WIP: fix inode time field

temp commit
aquasecurity · Dec 18, 2024 · 90ddedc · 90ddedc
1 parent b218ed4
commit 90ddedc
Show file tree

Hide file tree

Showing 4 changed files with 23 additions and 6 deletions.
diff --git a/.github/workflows/pr.yaml b/.github/workflows/pr.yaml
@@ -287,7 +287,7 @@ jobs:
               ["Noble 6.10 aarch64"]="01ce0f71400b5ff38 aarch64"
               ["Noble 6.11 x86_64"]="0ce1f88aa63091921 x86_64"
               ["Noble 6.11 aarch64"]="0123508488affb578 aarch64"
-              ["Noble 6.12 x86_64"]="0f039e123e781e989 x86_64"
+              ["Noble 6.12 x86_64"]="0e38f3caba1b4234d x86_64"
               ["Noble 6.12 aarch64"]="0547f429681dc1f2a aarch64"
               # expand as needed
           )

diff --git a/pkg/ebpf/c/common/filesystem.h b/pkg/ebpf/c/common/filesystem.h
@@ -57,13 +57,24 @@ statfunc u64 get_time_nanosec_timespec(struct timespec64 *ts)
 
 statfunc u64 get_ctime_nanosec_from_inode(struct inode *inode)
 {
-    struct timespec64 ts;
-    if (bpf_core_field_exists(inode->__i_ctime)) { // Version >= 6.6
-        ts = BPF_CORE_READ(inode, __i_ctime);
-    } else {
+    struct timespec64 ts = {};
+
+    // Kernel >= 6.11
+    if (bpf_core_field_exists(inode->i_ctime_sec) && bpf_core_field_exists(inode->i_ctime_nsec)) {
+        ts.tv_sec = BPF_CORE_READ(inode, i_ctime_sec);
+        ts.tv_nsec = BPF_CORE_READ(inode, i_ctime_nsec);
+    }
+    // Kernel 6.6 - 6.10
+    else if (bpf_core_field_exists(((struct inode___older_v611 *) inode)->__i_ctime)) {
+        struct inode___older_v611 *new_inode = (void *) inode;
+        ts = BPF_CORE_READ(new_inode, __i_ctime);
+    }
+    // Kernel < 6.6
+    else {
         struct inode___older_v66 *old_inode = (void *) inode;
         ts = BPF_CORE_READ(old_inode, i_ctime);
     }
+
     return get_time_nanosec_timespec(&ts);
 }
 

diff --git a/pkg/ebpf/c/vmlinux.h b/pkg/ebpf/c/vmlinux.h
@@ -658,7 +658,8 @@ struct inode {
     umode_t i_mode;
     struct super_block *i_sb;
     long unsigned int i_ino;
-    struct timespec64 __i_ctime;
+    time64_t i_ctime_sec;
+    u32 i_ctime_nsec;
     loff_t i_size;
     struct file_operations *i_fop;
 };

diff --git a/pkg/ebpf/c/vmlinux_flavors.h b/pkg/ebpf/c/vmlinux_flavors.h
@@ -100,6 +100,11 @@ struct inode___older_v66 {
     struct timespec64 i_ctime;
 };
 
+// kernel >= v6.11 inode i_ctime field change
+struct inode___older_v611 {
+    struct timespec64 __i_ctime;
+};
+
 ///////////////////
 
 #pragma clang attribute pop