fixup! fixup! fixup! feat(events): add io_uring visibility

aquasecurity · Nov 8, 2023 · 14433fb · 14433fb
1 parent 7ac0b2c
commit 14433fb
Showing 1 changed file with 6 additions and 9 deletions.
diff --git a/pkg/ebpf/c/tracee.bpf.c b/pkg/ebpf/c/tracee.bpf.c
@@ -5111,12 +5111,12 @@ common_submit_io_issue_sqe(program_data_t *p, struct io_kiocb *req, u8 opcode, u
     u32 ctx_flags = BPF_CORE_READ(uring_ctx, flags);
     bool sq_thread = ctx_flags & IORING_SETUP_SQPOLL;
     struct file *file = BPF_CORE_READ(req, file);
-    if (file == NULL) {
-        // file is null in first invocation of io_issue_sqe.
-        // in the second invocation, file is valid, but context is of async worker.
-        // we take care of the context below.
-        return 0;
-    }
+    // if (file == NULL) {
+    //     // file is null in first invocation of io_issue_sqe.
+    //     // in the second invocation, file is valid, but context is of async worker.
+    //     // we take care of the context below.
+    //     return 0;
+    // }
     file_info_t file_info = get_file_info(file);
 
     u32 host_tid = p->task_info->context.host_tid;
@@ -5218,9 +5218,6 @@ int BPF_KPROBE(trace__io_submit_sqe)
         return 0;
     }
 
-    if (!should_submit(IO_ISSUE_SQE, p.event) || !should_submit(IO_WRITE, p.event))
-        return 0;
-
     struct io_kiocb___older_v55 *req = (struct io_kiocb___older_v55 *) PT_REGS_PARM2(ctx);
 
     if (!bpf_core_field_exists(req->submit)) { // Version >= v5.5