sock_hc: always report binds, regardless of analysis scope#85
Merged
Conversation
The netbinds logger should capture every bind/release, including Penguin's own infrastructure (vpnguin/console/gdbserver, etc.). Remove the igloo_in_scope gates added with the scope feature so bind visibility is no longer tied to the firmware subtree. Syscall/exec scoping (scope.c, igloo_in_scope, the per-hook scope_filter) is unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Removes the
igloo_in_scopegates onigloo_sock_bind/igloo_sock_releaseso netbinds always reports, for every process — including Penguin's own infrastructure (vpnguin/console/gdbserver/guesthopper).Why
The firmware-scoping feature (igloo_driver #84) gated bind emission by UTS-namespace membership, which silently dropped infra binds from
netbinds.csv. That broke theindiv_debug+gdbservertest (gdbserver is launched as infra, so its0.0.0.0:1234bind never appeared) and, more importantly, hid useful bind visibility for Penguin's own services.We're keeping syscall/exec scoping (that's the noise we actually want gone) but bind visibility should be unconditional.
Scope
scope.c,igloo_in_scope,SET_SCOPE_ENABLED, and the per-hookscope_filterpath are untouched — syscall/exec scoping still works.scope.hinclude) are removed.Pairs with penguin (shell-coverage moves to a busybox env-marker; pin bump) and busybox (env-gated coverage) changes.