!