Skip to content

Theop/debug sid #49596

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
theop-dd wants to merge 7 commits into
base: main
Choose a base branch
from
Draft

Theop/debug sid #49596

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
d922ce9
new: add process.sid field to eBPF structs and Go model
loresuso Apr 20, 2026
a2ea67f
chore: regenerate code for process.sid field
loresuso Apr 20, 2026
ea0d3ca
new: resolve SID from /proc at snapshot time
loresuso Apr 20, 2026
eed171c
new: introduce setsid syscall monitoring
loresuso Apr 20, 2026
97cfa7f
new: sync SID from kernel to userspace cache
loresuso Apr 20, 2026
333ad15
test: add TestProcessSID
loresuso Apr 20, 2026
c6c3b4d
Add tail call for centos7
theop-dd Apr 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions docs/cloud-workload-security/backend_linux.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1343,6 +1343,10 @@ Workload Protection events for Linux systems have the following JSON schema:
"type": "integer",
"description": "Parent Process ID"
},
"sid": {
"type": "integer",
"description": "Session ID"
},
"tid": {
"type": "integer",
"description": "Thread ID"
Expand Down Expand Up @@ -1505,6 +1509,7 @@ Workload Protection events for Linux systems have the following JSON schema:
"additionalProperties": false,
"type": "object",
"required": [
"sid",
"fork_flags",
"uid",
"gid"
Expand All @@ -1521,6 +1526,10 @@ Workload Protection events for Linux systems have the following JSON schema:
"type": "integer",
"description": "Parent Process ID"
},
"sid": {
"type": "integer",
"description": "Session ID"
},
"tid": {
"type": "integer",
"description": "Thread ID"
Expand Down Expand Up @@ -1698,6 +1707,7 @@ Workload Protection events for Linux systems have the following JSON schema:
"additionalProperties": false,
"type": "object",
"required": [
"sid",
"fork_flags",
"uid",
"gid"
Expand Down Expand Up @@ -4554,6 +4564,10 @@ Workload Protection events for Linux systems have the following JSON schema:
"type": "integer",
"description": "Parent Process ID"
},
"sid": {
"type": "integer",
"description": "Session ID"
},
"tid": {
"type": "integer",
"description": "Thread ID"
Expand Down Expand Up @@ -4716,6 +4730,7 @@ Workload Protection events for Linux systems have the following JSON schema:
"additionalProperties": false,
"type": "object",
"required": [
"sid",
"fork_flags",
"uid",
"gid"
Expand All @@ -4729,6 +4744,7 @@ Workload Protection events for Linux systems have the following JSON schema:
| ----- | ----------- |
| `pid` | Process ID |
| `ppid` | Parent Process ID |
| `sid` | Session ID |
| `tid` | Thread ID |
| `fork_flags` | ForkFlags |
| `uid` | User ID |
Expand Down Expand Up @@ -4790,6 +4806,10 @@ Workload Protection events for Linux systems have the following JSON schema:
"type": "integer",
"description": "Parent Process ID"
},
"sid": {
"type": "integer",
"description": "Session ID"
},
"tid": {
"type": "integer",
"description": "Thread ID"
Expand Down Expand Up @@ -4967,6 +4987,7 @@ Workload Protection events for Linux systems have the following JSON schema:
"additionalProperties": false,
"type": "object",
"required": [
"sid",
"fork_flags",
"uid",
"gid"
Expand All @@ -4980,6 +5001,7 @@ Workload Protection events for Linux systems have the following JSON schema:
| ----- | ----------- |
| `pid` | Process ID |
| `ppid` | Parent Process ID |
| `sid` | Session ID |
| `tid` | Thread ID |
| `fork_flags` | ForkFlags |
| `uid` | User ID |
Expand Down
10 changes: 10 additions & 0 deletions docs/cloud-workload-security/backend_linux.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1332,6 +1332,10 @@
"type": "integer",
"description": "Parent Process ID"
},
"sid": {
"type": "integer",
"description": "Session ID"
},
"tid": {
"type": "integer",
"description": "Thread ID"
Expand Down Expand Up @@ -1494,6 +1498,7 @@
"additionalProperties": false,
"type": "object",
"required": [
"sid",
"fork_flags",
"uid",
"gid"
Expand All @@ -1510,6 +1515,10 @@
"type": "integer",
"description": "Parent Process ID"
},
"sid": {
"type": "integer",
"description": "Session ID"
},
"tid": {
"type": "integer",
"description": "Thread ID"
Expand Down Expand Up @@ -1687,6 +1696,7 @@
"additionalProperties": false,
"type": "object",
"required": [
"sid",
"fork_flags",
"uid",
"gid"
Expand Down
23 changes: 23 additions & 0 deletions docs/cloud-workload-security/linux_expressions.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -285,6 +285,7 @@ The *file.rights* attribute can now be used in addition to *file.mode*. *file.mo
| [`process.ancestors.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
| [`process.ancestors.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`process.ancestors.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`process.ancestors.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`process.ancestors.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`process.ancestors.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`process.ancestors.uid`](#common-credentials-uid-doc) | UID of the process |
Expand Down Expand Up @@ -489,6 +490,7 @@ The *file.rights* attribute can now be used in addition to *file.mode*. *file.mo
| [`process.parent.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
| [`process.parent.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`process.parent.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`process.parent.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`process.parent.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`process.parent.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`process.parent.uid`](#common-credentials-uid-doc) | UID of the process |
Expand All @@ -507,6 +509,7 @@ The *file.rights* attribute can now be used in addition to *file.mode*. *file.mo
| [`process.parent.user_session.ssh_session_id`](#common-sshsessioncontext-ssh_session_id-doc) | Unique identifier of the SSH user session on the host |
| [`process.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`process.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`process.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`process.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`process.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`process.uid`](#common-credentials-uid-doc) | UID of the process |
Expand Down Expand Up @@ -896,6 +899,7 @@ A process was executed (does not trigger on fork syscalls).
| [`exec.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
| [`exec.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`exec.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`exec.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`exec.syscall.path`](#exec-syscall-path-doc) | path argument of the syscall |
| [`exec.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`exec.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
Expand Down Expand Up @@ -1017,6 +1021,7 @@ A process was terminated
| [`exit.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
| [`exit.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`exit.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`exit.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`exit.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`exit.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`exit.uid`](#common-credentials-uid-doc) | UID of the process |
Expand Down Expand Up @@ -1483,6 +1488,7 @@ A ptrace command was executed
| [`ptrace.tracee.ancestors.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
| [`ptrace.tracee.ancestors.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`ptrace.tracee.ancestors.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`ptrace.tracee.ancestors.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`ptrace.tracee.ancestors.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`ptrace.tracee.ancestors.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`ptrace.tracee.ancestors.uid`](#common-credentials-uid-doc) | UID of the process |
Expand Down Expand Up @@ -1687,6 +1693,7 @@ A ptrace command was executed
| [`ptrace.tracee.parent.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
| [`ptrace.tracee.parent.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`ptrace.tracee.parent.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`ptrace.tracee.parent.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`ptrace.tracee.parent.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`ptrace.tracee.parent.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`ptrace.tracee.parent.uid`](#common-credentials-uid-doc) | UID of the process |
Expand All @@ -1705,6 +1712,7 @@ A ptrace command was executed
| [`ptrace.tracee.parent.user_session.ssh_session_id`](#common-sshsessioncontext-ssh_session_id-doc) | Unique identifier of the SSH user session on the host |
| [`ptrace.tracee.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`ptrace.tracee.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`ptrace.tracee.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`ptrace.tracee.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`ptrace.tracee.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`ptrace.tracee.uid`](#common-credentials-uid-doc) | UID of the process |
Expand Down Expand Up @@ -1989,6 +1997,7 @@ A setrlimit command was executed
| [`setrlimit.target.ancestors.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
| [`setrlimit.target.ancestors.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`setrlimit.target.ancestors.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`setrlimit.target.ancestors.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`setrlimit.target.ancestors.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`setrlimit.target.ancestors.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`setrlimit.target.ancestors.uid`](#common-credentials-uid-doc) | UID of the process |
Expand Down Expand Up @@ -2193,6 +2202,7 @@ A setrlimit command was executed
| [`setrlimit.target.parent.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
| [`setrlimit.target.parent.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`setrlimit.target.parent.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`setrlimit.target.parent.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`setrlimit.target.parent.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`setrlimit.target.parent.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`setrlimit.target.parent.uid`](#common-credentials-uid-doc) | UID of the process |
Expand All @@ -2211,6 +2221,7 @@ A setrlimit command was executed
| [`setrlimit.target.parent.user_session.ssh_session_id`](#common-sshsessioncontext-ssh_session_id-doc) | Unique identifier of the SSH user session on the host |
| [`setrlimit.target.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`setrlimit.target.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`setrlimit.target.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`setrlimit.target.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`setrlimit.target.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`setrlimit.target.uid`](#common-credentials-uid-doc) | UID of the process |
Expand Down Expand Up @@ -2400,6 +2411,7 @@ A signal was sent
| [`signal.target.ancestors.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
| [`signal.target.ancestors.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`signal.target.ancestors.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`signal.target.ancestors.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`signal.target.ancestors.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`signal.target.ancestors.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`signal.target.ancestors.uid`](#common-credentials-uid-doc) | UID of the process |
Expand Down Expand Up @@ -2604,6 +2616,7 @@ A signal was sent
| [`signal.target.parent.netns`](#common-pidcontext-netns-doc) | NetNS ID of the process |
| [`signal.target.parent.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`signal.target.parent.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`signal.target.parent.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`signal.target.parent.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`signal.target.parent.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`signal.target.parent.uid`](#common-credentials-uid-doc) | UID of the process |
Expand All @@ -2622,6 +2635,7 @@ A signal was sent
| [`signal.target.parent.user_session.ssh_session_id`](#common-sshsessioncontext-ssh_session_id-doc) | Unique identifier of the SSH user session on the host |
| [`signal.target.pid`](#common-pidcontext-pid-doc) | Process ID of the process (also called thread group ID) |
| [`signal.target.ppid`](#common-pidcontext-ppid-doc) | Parent process ID |
| [`signal.target.sid`](#common-pidcontext-sid-doc) | Session ID of the process |
| [`signal.target.tid`](#common-pidcontext-tid-doc) | Thread ID of the thread |
| [`signal.target.tty_name`](#common-process-tty_name-doc) | Name of the TTY associated with the process |
| [`signal.target.uid`](#common-credentials-uid-doc) | UID of the process |
Expand Down Expand Up @@ -3618,6 +3632,15 @@ Definition: Type of the user session
`exec.user_session` `exit.user_session` `process.ancestors.user_session` `process.parent.user_session` `process.user_session` `ptrace.tracee.ancestors.user_session` `ptrace.tracee.parent.user_session` `ptrace.tracee.user_session` `setrlimit.target.ancestors.user_session` `setrlimit.target.parent.user_session` `setrlimit.target.user_session` `signal.target.ancestors.user_session` `signal.target.parent.user_session` `signal.target.user_session`


### `*.sid` {#common-pidcontext-sid-doc}
Type: int

Definition: Session ID of the process

`*.sid` has 14 possible prefixes:
`exec` `exit` `process` `process.ancestors` `process.parent` `ptrace.tracee` `ptrace.tracee.ancestors` `ptrace.tracee.parent` `setrlimit.target` `setrlimit.target.ancestors` `setrlimit.target.parent` `signal.target` `signal.target.ancestors` `signal.target.parent`


### `*.size` {#common-networkcontext-size-doc}
Type: int

Expand Down
Loading
Loading