fix container procfs root errors#5271
Merged
geyslan merged 1 commit intoaquasecurity:mainfrom May 6, 2026
Merged
Conversation
|
|
Member
|
@ethical-buddy tks for contributing. We'll be on this soon. |
geyslan
force-pushed
the
fix/getprocessfsroot-errors
branch
from
c3de4c9 to
2c950f1
Compare
Member
|
@ethical-buddy tks for contributing. I've pushed again and will see test resuls. |
Member
Do you mind signing it? |
geyslan
force-pushed
the
fix/getprocessfsroot-errors
branch
from
2c950f1 to
192ece5
Compare
Wrap ErrNotExist and ErrPermission from /proc/<pid>/root access with ErrContainerFSUnreachable inside getProcessFSRoot, so all callers can match a single sentinel to reduce log noise from transient or policy-driven access failures (dead PIDs, user namespace boundaries, non-dumpable processes). The original cause is preserved via double-%w wrapping, so callers that debug-log the error still see "permission denied" or "no such file or directory" in the message. Also switch error formatting from %v to %w throughout the path resolver to keep the error chain inspectable with errors.Is.
geyslan
force-pushed
the
fix/getprocessfsroot-errors
branch
from
192ece5 to
d1a4118
Compare
geyslan
approved these changes
May 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1. Explain what the PR does
Fixes #5234.
This change makes ContainerPathResolver.GetHostAbsPath handle expected /proc//root access
failures more gracefully in the procfs fallback path.
Today, Tracee already skips stale or inaccessible cached PIDs when resolving a mount namespace root.
The gap was the fallback path: after GetAnyProcessInNS("mnt", mountNS) returns a PID, access to /
proc//root could still legitimately fail with:
Those cases are expected during event processing:
This PR changes that behavior so those expected failures are returned as ErrContainerFSUnreachable
instead of being treated as unexpected hard errors. Unexpected filesystem errors are still preserved
and returned.
The patch also preserves the underlying fs error chain in getProcessFSRoot, which is required for co
rrect errors.Is(..., fs.ErrPermission/fs.ErrNotExist) handling, and adds focused unit tests for:
"Replace me with
make check-proutput"2. Explain how to test it
Run the focused tests:
go test ./pkg/datastores/container -run 'TestPathResolver_(GetHostAbsPath_ExpectedProcFSRootErrors|
GetHostAbsPath_UnexpectedProcFSRootError)' -count=1
What to verify:
If you want to exercise the runtime path, run Tracee with exec hash enrichment enabled and trigger
short-lived container processes. The important behavior is that transient /proc//root permission
denied / not found failures in container path resolution are treated as expected unreachable-
container cases rather than surfacing as hard resolver errors.
3. Other comments
###4. make check-pr
[2026-04-07T10:56:30.920359Z] [checkpatch.sh] [INFO] Tracee Checkpatch Script
[2026-04-07T10:56:30.924776Z] [checkpatch.sh] [INFO] Checking: HEAD
[2026-04-07T10:56:30.930741Z] [checkpatch.sh] [INFO] Comparing against: origin/main
[2026-04-07T10:56:30.941857Z] [checkpatch.sh] [INFO]
[2026-04-07T10:56:30.945734Z] [checkpatch.sh] [INFO] ==========================================
[2026-04-07T10:56:30.949514Z] [checkpatch.sh] [INFO] Dependency Check
[2026-04-07T10:56:30.953544Z] [checkpatch.sh] [INFO] ==========================================
[2026-04-07T10:56:30.958122Z] [checkpatch.sh] [INFO] Checking dependencies...
[2026-04-07T10:56:30.968601Z] [checkpatch.sh] [INFO] Adding Go bin directory to PATH: /home/suryansh/go/bin
[2026-04-07T10:56:30.981862Z] [checkpatch.sh] [INFO] Go version: go1.26
[2026-04-07T10:56:30.986259Z] [checkpatch.sh] [WARN] revive not found.
[2026-04-07T10:56:30.991212Z] [checkpatch.sh] [INFO] Install with: go install github.com/mgechev/revive@8ece20b0789c517bd3a6742db0daa4dd5928146d
[2026-04-07T10:56:30.995882Z] [checkpatch.sh] [WARN] staticcheck not found.
[2026-04-07T10:56:30.999844Z] [checkpatch.sh] [INFO] Install with: go install honnef.co/go/tools/cmd/staticcheck@5af2e5fc3b08ba46027eb48ebddeba34dc0bd02c
[2026-04-07T10:56:31.004388Z] [checkpatch.sh] [WARN] errcheck not found.
[2026-04-07T10:56:31.009256Z] [checkpatch.sh] [INFO] Install with: go install github.com/kisielk/errcheck@11c27a7ce69d583465d80d808817d22d6653ee34
[2026-04-07T10:56:31.013960Z] [checkpatch.sh] [WARN] govulncheck not found.
[2026-04-07T10:56:31.017718Z] [checkpatch.sh] [INFO] Install with: go install golang.org/x/vuln/cmd/govulncheck@d1f380186385b4f64e00313f31743df8e4b89a77
[2026-04-07T10:56:31.022070Z] [checkpatch.sh] [WARN] clang-format-12 not found.
[2026-04-07T10:56:31.026464Z] [checkpatch.sh] [INFO] Refer to your OS package manager Install via official package manager (e.g., 'sudo apt-get install clang-format-12')
[2026-04-07T10:56:31.030813Z] [checkpatch.sh] [WARN] goimports-reviser not found.
[2026-04-07T10:56:31.035181Z] [checkpatch.sh] [INFO] Install with: go install github.com/incu6us/goimports-reviser/v3@fa5587e51ba33c58734984cb41370a5b2582d5b7
[2026-04-07T10:56:31.040774Z] [checkpatch.sh] [INFO] [PASS] Dependencies check completed
[2026-04-07T10:56:31.045311Z] [checkpatch.sh] [INFO]
[2026-04-07T10:56:31.049589Z] [checkpatch.sh] [INFO] ==========================================
[2026-04-07T10:56:31.054023Z] [checkpatch.sh] [INFO] Documentation Verification
[2026-04-07T10:56:31.057837Z] [checkpatch.sh] [INFO] ==========================================
[2026-04-07T10:56:31.062265Z] [checkpatch.sh] [INFO] Verifying documentation synchronization...
[2026-04-07T10:56:31.083834Z] [verify_man_md_sync.sh] [INFO] ================================================================================
[2026-04-07T10:56:31.088391Z] [verify_man_md_sync.sh] [INFO] Comparing changes from origin/main to HEAD
[2026-04-07T10:56:31.093178Z] [verify_man_md_sync.sh] [INFO] ================================================================================
[2026-04-07T10:56:31.131223Z] [verify_man_md_sync.sh] [INFO] No changes in '.md' or '.1.md' files
[2026-04-07T10:56:31.135658Z] [verify_man_md_sync.sh] [INFO] No changes in '.1' files
[2026-04-07T10:56:31.150780Z] [verify_man_md_sync.sh] [INFO] Documentation files are consistent.
[2026-04-07T10:56:31.156240Z] [checkpatch.sh] [INFO] [PASS] Documentation Verification completed successfully
[2026-04-07T10:56:31.160455Z] [checkpatch.sh] [INFO]
[2026-04-07T10:56:31.164222Z] [checkpatch.sh] [INFO] ==========================================
[2026-04-07T10:56:31.168254Z] [checkpatch.sh] [INFO] Code Analysis
[2026-04-07T10:56:31.172673Z] [checkpatch.sh] [INFO] ==========================================
[2026-04-07T10:56:31.177142Z] [checkpatch.sh] [INFO] Verifying and analyzing code...
[2026-04-07T10:56:31.181478Z] [checkpatch.sh] [INFO] Running formatting checks...
[2026-04-07T10:56:31.291363Z] [checkpatch.sh] [ERROR] Code formatting failed
ERROR: clang-format version 22 found, but version 19 is required
Hint: Try installing clang-format-19 or ensure clang-format points to version 19
make[1]: *** [builder/Makefile.checkers:44: .check_clang-format] Error 1
[2026-04-07T10:56:31.301489Z] [checkpatch.sh] [ERROR] Code Analysis failed
make: *** [Makefile:1274: check-pr] Error 1