feat(uprobes): add Go string parsing and inline modification by dwindsor · Pull Request #4817 · cilium/tetragon

dwindsor · 2026-03-31T18:49:07Z

Description

With the pclntab changes being merged, we now can write policies that target stripped Go binaries. The problem is, pclntab doesn't contain function signature metadata, only function location data (offset + size).

This series adds support for the go_string type and the clearGoString action to Override in TracingPolicy. It requires a fairly complicated descent into the Go ABI internals, but I think the ABI has been stable enough for a while (since 1.18) to make this safe. Basically, since we have the function start location from pclntab, we just need to be able to isolate go string parameters, which are stored as a ([word][u32]) tuple (data_ptr+len). The new Go ABI (ABIInternal) is register based, with predictable slot assignments for types that haven't changed since 1.18. We go:generate the ABI slot mapping at build time, so no hard-coding.

The following figure illustrates how Go datatypes map to register slots on Go 1.18+ (ABIInternal):

With this, we can use 7384893 (bpf: Allow uprobe program to change context registers) to add the clearGoString action to go_string parameters that contain suspicious (i.e. SQL injection, environment var leak, malicious AI prompt) strings. We don't return early here, we just make the string inert by clearing it, allowing the application to handle cleanup etc. It's difficult to return from non-LSM functions (lsm gives a lot of guarantees - locks held, refcounts guaranteed, etc).

Changelog

netlify · 2026-03-31T19:34:30Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`34d38ec`
🔍 Latest deploy log	https://app.netlify.com/projects/tetragon/deploys/6a01ee76108bde000863ca76
😎 Deploy Preview	https://deploy-preview-4817--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

dwindsor · 2026-04-01T20:54:59Z

vmtests CI failing due to a verifier error on < 6.12, will fix:

❌ pkg.sensors.tracing.TestUprobeGoStringArg

dwindsor · 2026-04-06T16:55:26Z

vmtests failing on kernels that don't have bpf_copy_from_user_str

424: (85) call unknown#233685214
invalid func unknown#233685214

Gating go_string support on the presence of bpf_copy_from_user_str.

dwindsor · 2026-04-20T18:20:28Z

Thank you for the review @olsajiri! Comments mostly all addressed, a few I have questions on.

CI should be fine, just missing a pr label. Windows CI failing, unrelated:

Looking for regex: \{\"process_exec\"\:\{\"process\"\:\{\"exec_id\"\:\".{16,30}\"\,.{0,1}\"pid\"\:5772\,.{0,1}\"uid\"\:[0-9]{0,9}\,.{0,1}\"binary\"\:\"C:\\\\Windows\\\\system32\\\\notepad.exe\"
Get-Content: D:\a\_temp\f4d56df1-39bf-46f4-8c85-7f80bf400926.ps1:39
Line |
  39 |  $jsonContent = Get-Content -Path $jsonFilePath
     |                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     | Cannot find path 'C:\Program Files\Tetragon\events.json' because it does not exist.
Error: Process completed with exit code 1.

olsajiri · 2026-04-22T15:56:19Z

-
-	err = jsonchecker.JsonTestCheck(t, checker)
-	require.NoError(t, err)
+	policytest.AllPolicyTests.DoObserverTest(t, "uprobe-go-string-arg", nil)


please squash this with the commit that adds this test

olsajiri · 2026-04-22T16:01:16Z

+			len = sizeof(data->data) - 4;
+		asm volatile("%[len] &= 0xfff;\n"
+			     : [len] "+r"(len));
+		err = probe_read_user(&data->data[4], len, (void *)ptr);


probe_read_user does not allow faults and the point of preload is that we allow faults,
I think we need to use copy_from_user_task instead

Thanks! copy_from_user_task does appear to allow faults (it runs with .might_sleep = true). Updated to use that.

olsajiri · 2026-04-22T16:02:49Z

 			}
+
+			if argType == gt.GenericGoStringType {
+				if !bpf.HasKfunc("bpf_copy_from_user_str") {


this kfunc seems unrelated to the go_string preload

Yes, this is strange because the go_string preload indeed doesn't call bpf_copy_from_user_str, yet without this, vmtests fail in CI on kernels that are missing copy_from_user_str. I haven't quite figured out why that is the case yet. See this above comment: #4817 (comment)

olsajiri · 2026-04-22T16:03:07Z

+				if symbols == 0 {
+					return errors.New("go_string type requires at least one symbol")
+				}
+				sym := spec.Symbols[0]


what if there's more symbols in the uprobe spec? I think we should fail the spec in such case

Good point. Updated to reject if the # of arguments isn't exactly 1.

olsajiri · 2026-04-22T16:25:20Z

+					return errors.New("error: can't preload more than one argument")
+				}
+				if !goABIValidated {
+					if err := f.ValidateGoABI(); err != nil {


could this be called later underIsStrippedPureGoBinary condition?

if symbols != 0 && f.IsStrippedPureGoBinary() { tbl, err := f.Pclntab() if err != nil { return nil, fmt.Errorf("failed to parse pclntab: %w", err) } -> in here

Not without the side effect of removing ABI validation on non-stripped binaries. It would be nice if this worked transparently for both cases.

olsajiri · 2026-04-22T16:32:07Z

+	case *types.Array:
+		return int(u.Len()) * intRegSlots(u.Elem())
+	}
+	return 1


curious.. looks like in here we should return 0, warn or error?

Yes, you're right. This is a leftover hack from when I was trying to get this working with non-stdlib types.

Returning error now when an unknown type is encountered. We don't want to generate a slot table that's based on guessed slot counts.

Added a unit test to explicitly test for this condition: slot generation for an unknown type.

olsajiri · 2026-04-22T16:43:57Z

+					return errors.New("parseMatchAction: clearGoString requires uprobe symbol context")
+				}
+				var err error
+				argRegs, err = k.uprobeGoStringClearRegs(action.ArgIndex)


this seems worse to me.. I can't find your previous version, but I think now this is more complicated, sorry..

how about we leave user to configure action.ClearGoString and we validate that user did not provide argsRegs and then we populate argsRegs with the needed register assignment?

That's fine, I have no strong opinion on how the action gets translated to registers, I just would rather not allow the user to populate regs whenever it can be fixed up behind the scenes. We'll find a way that works =).

Hmm, but aren't we already doing that?

We validate that they didn't provide argRegs:

if len(argRegs) > 0 { return errors.New("parseMatchAction: clearGoString cannot be combined with argRegs") }

Immediately after we populate argRegs using uprobeGoStringClearRegs. I might be missing something you were thinking about though?

yes, but I think it's better to do it in uprobe code without theuprobeGoStringClearRegs callback ... just prepare argRegs in uprobe sensor code

Ahh I see. Moved the args fixup code to expandClearGoStringActions and call that in addUprobe after elf.SafeOpenFile.

olsajiri · 2026-04-22T16:46:33Z

+
+// GoABISlotRegNames returns the ptr and len register names for a Go string at slot.
+func GoABISlotRegNames(slot int) (ptrReg, lenReg string, err error) {
+	if !archHasGoString() {


it's bit of a shortcut now, but I guess full arch split can wait when we get another arch support

Yeah other arch support will be tiny PRs compared to this.

The reason this PR is so massive is that it adds the Go ABI slot generation code and updates CRDs. I didn't want to add that in a separate PR without a user, hence we have it here in this PR with the most useful (in my opinion) type to write policies against (strings).

Map logical argument indices to physical register slots under Go's ABIInternal calling convention on amd64. Multi-slot types shift subsequent arguments into higher registers. This is needed to extract the correct argument from uprobes attached to Go functions. Signed-off-by: David Windsor <dwindsor@gmail.com>

Cover GoABISlotForArg slot resolution for representative symbols. Signed-off-by: David Windsor <dwindsor@gmail.com>

Wire the go_string generic type through BPF user preload and event configuration, and expose it in the tracing API, generic types, ELF pclntab resolution, selectors, and the uprobe sensor path. Signed-off-by: David Windsor <dwindsor@gmail.com>

Bump CRD schema and docs for the new go_string type. Signed-off-by: David Windsor <dwindsor@gmail.com>

Signed-off-by: David Windsor <dwindsor@gmail.com>

Add ClearGoString argument for Override that clears Go strings in userspace. Strings are stored as [ptr,len] tuples in Go. We only zero len here because it's possible to do atomically with a single aligned word-size write. Zeroing the ptr field would require another write which cannot be performed atomically with respect to the clearing of the len field. With len cleared to zero the header matches how the runtime treats empty results from []byte-to-string conversion: slicebytetostring returns "" when n==0 without reading ptr [1]. [1] Link: https://github.com/golang/go/blob/go1.24.0/src/runtime/string.go#L132-L137 Signed-off-by: David Windsor <dwindsor@gmail.com>

Cover ClearGoString match-action expansion into Override arg regs for representative uprobes. Signed-off-by: David Windsor <dwindsor@gmail.com>

Signed-off-by: David Windsor <dwindsor@gmail.com>

olsajiri · 2026-05-14T07:04:14Z

+}
+
+// GoABISlotRegNames returns the ptr and len register names for a Go string at slot.
+func GoABISlotRegNames(slot int) (ptrReg, lenReg string, err error) {


nit, no need for this to be global

olsajiri · 2026-05-14T07:08:19Z

 	shift = 64 - reg->size * 8;

 	val = read_reg(ctx, reg->offset, shift);
-	ty = config->arg[index];


I dont understand this change.. no nee dto move this right?

olsajiri · 2026-05-14T07:13:52Z

 	case string_type:
 		size = copy_strings(args, (char *)arg, MAX_STRING);
 		break;
+	case go_string_type: {


I think we need to add go_string_type to type_to_min_size

olsajiri · 2026-05-14T07:24:58Z

+		sel := &spec.Selectors[si]
+		for ai := range sel.MatchActions {
+			act := &sel.MatchActions[ai]
+			if !act.ClearGoString {


I think this looks better now, but should it also check there is actualy argument with go_string in the spec? otherwise the ValidateGoABI won't be called later on

olsajiri · 2026-05-14T07:32:46Z

+		err = copy_from_user_task(&data->data[4], len, (void *)ptr, task, 0);
+		if (err) {
+			*(__u32 *)data->data = 0;
+			data->status = (__u32)-err;


I think we expect (__u32) -1 as error.. anything else is interpreted as depth error during resolve (getArgStatus)

olsajiri · 2026-05-14T07:34:25Z

 static int BPF_FUNC(probe_read_user, void *dst, uint32_t size, const void *src);
 static int BPF_FUNC(probe_write_user, void *dst, const void *src, uint32_t len);
 static int BPF_FUNC(copy_from_user, void *dst, uint32_t size, const void *src);
+struct task_struct;


is this needed? I get clean build without it

olsajiri · 2026-05-14T07:35:58Z

@@ -0,0 +1,256 @@
+// SPDX-License-Identifier: Apache-2.0


this seems to break make codegen:

... go generate ./pkg/sensors/tracing/... 2026/05/14 09:35:16 write pkg/sensors/tracing/goabi_slots_gen.go: open pkg/sensors/tracing/goabi_slots_gen.go: no such file or directory exit status 1

dwindsor requested a review from a team as a code owner March 31, 2026 18:49

dwindsor requested a review from kevsecurity March 31, 2026 18:49

dwindsor force-pushed the dwindsor/clear-go-string-action branch 4 times, most recently from b6e596e to 08528fe Compare March 31, 2026 19:34

dwindsor force-pushed the dwindsor/clear-go-string-action branch 2 times, most recently from 9893e14 to 276ab1c Compare March 31, 2026 19:40

dwindsor changed the title ~~feat/uprobes: add Go string parsing and inline modification~~ feat(uprobes): add Go string parsing and inline modification Mar 31, 2026

dwindsor force-pushed the dwindsor/clear-go-string-action branch 6 times, most recently from dacb94e to 1ecce4f Compare April 1, 2026 04:06

mtardy marked this pull request as draft April 3, 2026 16:01

dwindsor force-pushed the dwindsor/clear-go-string-action branch 6 times, most recently from d3f7dfa to 39ff357 Compare April 6, 2026 16:54

dwindsor force-pushed the dwindsor/clear-go-string-action branch 5 times, most recently from f6985b1 to f20dd45 Compare April 6, 2026 17:19

dwindsor force-pushed the dwindsor/clear-go-string-action branch 2 times, most recently from 43a3f6c to 067c4e5 Compare April 20, 2026 17:25

dwindsor requested a review from olsajiri April 20, 2026 18:19

dwindsor marked this pull request as ready for review April 20, 2026 18:19

dwindsor force-pushed the dwindsor/clear-go-string-action branch from 067c4e5 to 843bfa2 Compare April 21, 2026 14:32

olsajiri reviewed Apr 22, 2026

View reviewed changes

dwindsor force-pushed the dwindsor/clear-go-string-action branch 6 times, most recently from 0775599 to 3750c07 Compare April 27, 2026 16:01

kkourt added the needs-rebase This PR needs to be rebased because it has merge conflicts. label Apr 29, 2026

dwindsor force-pushed the dwindsor/clear-go-string-action branch 4 times, most recently from d32c9e1 to a5bf1e5 Compare April 29, 2026 13:40

kkourt added the release-note/major This PR introduces major new functionality label Apr 29, 2026

dwindsor added 8 commits May 11, 2026 10:57

test(tracing): add Go ABI register slot unit tests

32d3bc7

Cover GoABISlotForArg slot resolution for representative symbols. Signed-off-by: David Windsor <dwindsor@gmail.com>

chore(k8s): regenerate CRDs/docs for go_string

6315111

Bump CRD schema and docs for the new go_string type. Signed-off-by: David Windsor <dwindsor@gmail.com>

test(tracing): add go_string arg uprobe test

e4438f0

Signed-off-by: David Windsor <dwindsor@gmail.com>

test(tracing): add TestExpandClearGoStringActions

8fe66a5

Cover ClearGoString match-action expansion into Override arg regs for representative uprobes. Signed-off-by: David Windsor <dwindsor@gmail.com>

chore(k8s): regenerate CRDs/docs for ClearGoString uprobe override

34d38ec

Signed-off-by: David Windsor <dwindsor@gmail.com>

dwindsor mentioned this pull request May 11, 2026

ci: sensors.tracing.TestKprobeMatchParentBinaries might be flaky #4751

Open

mtardy mentioned this pull request May 12, 2026

new: uprobe OverrideCall action #4990

Open

olsajiri reviewed May 14, 2026

View reviewed changes

Conversation

dwindsor commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changelog

Uh oh!

netlify Bot commented Mar 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for tetragon ready!

Uh oh!

dwindsor commented Apr 1, 2026

Uh oh!

dwindsor commented Apr 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dwindsor commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dwindsor Apr 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dwindsor Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

dwindsor commented Mar 31, 2026 •

edited

Loading

netlify Bot commented Mar 31, 2026 •

edited

Loading

dwindsor commented Apr 6, 2026 •

edited

Loading

dwindsor commented Apr 20, 2026 •

edited

Loading

dwindsor Apr 23, 2026 •

edited

Loading

dwindsor Apr 22, 2026 •

edited

Loading