chore: remove deprecated FD-tracking actions and related code by ariosmon · Pull Request #4718 · cilium/tetragon

ariosmon · 2026-03-02T13:10:54Z

Remove the FD-tracking infrastructure deprecated in v1.5.

Removed:

BPF: installfd()/copyfd() helpers, fdinstall_map, fd_ty enum, heap map
Go: GenericFdType, fdInstall map tracking, HasFDInstall(), fdInstallMapMaxEntries
15 FD-tracking tests; 3 skipped pending BPF investigation

Policies using type: "fd" or FD-tracking actions (FollowFD/UnfollowFD/CopyFD) now fail at load time with a clear error. argFd/argName fields trigger a deprecation warning on any action.

The fd_install hook itself is unaffected.

Fixes #4580

netlify · 2026-03-16T14:57:46Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`4aed911`
🔍 Latest deploy log	https://app.netlify.com/projects/tetragon/deploys/69bc643a1def3000089adc84
😎 Deploy Preview	https://deploy-preview-4718--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

olsajiri · 2026-03-18T15:33:13Z

bpf/process/types/basic.h

-		probe_read(&val->file[0], size + 4 /* size */ + 4 /* flags */,
-			   &e->args[nameoff]);
-
-		map_update_elem(&fdinstall_map, &key, val, BPF_ANY);


hum, so this effectively removes also fd type, no? also fdinstall_map should be removed?

@olsajiri Can I have a review again?

Remove fd_ty argument type and related ACTION_FOLLOWFD, ACTION_UNFOLLOWFD, and ACTION_COPYFD actions that were deprecated in v1.5. This includes: - Removal of fdinstall_map and associated key/value structures - Removal of installfd() and copyfd() helper functions - Removal of fd_ty handling in argument reading and filtering - Removal of heap_value structure used for fd tracking Signed-off-by: ariosmon <ariosmon@cisco.com>

Remove GenericFdType constant and fd type handling from generic types, argument parsing, and tracepoint processing. Mark ActionTypeFollowFd, ActionTypeUnfollowFd, and ActionTypeCopyFd as deprecated with protocol compatibility comments. Add explicit rejection and warnings for deprecated FD-tracking actions in ParseMatchAction. Remove fdinstall_map creation and HasFDInstall helper. Update test expectations and test policy templates to remove fd-install kprobe sections Signed-off-by: ariosmon <ariosmon@cisco.com>

Remove test cases that relied on deprecated fd-tracking functionality including FollowFD, UnfollowFD, and CopyFD actions. This includes: - testSecurity helper and TestEnforcerSecuritySigKill/TestEnforcerSecurityNotifyEnforcer tests - TestCopyFd test and associated template files - testKprobeObjectFileWriteHook and related fd_install test cases - fdinstall_map test case from kprobe_maxentries_test.go Signed-off-by: ariosmon <ariosmon@cisco.com>

mtardy

Hey thanks for trying, for commit 2 I'd suggest maybe splitting the part that are modifying existing tests, explaining the modifications, and another commit that is strictly removing the stuff (or adding the compatibility thing you added).

Also in general, I imagine you used AI given the text in the PR body and the look of the commit description of the first commit. First I think it would have been nice to learn by just doing the removal by grepping and removing manually, this is usually quite easy since the compiler will complain and you can just search for pattern/names and remove stuff. Second I think writing a PR of ~1100 words or 10k chars for removing a feature is really too much please try to be more concise, it'll be easier on the reviewer. Thank you!

mtardy · 2026-03-20T16:31:43Z

pkg/selectors/kernel.go

+	// Warn about deprecated fields regardless of action type
+	if action.ArgFd != 0 {
+		logger.GetLogger().Warn("Deprecated field has no effect: 'argFd' is ignored as of v1.5. FD-tracking actions (FollowFD/UnfollowFD/CopyFD) have been removed from Tetragon.", "field", "argFd", "action", action.Action)
+	}
+	if action.ArgName != 0 {
+		logger.GetLogger().Warn("Deprecated field has no effect: 'argName' is ignored as of v1.5. FD-tracking actions (FollowFD/UnfollowFD/CopyFD) have been removed from Tetragon.", "field", "argName", "action", action.Action)
+	}
+
+	// Reject deprecated FD-tracking actions
+	actionLower := strings.ToLower(action.Action)
+	switch actionLower {
+	case "followfd", "unfollowfd", "copyfd":
+		return fmt.Errorf("action '%s' is no longer supported as of v1.5. FD-tracking has been removed from Tetragon", action.Action)
+	}


mmh this is debatable if we want to do this, I see the point from an UX perspective but it was already deprecated for a while. But that could make sense since people can still feed old TracingPolicy and be surprised. Not sure

fine with either way, but let's put it to some function like checkDeprecates or such

mtardy · 2026-03-20T16:34:14Z

pkg/sensors/tracing/kprobe_test.go

-		t.Skip("TestCopyFd requires at least 5.3.0 version")
+		t.Skip("requires at least 5.3.0 kernel")


can we extend the test to older kernel version now then?

mtardy · 2026-03-20T16:34:36Z

pkg/sensors/tracing/kprobe_filterchange_test.go

 )

 func TestKprobeNSChanges(t *testing.T) {
+	t.Skip("matchNamespaceChanges BPF filter does not pass events - needs further investigation")


please do investigate 😃

olsajiri

thanks, left some more comments, also please remove fdinstall_map from TestMaxEntries test

olsajiri · 2026-03-22T13:45:28Z

pkg/selectors/kernel.go

+	// Warn about deprecated fields regardless of action type
+	if action.ArgFd != 0 {
+		logger.GetLogger().Warn("Deprecated field has no effect: 'argFd' is ignored as of v1.5. FD-tracking actions (FollowFD/UnfollowFD/CopyFD) have been removed from Tetragon.", "field", "argFd", "action", action.Action)
+	}
+	if action.ArgName != 0 {
+		logger.GetLogger().Warn("Deprecated field has no effect: 'argName' is ignored as of v1.5. FD-tracking actions (FollowFD/UnfollowFD/CopyFD) have been removed from Tetragon.", "field", "argName", "action", action.Action)
+	}
+
+	// Reject deprecated FD-tracking actions
+	actionLower := strings.ToLower(action.Action)
+	switch actionLower {
+	case "followfd", "unfollowfd", "copyfd":
+		return fmt.Errorf("action '%s' is no longer supported as of v1.5. FD-tracking has been removed from Tetragon", action.Action)
+	}


fine with either way, but let's put it to some function like checkDeprecates or such

olsajiri · 2026-03-22T13:48:55Z

pkg/selectors/kernel.go

 	}
+
+	// Warn about deprecated fields regardless of action type
+	if action.ArgFd != 0 {


if we keep action.ArgFd and action.ArgName it means it will still be in the docs right? https://github.com/cilium/tetragon/blob/main/docs/content/en/docs/reference/tracing-policy.md

perhaps we should just remove it, but not sure what's the best practise @kkourt

olsajiri · 2026-03-22T13:52:15Z

testdata/specs/capchanges.yaml.tmpl

+  name: "capability-changes"
 spec:
  kprobes:
-  - call: "fd_install"


this should be part of the last/test commit?

olsajiri · 2026-03-22T13:52:25Z

testdata/specs/nschanges.yaml.tmpl

+  name: "namespace-changes"
 spec:
  kprobes:
-  - call: "fd_install"


this should be part of the last/test commit?

olsajiri · 2026-03-22T13:53:55Z

pkg/sensors/tracing/kprobe_filterchange_test.go

 }

 func testKprobeCapChanges(t *testing.T, spec string, op string, value string) {
+	t.Skip("matchCapabilityChanges BPF filter does not pass events - needs further investigation")


same here ;-)

olsajiri · 2026-03-22T14:00:39Z

pkg/sensors/tracing/kprobe_test.go

-        matchActions:
-        - action: FollowFD
-          argFd: 0
-          argName: 1


I think it's too much to remove al lthe tests using follow_fd, I think we should convert it.. I think you can just remove the fd_install hook and add fd filter for sys_write .. or what's the best way to replace that, there's probably some reason/replacement why we deprecate this ;) @kkourt

ariosmon force-pushed the ariosm/pr/remove-followFD-and-friends-from-BPF_just_bpf_code branch 11 times, most recently from d63efee to 36ded74 Compare March 4, 2026 01:43

ariosmon mentioned this pull request Mar 4, 2026

remove followFD and friends from BPF #4580

Open

ariosmon force-pushed the ariosm/pr/remove-followFD-and-friends-from-BPF_just_bpf_code branch 6 times, most recently from d3a2f7d to 1d529e7 Compare March 16, 2026 14:57

ariosmon force-pushed the ariosm/pr/remove-followFD-and-friends-from-BPF_just_bpf_code branch 3 times, most recently from f6e73f1 to 6a57725 Compare March 16, 2026 21:40

ariosmon marked this pull request as ready for review March 17, 2026 22:20

ariosmon requested a review from a team as a code owner March 17, 2026 22:20

ariosmon requested a review from kevsecurity March 17, 2026 22:20

olsajiri reviewed Mar 18, 2026

View reviewed changes

mtardy self-requested a review March 18, 2026 15:39

ariosmon force-pushed the ariosm/pr/remove-followFD-and-friends-from-BPF_just_bpf_code branch 3 times, most recently from fd692b0 to 951b821 Compare March 19, 2026 16:49

ariosmon force-pushed the ariosm/pr/remove-followFD-and-friends-from-BPF_just_bpf_code branch 5 times, most recently from f11818a to c602feb Compare March 19, 2026 22:26

ariosmon force-pushed the ariosm/pr/remove-followFD-and-friends-from-BPF_just_bpf_code branch from ebb1a21 to 02e5b3b Compare March 19, 2026 22:40

ariosmon added 2 commits March 19, 2026 17:41

ariosmon requested a review from olsajiri March 19, 2026 23:37

mtardy added the release-note/minor This PR introduces a minor user-visible change label Mar 20, 2026

mtardy requested changes Mar 20, 2026

View reviewed changes

olsajiri reviewed Mar 22, 2026

View reviewed changes

		t.Skip("TestCopyFd requires at least 5.3.0 version")
		t.Skip("requires at least 5.3.0 kernel")

Conversation

ariosmon commented Mar 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

netlify bot commented Mar 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for tetragon ready!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mtardy left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

olsajiri left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

ariosmon commented Mar 2, 2026 •

edited

Loading

netlify bot commented Mar 16, 2026 •

edited

Loading