recomission integration tests (#2017)

Integration tests were previously skipped and as such unmaintained
and were broken over time.

This commit fixes the tests by redesigning them to locally run tracee, and
making code ready for new integration tests being added.

Adds a new test to check container mode filtering.

Author: NDStrahilevitz

.github/actions/build-dependencies/action.yaml

@@ -41,3 +41,12 @@ runs:
       run: |
         go install honnef.co/go/tools/cmd/staticcheck@latest
       shell: bash
+    - name: Install docker
+      run: |
+        sudo apt-get install --yes ca-certificates curl gnupg lsb-release
+        sudo mkdir -p /etc/apt/keyrings
+        curl -fsSL https://download.docker.com/linux/ubuntu/gpg | sudo gpg --dearmor -o /etc/apt/keyrings/docker.gpg
+        echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
+        sudo apt-get --yes update
+        sudo apt-get install --yes docker-ce docker-ce-cli containerd.io
+      shell: bash

.github/workflows/pr.yaml

@@ -89,7 +89,7 @@ jobs:
           opa-version: ${{ env.OPA_VERSION }}
       - name: Run Integration Tests
         run: |
-          make test-integration
+          sudo env "PATH=$PATH" make test-integration
   VERIFY-SIGNATURES:
     name: Verify Signatures
     needs:

Makefile

@@ -235,8 +235,8 @@ help:
 	@echo ""
 	@echo "# test"
 	@echo ""
-	@echo "    $$ make test-types           	# run unit tests for types module"
 	@echo "    $$ make test-unit            	# run unit tests"
+	@echo "    $$ make test-types           	# run unit tests for types module"
 	@echo "    $$ make test-integration     	# run integration tests"
 	@echo "    $$ make test-rules           	# opa test (tracee-rules)"
 	@echo ""
@@ -556,45 +556,6 @@ clean-tracee-rules:
 #
 	$(CMD_RM) -rf $(OUTPUT_DIR)/tracee-rules
 
-.PHONY: test-unit
-test-unit: \
-	.checkver_$(CMD_GO) \
-	tracee-ebpf \
-	test-types
-#
-	$(GO_ENV_EBPF) \
-	$(CMD_GO) test \
-		-tags ebpf \
-		-short \
-		-race \
-		-v \
-		-coverprofile=coverage.txt \
-		./...
-
-.PHONY: test-types
-test-types: \
-	.checkver_$(CMD_GO)
-#
-	# Note that we must changed the directory here because types is a standalone Go module.
-	cd ./types && $(CMD_GO) test \
-		-short \
-		-race \
-		-v \
-		-coverprofile=coverage.txt \
-		./...
-
-.PHONY: test-integration
-test-integration: \
-	.checkver_$(CMD_GO) \
-	tracee-ebpf
-#
-	TRC_BIN=$(abspath $(OUTPUT_DIR)/tracee-ebpf) \
-	$(GO_ENV_EBPF) \
-	$(CMD_GO) test \
-		-tags ebpf,integration \
-		-v \
-		-run "Test_Events" ./tests/integration/...
-
 #
 # rules
 #
@@ -637,6 +598,55 @@ clean-rules:
 #
 	$(CMD_RM) -rf $(OUTPUT_DIR)/rules
 
+#
+# tests
+#
+
+.PHONY: test-unit
+test-unit: \
+	.checkver_$(CMD_GO) \
+	tracee-ebpf \
+	test-types
+#
+	$(GO_ENV_EBPF) \
+	$(CMD_GO) test \
+		-tags ebpf \
+		-short \
+		-race \
+		-v \
+		-coverprofile=coverage.txt \
+		./cmd/... \
+		./pkg/... \
+		./signatures/... \
+
+.PHONY: test-types
+test-types: \
+	.checkver_$(CMD_GO)
+#
+	# Note that we must changed the directory here because types is a standalone Go module.
+	cd ./types && $(CMD_GO) test \
+		-short \
+		-race \
+		-v \
+		-coverprofile=coverage.txt \
+		./...
+
+.PHONY: test-integration
+test-integration: \
+	.checkver_$(CMD_GO) \
+	tracee-ebpf
+#
+	$(GO_ENV_EBPF) \
+	$(CMD_GO) test \
+		-tags $(GO_TAGS_EBPF) \
+		-ldflags="-w \
+			-extldflags \"$(CGO_EXT_LDFLAGS_EBPF)\" \
+			-X main.version=\"$(VERSION)\" \
+			" \
+		-v \
+		-p 1 \
+		./tests/integration/... \
+
 .PHONY: test-rules
 test-rules: \
 	| .check_$(CMD_OPA)

pkg/ebpf/tracee.go

@@ -201,6 +201,7 @@ type Tracee struct {
 	eventsSorter      *sorting.EventsChronologicalSorter
 	eventDerivations  events.DerivationTable
 	kernelSymbols     *helpers.KernelSymbolTable
+	running           bool
 }
 
 func (t *Tracee) Stats() *metrics.Stats {
@@ -985,6 +986,7 @@ func (t *Tracee) Run(ctx gocontext.Context) error {
 	go t.handleEvents(ctx)
 	go t.processFileWrites()
 	go t.processNetEvents(ctx)
+	t.running = true
 	// block until ctx is cancelled elsewhere
 	<-ctx.Done()
 	t.eventsPerfMap.Stop()
@@ -1054,6 +1056,11 @@ func (t *Tracee) Close() {
 			fmt.Fprintf(os.Stderr, "failed to clean containers module when closing tracee: %s", err)
 		}
 	}
+	t.running = false
+}
+
+func (t *Tracee) Running() bool {
+	return t.running
 }
 
 func computeFileHash(fileName string) (string, error) {