fix(tracers): pick the iouring_new gadget on kernel 7.x

[AlonLiwsky]

Summary

IoUringTracer.Start chose the gadget with major >= SupportedMajor && minor >= SupportedMinor (6 and 4). That compares the minor version alone, so kernels 7.0 to 7.3 get iouring_old. Its io_uring_submit_sqe tracepoint does not exist there, so the gadget fails to attach and io_uring events are lost on those nodes. I hit it on GitHub's ubuntu-24.04-arm runner, which now boots 7.0.0-1017-azure: "open /sys/kernel/tracing/events/io_uring/io_uring_submit_sqe/id: no such file or directory".

The check now compares the version as a whole: major > 6 || (major == 6 && minor >= 4).

How to Test

go test -run TestHasIouringSubmitReq ./pkg/containerwatcher/v2/tracers/ covers 5.15, 6.3, 6.4, 6.17, 7.0, 7.3, 7.4 and 8.0.

AI-skills: armosec-shared-rules:agent-dispatch-policy

Summary by CodeRabbit

• Bug Fixes

  • Improved compatibility when selecting the appropriate io_uring monitoring support across kernel versions, including newer major versions.

• Tests

  • Added coverage for io_uring capability detection across multiple kernel versions.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 9a906d94-c99f-47fc-898e-215f0ca20f24

📥 Commits

Reviewing files that changed from the base of the PR and between 02f0bf7 and 3b687d0.

📒 Files selected for processing: 2

• pkg/containerwatcher/v2/tracers/iouring.go
• pkg/containerwatcher/v2/tracers/iouring_test.go

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The io_uring tracer now uses a helper to check whether a kernel version supports the newer gadget image. Tests cover the 6.4 boundary and major versions above 6.

Changes: io_uring Version Selection

Layer / File(s)	Summary
Kernel version check and gadget selection pkg/containerwatcher/v2/tracers/iouring.go, pkg/containerwatcher/v2/tracers/iouring_test.go	hasIouringSubmitReq returns true for major versions above 6 or version 6.4 and later. Start uses the helper to select the gadget image. Tests cover the support boundary and major versions above 6.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 3b687

The compatible gadget is selected across the reviewed kernel-version boundaries, with no concrete merge-blocking risk remaining.

Pre-merge checks: 4 · 1

Failed checks: 1 warning

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 4 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

Passed checks: 4 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the primary change: selecting the iouring_new gadget for kernel 7.x.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches: 💡 1

🧪 Generate unit tests (beta)

• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Warning

Tools execution failed with the following error:

Failed to run tools: 14 UNAVAILABLE: Connection dropped

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[matthyx]

Approve — no material blockers found in the two-file change. Independent code review recommends APPROVE; architecture review is CLEAR.

Reviewed head 3b687d06615bc2d6a863356d77a381daef9b9a02 against main at 02f0bf7b21fd98da0d6f6935d3c49503d6978738.

The fix is needed: the target branch's predicate selects the old gadget for 7.0–7.3 and 8.0. iouring.go:58,70 now compares versions lexicographically, preserving the 6.4 boundary and selecting the gadget that attaches to io_uring_submit_req. The old gadget attaches to io_uring_submit_sqe. This repairs selection directly; configuration can disable the tracer but cannot repair selection. Registration, event schema, callbacks, and resource lifecycle remain unchanged; no dependencies or public API changes.

History: repository-wide GitHub PR searches across open/closed/merged states used io_uring, iouring, iouring.go, SupportedMajor, kernel 7, and io_uring_submit_sqe; issue searches used io_uring, iouring, and gadget/kernel terms (100 results/query; none reached that cap). No duplicate/superseding selector fix surfaced; search indexing and unmentioned changes remain limits. #741 fixed CO-RE reads; #751 fixed datasource fields. Neither fixes selection. #750 was explicitly closed for suppressing symptoms instead of fixing their cause; that objection does not apply here. #513 proposed removing the rule, but its discussion provides no explicit rejection rationale. Current PR has no human reviews or inline concerns; CodeRabbit reports no actionable findings.

Validation: gofmt -d on both complete changed files produced no output. In a credential-free, network-isolated Bubblewrap environment, go test -v on the exact extracted helper with the eight boundary cases passed; substituting the target-branch predicate failed for 7.0, 7.3, and 8.0. This is a focused regression harness, not a run of the full tracer package. Full package tests, local build/lint, and live eBPF validation were not run.

CI logs show selection of iouring_new on 7.0.0-1017-azure and attachment attempts to io_uring_submit_req. Cross-platform build, benchmark, and CodeQL passed. Multiple component jobs failed, including missing container profiles and an exec-alert count of 0 versus 10. Those failures do not establish a defect in this selector change; their full root causes and baseline reproducibility remain unverified. CI is not wholly green.

Head, target, open/non-draft status, mergeability, and review context were rechecked immediately before submission. Verdict: APPROVE.

[AlonLiwsky]

The red component tests are not from this change. These runners now boot 7.0.0-1017-azure. On 7.0, a BPF program on a sys_enter_* tracepoint whose event copies user memory (the format has a __data_loc field) runs only on CPUs that have their own perf event on it, so exec, open and link events from the other CPUs are lost. I checked Test_14: the "Hard link created over sensitive file" alert never arrives (linkat). The exec-alert count of 0 looks the same. Until node-agent has a workaround, component tests on these runners will fail on every PR. We have one downstream (one counting perf event per CPU on the linked tracepoints); I can upstream it.