@@ -313,6 +313,8 @@ func (e *JsonEnricher) Run(ctx context.Context, runErr chan<- error) {
313313 }
314314
315315 // Capture proc/pid/(cmdLine/environ) early; these files are ephemeral on some OS (e.g., Ubuntu).
316+ logBucket .Mu .Lock ()
317+
316318 if logBucket .ProcessInfo == nil {
317319 uid , gid , err := auditsource .GetUidGid (line )
318320 if err != nil {
@@ -324,12 +326,18 @@ func (e *JsonEnricher) Run(ctx context.Context, runErr chan<- error) {
324326 auditLine .Executable , uid , gid )
325327 }
326328
329+ logBucket .Mu .Unlock ()
330+
327331 e .processEbpf (logBucket , auditLine )
328332
333+ logBucket .Mu .Lock ()
334+
329335 if logBucket .ContainerInfo == nil {
330336 logBucket .ContainerInfo = e .fetchContainerInfo (ctx , auditLine .ProcessID , nodeName )
331337 }
332338
339+ logBucket .Mu .Unlock ()
340+
333341 logBucket .SyscallIds .LoadOrStore (auditLine .SystemCallID , struct {}{})
334342
335343 if ! e .logLinesCache .Has (auditLine .ProcessID ) {
@@ -341,6 +349,9 @@ func (e *JsonEnricher) Run(ctx context.Context, runErr chan<- error) {
341349}
342350
343351func (e * JsonEnricher ) processEbpf (logBucket * types.LogBucket , auditLine * types.AuditLine ) {
352+ logBucket .Mu .Lock ()
353+ defer logBucket .Mu .Unlock ()
354+
344355 if e .bpfProcessCache != nil && logBucket .ProcessInfo != nil && logBucket .ProcessInfo .CmdLine == "" {
345356 cmdLine , errCmdLine := e .bpfProcessCache .GetCmdLine (auditLine .ProcessID )
346357 if errCmdLine == nil {
@@ -435,6 +446,10 @@ func (e *JsonEnricher) dispatchSeccompLine(
435446 return true
436447 })
437448
449+ // Acquire read lock to safely access ProcessInfo and ContainerInfo
450+ logBucket .Mu .RLock ()
451+ defer logBucket .Mu .RUnlock ()
452+
438453 var resource map [string ]string
439454
440455 if logBucket .ProcessInfo == nil {
@@ -448,10 +463,14 @@ func (e *JsonEnricher) dispatchSeccompLine(
448463 }
449464
450465 if logBucket .ContainerInfo != nil {
466+ podName := logBucket .ContainerInfo .PodName
467+ namespace := logBucket .ContainerInfo .Namespace
468+ containerName := logBucket .ContainerInfo .ContainerName
469+
451470 resource = map [string ]string {
452- "pod" : logBucket . ContainerInfo . PodName ,
453- "namespace" : logBucket . ContainerInfo . Namespace ,
454- "container" : logBucket . ContainerInfo . ContainerName ,
471+ "pod" : podName ,
472+ "namespace" : namespace ,
473+ "container" : containerName ,
455474 }
456475 }
457476
0 commit comments