tetragon: harden actions a bit

[olsajiri]

when execve_map is full, create local process record in kprobe context and use it
to do the filter and execute actions

on user space side such process is tracked as 'unknown'

{
  "process_kprobe": {
    "process": {
      "binary": "unknown"
    },
    "parent": {
      "binary": "unknown"
    },
    "function_name": "__x64_sys_symlinkat",
    "args": [
      {
        "string_arg": "/tmp/passwd"
      },
      {
        "int_arg": -100
      },
      {
        "string_arg": "/tmp/link"
      }
    ],
    "action": "KPROBE_ACTION_OVERRIDE",
    "policy_name": "sys-symlink-passwd",
    "return_action": "KPROBE_ACTION_POST"
  },
  "node_name": "ubuntu-24",
  "time": "2025-01-21T10:56:52.279276243Z"
}

[mtardy]

Why do we need this? It seems it will make the size of the execve_map even larger as threads-max is often well above 32K. This will take significant space while running threads-max threads is pretty rare nop?

[olsajiri]

I tried this as mitigation for https://github.com/isovalent/security/issues/88 .. I think we need some combination of this change (with some reasonable size for execve_map) and other ways mentioned in the issue

[mtardy]

ah I see, maybe this is one of the cases where NO_PREALLOC could help so that we can dynamically size to a very large map. But I could see how this can lead to memory issues in the future. That's not an easy problem :/

[netlify]

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	6922611
🔍 Latest deploy log	https://app.netlify.com/sites/tetragon/deploys/67a0e5c46b3e55000898b260
😎 Deploy Preview	https://deploy-preview-3279--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[kkourt]

Can we have the default from the actual default value here? If we ever change it, the change should be reflected in help.