Repository navigation
Conversation
kemingy
force-pushed
the
fix/pid-tree-filter-lifecycle
branch
from
September 9, 2026 00:32
417ffed to
8516ad7
Compare
Signed-off-by: Keming <kemingy94@gmail.com>
kemingy
force-pushed
the
fix/pid-tree-filter-lifecycle
branch
from
September 9, 2026 00:33
8516ad7 to
308abf9
Compare
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Lifecycle races can permanently retain or resurrect stale PIDs, allowing unrelated processes to pass the filter.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Adds host PID-tree filtering across WatchU’s eBPF probes.
Changes:
- Adds
-pid, descendant discovery, and fork/exit tracking. - Shares filtering state across all probes.
- Updates bindings, documentation, and traversal tests.
File summaries
| File | Description |
|---|---|
| README.md | Documents PID filtering. |
| cmd/main.go | Configures and distributes the filter. |
| internal/pidfilter/filter.go | Implements filter state and reconciliation. |
| internal/pidfilter/filter_test.go | Tests descendant traversal. |
| headers/pid_filter.h | Defines the shared eBPF map and helpers. |
| execve/exec.bpf.c | Tracks lifecycle events and filters exec activity. |
| execve/probe.go | Integrates lifecycle tracking. |
| execve/exec_x86_bpfel.go | Updates x86 generated bindings. |
| execve/exec_arm64_bpfel.go | Updates ARM64 generated bindings. |
| fileop/fileop.bpf.c | Filters file events. |
| fileop/probe.go | Injects the shared map. |
| fileop/fileop_x86_bpfel.go | Updates x86 generated bindings. |
| fileop/fileop_arm64_bpfel.go | Updates ARM64 generated bindings. |
| postgres/pg.bpf.c | Filters PostgreSQL events. |
| postgres/probe.go | Injects the shared map. |
| postgres/pg_x86_bpfel.go | Updates x86 generated bindings. |
| postgres/pg_arm64_bpfel.go | Updates ARM64 generated bindings. |
| stdio/stdio.bpf.c | Filters stdio events. |
| stdio/probe.go | Injects the shared map. |
| stdio/stdio_x86_bpfel.go | Updates x86 generated bindings. |
| stdio/stdio_arm64_bpfel.go | Updates ARM64 generated bindings. |
| tcpconn/tcpconn.bpf.c | Filters connection initiation. |
| tcpconn/probe.go | Injects the shared map. |
| tcpconn/tcpconn_x86_bpfel.go | Updates x86 generated bindings. |
| tcpconn/tcpconn_arm64_bpfel.go | Updates ARM64 generated bindings. |
| tls/ssl_common.h | Filters emitted TLS events. |
| tls/ssl.bpf.c | Filters OpenSSL entry probes. |
| tls/boring.bpf.c | Filters BoringSSL entry probes. |
| tls/probe.go | Propagates the filter to TLS probes. |
| tls/openssl.go | Injects the map into OpenSSL probes. |
| tls/boring.go | Injects the map into BoringSSL probes. |
| tls/ssl_x86_bpfel.go | Updates x86 generated bindings. |
| tls/ssl_arm64_bpfel.go | Updates ARM64 generated bindings. |
| tls/boring_x86_bpfel.go | Updates x86 generated bindings. |
| tls/boring_arm64_bpfel.go | Updates ARM64 generated bindings. |
Review details
Files not reviewed (12)
- execve/exec_arm64_bpfel.go: Generated file
- execve/exec_x86_bpfel.go: Generated file
- fileop/fileop_arm64_bpfel.go: Generated file
- fileop/fileop_x86_bpfel.go: Generated file
- postgres/pg_arm64_bpfel.go: Generated file
- postgres/pg_x86_bpfel.go: Generated file
- stdio/stdio_arm64_bpfel.go: Generated file
- stdio/stdio_x86_bpfel.go: Generated file
- tcpconn/tcpconn_arm64_bpfel.go: Generated file
- tcpconn/tcpconn_x86_bpfel.go: Generated file
- tls/boring_arm64_bpfel.go: Generated file
- tls/boring_x86_bpfel.go: Generated file
- Files reviewed: 23/35 changed files
- Comments generated: 5
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Signed-off-by: Keming <kemingy94@gmail.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Startup reconciliation can permanently miss newly forked descendants, and the disabled path unnecessarily allocates another 4 MiB kernel ring buffer.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Files not reviewed (12)
- execve/exec_arm64_bpfel.go: Generated file
- execve/exec_x86_bpfel.go: Generated file
- fileop/fileop_arm64_bpfel.go: Generated file
- fileop/fileop_x86_bpfel.go: Generated file
- postgres/pg_arm64_bpfel.go: Generated file
- postgres/pg_x86_bpfel.go: Generated file
- stdio/stdio_arm64_bpfel.go: Generated file
- stdio/stdio_x86_bpfel.go: Generated file
- tcpconn/tcpconn_arm64_bpfel.go: Generated file
- tcpconn/tcpconn_x86_bpfel.go: Generated file
- tls/boring_arm64_bpfel.go: Generated file
- tls/boring_x86_bpfel.go: Generated file
- Files reviewed: 23/35 changed files
- Comments generated: 2
- Review effort level: Balanced
Comment on lines
+219
to
+222
| struct { | ||
| __uint(type, BPF_MAP_TYPE_RINGBUF); | ||
| __uint(max_entries, RING_BUFFER_SIZE); | ||
| } pid_events SEC(".maps"); |
Member
Author
There was a problem hiding this comment.
Valid. Fixed in 9e4128f: lifecycle notifications and their userspace reader were removed. The generated map slot is now a one-entry array placeholder instead of a 4 MiB ring buffer, so the disabled path no longer allocates the lifecycle ring.
Signed-off-by: Keming <kemingy94@gmail.com>
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Descendant reconciliation can admit an unrelated process when a child PID is reused between /proc reads.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Files not reviewed (12)
- execve/exec_arm64_bpfel.go: Generated file
- execve/exec_x86_bpfel.go: Generated file
- fileop/fileop_arm64_bpfel.go: Generated file
- fileop/fileop_x86_bpfel.go: Generated file
- postgres/pg_arm64_bpfel.go: Generated file
- postgres/pg_x86_bpfel.go: Generated file
- stdio/stdio_arm64_bpfel.go: Generated file
- stdio/stdio_x86_bpfel.go: Generated file
- tcpconn/tcpconn_arm64_bpfel.go: Generated file
- tcpconn/tcpconn_x86_bpfel.go: Generated file
- tls/boring_arm64_bpfel.go: Generated file
- tls/boring_x86_bpfel.go: Generated file
- Files reviewed: 23/35 changed files
- Comments generated: 2
- Review effort level: Balanced
Comment on lines
+186
to
+191
| for _, childPID := range readProcessChildren(pid) { | ||
| childIdentity, ok := readProcessIdentity(childPID) | ||
| if !ok { | ||
| continue | ||
| } | ||
| if err := f.seedProcess(childPID, childIdentity, seen); err != nil { |
| return nil | ||
| } | ||
|
|
||
| func readProcessChildren(pid uint32) []uint32 { |
Signed-off-by: Keming <kemingy94@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
-pidto restrict eBPF events to a host process and its existing/future descendantsCloses #33
Validation
go test ./internal/pidfiltergolangci-lint run ./internal/pidfilter/...git diff --checkmake gen_ebpfwas attempted, but this macOS host lacksllvm-stripand a Clang BPF target; Linux CI should run the full generation/build/test workflow.