Profile Recorder: Add bpf_d_path implementation and hook mkdir, mknod, unlink.

[mhils]

What type of PR is this?

/kind feature

What this PR does / why we need it:

This PR adds a custom bpf_d_path implementation that can be used in eBPF hooks that are not allowlisted to actually use bpf_d_path. We then use this to hook mkdir, mknod, and unlink to create more comprehensive AppArmor profiles.

Which issue(s) this PR fixes:

None

Does this PR have test?

Yes

Special notes for your reviewer:

supersedes #2608

Does this PR introduce a user-facing change?

Profile recorder: Hook `mkdir`, `mknod`, and `unlink` for better AppArmor profiles

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: mhils
Once this PR has been reviewed and has the lgtm label, please assign saschagrunert for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[k8s-ci-robot]

Hi @mhils. Thanks for your PR.

I'm waiting for a kubernetes-sigs member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 41.38%. Comparing base (11d77f4) to head (c7e1b5b).
Report is 539 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2611      +/-   ##
==========================================
- Coverage   45.50%   41.38%   -4.12%     
==========================================
  Files          79      109      +30     
  Lines        7782    18239   +10457     
==========================================
+ Hits         3541     7549    +4008     
- Misses       4099    10191    +6092     
- Partials      142      499     +357     

[ccojocar]

It seems that the entire overlay filesystem is added to the profile https://github.com/kubernetes-sigs/security-profiles-operator/actions/runs/12261338471/job/34208338061?pr=2611#step:8:170.

We need to filter out all these file permissions since is not required in the apaprmor profile.

[ccojocar]

I think we need to filter out the bootstraping and init phases of the container.

As far as I know the nsenter (https://github.com/opencontainers/runc/tree/main/libcontainer/nsenter) gets executed before runc init(https://github.com/opencontainers/runc/blob/4cb480de703f78876b92f7c6ca058a99956d27d9/init.go#L11) which executes itself and then starts the container init process. I believe that we should not record the resources before container init process.

I am think maybe is possible to filter out all resource associated with runc command. There is already this filter for syscalls

security-profiles-operator/internal/pkg/daemon/bpfrecorder/bpf/recorder.bpf.c

Line 124 in 3cb35b9

if (has_filter()) {

.

[k8s-ci-robot]

PR needs rebase.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.