Repository: kubernetes-sigs/security-profiles-operator
Pull request #503 (2021-06-24 12:42:51)

Allow syscall with ID 0
#### What type of PR is this?

/kind bug


#### What this PR does / why we need it:
The syscall with ID 0 is `read`, which should be allowed to trace.

#### Which issue(s) this PR fixes:

<!--
*Automatically closes linked issue when PR is merged.
Usage: `Fixes #<issue number>`, or `Fixes (paste link of issue)`.

Fixes #

or

None
-->
None
#### Does this PR have test?
None
<!--
If tests aren't applicable just write N/A.
-->

#### Special notes for your reviewer:
None
#### Does this PR introduce a user-facing change?

<!--
If no, just write "NONE" in the release-note block below.
If yes, a release note is required:
Enter your extended release note in the block below. If the PR requires additional action from users switching to the new release, include the string "action required".

For more information on release notes see: https://git.k8s.io/community/contributors/guide/release-notes.md
-->

```release-note
None
```


k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/503#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->
codecov-commenter: # [Codecov](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/503?src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) Report
> Merging [#503](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/pull/503?src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (865978b) into [master](https://codecov.io/gh/kubernetes-sigs/security-profiles-operator/commit/8a4e34d079c6a8a95de973b7d4cfe884162d9b1f?el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=None) (8a4e34d) will **increase** coverage by `0.09%`.
> The diff coverage is `n/a`.


```diff
@@            Coverage Diff             @@
##           master     #503      +/-   ##
==========================================
+ Coverage   38.21%   38.31%   +0.09%     
==========================================
  Files          23       23              
  Lines        1201     1198       -3     
==========================================
  Hits          459      459              
+ Misses        727      724       -3     
  Partials       15       15              
```

k8s-ci-robot: @saschagrunert: The following test **failed**, say `/retest` to rerun all failed tests:

Test name | Commit | Details | Rerun command
--- | --- | --- | ---
pull-security-profiles-operator-test-e2e | 865978b5a6930c11ca808f3db7767cd4361d755b | [link](https://prow.k8s.io/view/gs/kubernetes-jenkins/pr-logs/pull/kubernetes-sigs_security-profiles-operator/503/pull-security-profiles-operator-test-e2e/1408042941468905472) | `/test pull-security-profiles-operator-test-e2e`

[Full PR test history](https://prow.k8s.io/pr-history?org=kubernetes-sigs&repo=security-profiles-operator&pr=503). [Your PR dashboard](https://prow.k8s.io/pr?query=is%3Apr%20state%3Aopen%20author%3Asaschagrunert). Please help us cut down on flakes by [linking to](https://git.k8s.io/community/contributors/devel/sig-testing/flaky-tests.md#filing-issues-for-flaky-tests) an [open issue](https://github.com/kubernetes-sigs/security-profiles-operator/issues?q=is:issue+is:open) when you hit one in your PR.

<details>

Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md).  If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes/test-infra](https://github.com/kubernetes/test-infra/issues/new?title=Prow%20issue:) repository. I understand the commands that are listed [here](https://go.k8s.io/bot-commands).
</details>
<!-- test report -->
saschagrunert: /test pull-security-profiles-operator-test-e2e
k8s-ci-robot: [APPROVALNOTIFIER] This PR is **APPROVED**

This pull-request has been approved by: *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/503#pullrequestreview-691739399" title="LGTM">JAORMX</a>*, *<a href="https://github.com/kubernetes-sigs/security-profiles-operator/pull/503#" title="Author self-approved">saschagrunert</a>*

The full list of commands accepted by this bot can be found [here](https://go.k8s.io/bot-commands?repo=kubernetes-sigs%2Fsecurity-profiles-operator).

The pull request process is described [here](https://git.k8s.io/community/contributors/guide/owners.md#the-code-review-process)

<details >
Needs approval from an approver in each of these files:

- ~~[OWNERS](https://github.com/kubernetes-sigs/security-profiles-operator/blob/master/OWNERS)~~ [saschagrunert]

Approvers can indicate their approval by writing `/approve` in a comment
Approvers can cancel approval by writing `/approve cancel` in a comment
</details>
<!-- META={"approvers":[]} -->

Patch:
diff --git a/api/profilebinding/v1alpha1/profilebinding_types.go b/api/profilebinding/v1alpha1/profilebinding_types.go
index 62ef8db75..1c1a98cdc 100644
--- a/api/profilebinding/v1alpha1/profilebinding_types.go
+++ b/api/profilebinding/v1alpha1/profilebinding_types.go
@@ -20,6 +20,12 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+type ProfileBindingKind string
+
+const (
+	ProfileBindingKindSeccompProfile ProfileBindingKind = "SeccompProfile"
+)
+
 // ProfileBindingSpec defines the desired state of ProfileBinding.
 type ProfileBindingSpec struct {
 	// ProfileRef references a SeccompProfile or other profile type in the current namespace.
@@ -32,7 +38,7 @@ type ProfileBindingSpec struct {
 type ProfileRef struct {
 	// Kind of object to be bound.
 	// +kubebuilder:validation:Enum=SeccompProfile
-	Kind string `json:"kind"` // TODO(cmurphy) add SelinuxProfile
+	Kind ProfileBindingKind `json:"kind"` // TODO(cmurphy) add SelinuxProfile
 	// Name of the profile within the current namespace to which to bind the selected pods.
 	Name string `json:"name"`
 }
diff --git a/api/profilerecording/v1alpha1/profilerecording_types.go b/api/profilerecording/v1alpha1/profilerecording_types.go
index 9e9cd4abd..f908b4100 100644
--- a/api/profilerecording/v1alpha1/profilerecording_types.go
+++ b/api/profilerecording/v1alpha1/profilerecording_types.go
@@ -20,11 +20,17 @@ import (
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 )
 
+type ProfileRecordingKind string
+
+const (
+	ProfileRecordingKindSeccompProfile ProfileRecordingKind = "SeccompProfile"
+)
+
 // ProfileRecordingSpec defines the desired state of ProfileRecording.
 type ProfileRecordingSpec struct {
 	// Kind of object to be recorded.
 	// +kubebuilder:validation:Enum=SeccompProfile
-	Kind string `json:"kind"`
+	Kind ProfileRecordingKind `json:"kind"`
 
 	// PodSelector selects the pods to record. This field follows standard
 	// label selector semantics. An empty podSelector matches all pods in this
diff --git a/internal/pkg/daemon/enricher/enricher.go b/internal/pkg/daemon/enricher/enricher.go
index 22dbb4ee0..c9862699a 100644
--- a/internal/pkg/daemon/enricher/enricher.go
+++ b/internal/pkg/daemon/enricher/enricher.go
@@ -85,11 +85,6 @@ func Run(logger logr.Logger) error {
 			continue
 		}
 
-		if auditLine.SystemCallID == 0 {
-			logger.Info("Audit line SystemCallID is 0, skipping")
-			continue
-		}
-
 		cID, err := getContainerID(auditLine.ProcessID)
 		if err != nil {
 			logger.Error(err, "unable to get container ID", "processID", auditLine.ProcessID)
diff --git a/internal/pkg/webhooks/binding/binding.go b/internal/pkg/webhooks/binding/binding.go
index 6f3db0477..49093e8f2 100644
--- a/internal/pkg/webhooks/binding/binding.go
+++ b/internal/pkg/webhooks/binding/binding.go
@@ -118,7 +118,7 @@ func (p *podSeccompBinder) Handle(ctx context.Context, req admission.Request) ad
 
 	for i := range profilebindings {
 		// TODO(cmurphy): handle profiles kinds other than SeccompProfile
-		if profilebindings[i].Spec.ProfileRef.Kind != "SeccompProfile" {
+		if profilebindings[i].Spec.ProfileRef.Kind != profilebindingv1alpha1.ProfileBindingKindSeccompProfile {
 			p.log.Info(fmt.Sprintf("profile kind %s not yet supported", profilebindings[i].Spec.ProfileRef.Kind))
 			continue
 		}
diff --git a/internal/pkg/webhooks/recording/recording.go b/internal/pkg/webhooks/recording/recording.go
index fc54b4bae..60de139f3 100644
--- a/internal/pkg/webhooks/recording/recording.go
+++ b/internal/pkg/webhooks/recording/recording.go
@@ -111,7 +111,7 @@ func (p *podSeccompRecorder) Handle(
 
 	for i := range items {
 		item := items[i]
-		if item.Spec.Kind != "SeccompProfile" {
+		if item.Spec.Kind != profilerecordingv1alpha1.ProfileRecordingKindSeccompProfile {
 			p.log.Info(fmt.Sprintf(
 				"recording kind %s not supported", item.Spec.Kind,
 			))


Test patch:
diff --git a/internal/pkg/webhooks/binding/binding_test.go b/internal/pkg/webhooks/binding/binding_test.go
index 6e37e303a..6f7ef7ef6 100644
--- a/internal/pkg/webhooks/binding/binding_test.go
+++ b/internal/pkg/webhooks/binding/binding_test.go
@@ -98,7 +98,7 @@ func TestHandle(t *testing.T) {
 						{
 							Spec: v1alpha1.ProfileBindingSpec{
 								ProfileRef: v1alpha1.ProfileRef{
-									Kind: "SeccompProfile",
+									Kind: v1alpha1.ProfileBindingKindSeccompProfile,
 								},
 							},
 						},
@@ -174,7 +174,7 @@ func TestHandle(t *testing.T) {
 						{
 							Spec: v1alpha1.ProfileBindingSpec{
 								ProfileRef: v1alpha1.ProfileRef{
-									Kind: "SeccompProfile",
+									Kind: v1alpha1.ProfileBindingKindSeccompProfile,
 								},
 							},
 						},
@@ -207,7 +207,7 @@ func TestHandle(t *testing.T) {
 						{
 							Spec: v1alpha1.ProfileBindingSpec{
 								ProfileRef: v1alpha1.ProfileRef{
-									Kind: "SeccompProfile",
+									Kind: v1alpha1.ProfileBindingKindSeccompProfile,
 								},
 							},
 						},
@@ -239,7 +239,7 @@ func TestHandle(t *testing.T) {
 						{
 							Spec: v1alpha1.ProfileBindingSpec{
 								ProfileRef: v1alpha1.ProfileRef{
-									Kind: "SeccompProfile",
+									Kind: v1alpha1.ProfileBindingKindSeccompProfile,
 								},
 							},
 						},
@@ -278,7 +278,7 @@ func TestHandle(t *testing.T) {
 						{
 							Spec: v1alpha1.ProfileBindingSpec{
 								ProfileRef: v1alpha1.ProfileRef{
-									Kind: "SeccompProfile",
+									Kind: v1alpha1.ProfileBindingKindSeccompProfile,
 								},
 							},
 						},
@@ -316,7 +316,7 @@ func TestHandle(t *testing.T) {
 						{
 							Spec: v1alpha1.ProfileBindingSpec{
 								ProfileRef: v1alpha1.ProfileRef{
-									Kind: "SeccompProfile",
+									Kind: v1alpha1.ProfileBindingKindSeccompProfile,
 								},
 							},
 							Status: v1alpha1.ProfileBindingStatus{
@@ -343,7 +343,7 @@ func TestHandle(t *testing.T) {
 						{
 							Spec: v1alpha1.ProfileBindingSpec{
 								ProfileRef: v1alpha1.ProfileRef{
-									Kind: "SeccompProfile",
+									Kind: v1alpha1.ProfileBindingKindSeccompProfile,
 								},
 							},
 							Status: v1alpha1.ProfileBindingStatus{
diff --git a/internal/pkg/webhooks/recording/recording_test.go b/internal/pkg/webhooks/recording/recording_test.go
index 42770e8d3..5ae5f2c91 100644
--- a/internal/pkg/webhooks/recording/recording_test.go
+++ b/internal/pkg/webhooks/recording/recording_test.go
@@ -94,7 +94,7 @@ func TestHandle(t *testing.T) {
 					Items: []v1alpha1.ProfileRecording{
 						{
 							Spec: v1alpha1.ProfileRecordingSpec{
-								Kind: "SeccompProfile",
+								Kind: v1alpha1.ProfileRecordingKindSeccompProfile,
 							},
 						},
 					},
@@ -142,7 +142,7 @@ func TestHandle(t *testing.T) {
 					Items: []v1alpha1.ProfileRecording{
 						{
 							Spec: v1alpha1.ProfileRecordingSpec{
-								Kind: "SeccompProfile",
+								Kind: v1alpha1.ProfileRecordingKindSeccompProfile,
 							},
 						},
 					},
@@ -160,7 +160,7 @@ func TestHandle(t *testing.T) {
 					Items: []v1alpha1.ProfileRecording{
 						{
 							Spec: v1alpha1.ProfileRecordingSpec{
-								Kind: "SeccompProfile",
+								Kind: v1alpha1.ProfileRecordingKindSeccompProfile,
 							},
 						},
 					},
@@ -190,7 +190,7 @@ func TestHandle(t *testing.T) {
 					Items: []v1alpha1.ProfileRecording{
 						{
 							Spec: v1alpha1.ProfileRecordingSpec{
-								Kind: "SeccompProfile",
+								Kind: v1alpha1.ProfileRecordingKindSeccompProfile,
 							},
 						},
 					},
@@ -224,7 +224,7 @@ func TestHandle(t *testing.T) {
 					Items: []v1alpha1.ProfileRecording{
 						{
 							Spec: v1alpha1.ProfileRecordingSpec{
-								Kind: "SeccompProfile",
+								Kind: v1alpha1.ProfileRecordingKindSeccompProfile,
 							},
 							Status: v1alpha1.ProfileRecordingStatus{
 								ActiveWorkloads: []string{"1", "2", "3"},
@@ -250,7 +250,7 @@ func TestHandle(t *testing.T) {
 					Items: []v1alpha1.ProfileRecording{
 						{
 							Spec: v1alpha1.ProfileRecordingSpec{
-								Kind: "SeccompProfile",
+								Kind: v1alpha1.ProfileRecordingKindSeccompProfile,
 							},
 							Status: v1alpha1.ProfileRecordingStatus{
 								ActiveWorkloads: []string{"1", "2", "3"},