From 4a316df9feb409d580bed4a10eee3b8fba7ddc14 Mon Sep 17 00:00:00 2001 From: Ben Date: Tue, 17 Mar 2026 14:33:20 +0200 Subject: [PATCH 1/2] fix: use correct fields for iouring events The iouring event handler was accessing fields that don't exist in the iouring gadget datasource, causing a "field not found" warning on every single event (~97% of all node-agent log lines on affected nodes). Two mismatches fixed: - event_handler_factory used GetIdentifier() for the rule policy allowedProcess param, but the iouring datasource has no "identifier" field. Use GetComm() instead, matching exec/symlink/hardlink events. - GetFlags()/GetFlagsRaw() accessed "flags_raw", but the iouring gadget exposes "flags". Also, decodeOpenFlags() is for file open flags, not io_uring SQE flags. Made-with: Cursor Signed-off-by: Ben --- .../v2/event_handler_factory.go | 2 +- pkg/utils/datasource_event.go | 23 +++++++++++++++---- 2 files changed, 20 insertions(+), 5 deletions(-) diff --git a/pkg/containerwatcher/v2/event_handler_factory.go b/pkg/containerwatcher/v2/event_handler_factory.go index 4ce061e06..668a91881 100644 --- a/pkg/containerwatcher/v2/event_handler_factory.go +++ b/pkg/containerwatcher/v2/event_handler_factory.go @@ -137,7 +137,7 @@ func NewEventHandlerFactory( } case utils.IoUringEventType: if iouringEvent, ok := event.(utils.IOUring); ok { - rulePolicyReporter.ReportEvent(eventType, event, iouringEvent.GetContainerID(), iouringEvent.GetIdentifier()) + rulePolicyReporter.ReportEvent(eventType, event, iouringEvent.GetContainerID(), iouringEvent.GetComm()) } } }) diff --git a/pkg/utils/datasource_event.go b/pkg/utils/datasource_event.go index 55abaca20..88fba89a3 100644 --- a/pkg/utils/datasource_event.go +++ b/pkg/utils/datasource_event.go @@ -409,13 +409,28 @@ func (e *DatasourceEvent) GetExtra() interface{} { } func (e *DatasourceEvent) GetFlags() []string { - flags, _ := e.getFieldAccessor("flags_raw").Int32(e.Data) - return decodeOpenFlags(flags) + switch e.EventType { + case IoUringEventType: + flags, _ := e.getFieldAccessor("flags").String(e.Data) + if flags == "" { + return nil + } + return []string{flags} + default: + flags, _ := e.getFieldAccessor("flags_raw").Int32(e.Data) + return decodeOpenFlags(flags) + } } func (e *DatasourceEvent) GetFlagsRaw() uint32 { - flags, _ := e.getFieldAccessor("flags_raw").Int32(e.Data) - return uint32(flags) + switch e.EventType { + case IoUringEventType: + flags, _ := e.getFieldAccessor("flags").Uint32(e.Data) + return flags + default: + flags, _ := e.getFieldAccessor("flags_raw").Int32(e.Data) + return uint32(flags) + } } func (e *DatasourceEvent) GetFullPath() string { From a0d19b675e831f72ffbbf34703c7fe28c19148a5 Mon Sep 17 00:00:00 2001 From: Ben Date: Tue, 17 Mar 2026 15:04:36 +0200 Subject: [PATCH 2/2] fix: read iouring flags as uint32, not string The iouring gadget defines flags as __u32 in the eBPF struct. Reading it via .String() would silently fail and always return empty. Use .Uint32() and convert to string for the []string return type. Made-with: Cursor Signed-off-by: Ben --- pkg/utils/datasource_event.go | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/pkg/utils/datasource_event.go b/pkg/utils/datasource_event.go index 88fba89a3..3c5d803e7 100644 --- a/pkg/utils/datasource_event.go +++ b/pkg/utils/datasource_event.go @@ -5,6 +5,7 @@ import ( "net" "net/http" "os" + "strconv" "strings" "sync" "time" @@ -411,11 +412,11 @@ func (e *DatasourceEvent) GetExtra() interface{} { func (e *DatasourceEvent) GetFlags() []string { switch e.EventType { case IoUringEventType: - flags, _ := e.getFieldAccessor("flags").String(e.Data) - if flags == "" { + flags, _ := e.getFieldAccessor("flags").Uint32(e.Data) + if flags == 0 { return nil } - return []string{flags} + return []string{strconv.FormatUint(uint64(flags), 10)} default: flags, _ := e.getFieldAccessor("flags_raw").Int32(e.Data) return decodeOpenFlags(flags)