fix(sinsp/parsers): fix open_by_handle_at dirfd / mountfd parsing

Signed-off-by: Melissa Kilby <[email protected]>
falcosecurity · Aug 7, 2024 · 3c5d125 · 3c5d125
1 parent afce13a
commit 3c5d125
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp
@@ -2732,8 +2732,8 @@ void sinsp_parser::parse_open_openat_creat_exit(sinsp_evt *evt)
 			}
 		}
 
-		// since open_by_handle_at returns an absolute path we will always start at /
-		sdir = "";
+		int64_t dirfd_mountfd = evt->get_param(1)->as<int64_t>(); // mountfd
+		sdir = parse_dirfd(evt, name, dirfd_mountfd);
 	}
 	else
 	{

diff --git a/userspace/libsinsp/test/events_file.ut.cpp b/userspace/libsinsp/test/events_file.ut.cpp
@@ -127,7 +127,7 @@ TEST_F(sinsp_with_test_input, open_by_handle_at)
 	add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_OPEN_BY_HANDLE_AT_E, 0);
 	evt = add_event_advance_ts(increasing_ts(), 1, PPME_SYSCALL_OPEN_BY_HANDLE_AT_X, 4, fd, mountfd, PPM_O_RDWR, "<NA>");
 
-	ASSERT_EQ(get_field_as_string(evt, "fd.name"), "<NA>");
+	ASSERT_EQ(get_field_as_string(evt, "fd.name"), "<UNKNOWN><NA>");
 }
 
 TEST_F(sinsp_with_test_input, path_too_long)