fix(ebpf): kernel data filter combine bitmap

[rscampos]

1. Explain what the PR does

3e7df50 test(filters): kernel data filter
d66134b fix(ebpf): kernel data filter combine bitmap

3e7df50 test(filters): kernel data filter

Add two different test cases:
- test1: policy1 without in-kernel filter and policy2 with in-kernel
  filter;
- test2: policy1 with two filters (one in-kernel filter and other non
  in-kernel filter) and policy2 with in-kernel filter;

d66134b fix(ebpf): kernel data filter combine bitmap

- Issue: The final bitmap (res) only contains the enabled bit for
the policy that was matched during the kernel data filter logic.
- Solution: After completing the filter logic, combine the bitmap
for policies without filters to ensure they are correctly enabled
in the final result.

2. Explain how to test it

Start Tracee with the following two policies:

sudo ./dist/tracee -p sfo-01.yaml -p sfo-02.yaml
TIME             UID    COMM             PID     TID     RET              EVENT                     ARGS
12:18:40:780375  1000   more             442654  442654  0                security_file_open        pathname: /sys/devices/virtual/dmi/id/bios_date, flags: O_RDONLY|O_NOFOLLOW, dev: 25, inode: 1995, ctime: 1736186855386691414, syscall_pathname: /sys/class/dmi/id/bios_dat

Access the following file:

more /sys/class/dmi/id/bios_date
Mon, 21 Oct 2024 04:03:58

policies.zip

3. Other comments

A bug was identified and reported by @OriGlassman in the new kernel data filter.

1. Scenario: There are two policies with security_file_open:
   • Policy 1: Uses security_file_open without a filter.
   • Policy 2: Uses security_file_open with pathname filter (which uses in-kernel filter).
2. Problem: The final bitmap (res) only contains the enabled bit for the policy that was matched during the kernel data filter logic.
   • Example: The resulting bitmap is 10, meaning only Policy 2 is enabled.
   • However, the correct result should be 11, where Policy 1 is also enabled because it does not use a filter.
3. Root Cause:
   • In Tracee, the scope logic (match_scope_filters) works because it initializes all bits to 1 and disables them as needed throughout the code.
   • However, when dealing with the in-kernel filter, we need to use an OR operation between different types of string filters. This requires starting the bitmap with 0 and enabling bits during the filter logic.
   • Unfortunately, this approach only enables policies with in-kernel filters, omitting policies without filters (e.g., Policy 1).
4. Solution:
   After completing the filter logic, combine the bitmap for policies without filters to ensure they are correctly enabled in the final result.

[yanivagman]

LGTM

[rscampos]

/fast-forward