kubescape / kubescape/node-agent

`hasTty` is false on /dev/pts/0: bump trace_exec gadget to v0.55.0+

Open Beginner friendly
#975 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
37
Forks
28
Avg merge
23h 31m
Merged PRs (30d)
29

Description

# Description
Hi 👋, and thanks for the TTY fields and the very clear `docs/features/exec-tty-field.md`!

`event.hasTty` is false for a shell on `/dev/pts/0`, which is where the first `kubectl exec -it` into a container lands. node-agent pins `ghcr.io/inspektor-gadget/gadget/trace_exec:v0.48.1` (`pkg/containerwatcher/v2/tracers/exec.go`), which only emits the tty index, so `has(event.ttyMajor)` is never true and `hasTty` falls back to an index where `0` means both "no terminal" and `/dev/pts/0`.

Good news: inspektor-gadget/inspektor-gadget#5714 landed in v0.55.0 and emits the terminal device number. Since node-agent already reads `tty_major` when it's present, a gadget bump might be all it takes.

# Environment
OS: `Amazon Linux 2023 (EKS 1.34), kernel 6.12, arm64, containerd 2.2`
Version: `node-agent v0.3.219 (kubescape-operator chart 1.40.4)`

# Steps To Reproduce
1. Bind these three rules to a namespace running a `busybox` pod (`sleep` as its command):
```yaml
- id: TLX901 # control
expressions:
message: "'control: ' + event.comm + ' tty=' + string(event.tty)"
uniqueId: "event.comm + '_' + string(event.pid)"
ruleExpression:
- eventType: exec
expression: 'event.comm == "sh"'
- id: TLX902
# same, with expression: 'event.comm == "sh" && event.hasTty'
- id: TLX903
# same, with expression: 'event.comm == "sh" && has(event.ttyMajor)'
```
2. `kubectl exec -it -- sh -c 'tty; sleep 3'` → prints `/dev/pts/0`
3. `kubectl exec -it -- sh -c 'tty; sleep 5'` while a pts index is still held → prints `/dev/pts/1`

# Expected behavior
All three rules fire for both shells: each has a terminal (major 136).

# Actual Behavior
| Terminal | TLX901 control | TLX902 `hasTty` | TLX903 `has(ttyMajor)` | `tty` |
|---|---|---|---|---|
| `/dev/pts/0` | fired | not fired | not fired | 0 |
| `/dev/pts/1` | fired | fired | not fired | 1 |

# Additional context
This matches the phase-1 expectations in `Test_35_ExecTTYFieldTest` (`c-pts0=0`), and v0.3.231 still pins the same gadget. Our use case is a rule reporting interactive shells that stays quiet for containers whose start command is a shell (`sh -c ...` in CronJobs). For now we keep a per-workload exception list, which we'd happily drop. Happy to help test a bump. Thanks!

Contributor guide

Open the contributing guide

Research direction

Start with the gadget pin and exec tracer reference in pkg/containerwatcher/v2/tracers/exec.go, then read Test_35_ExecTTYFieldTest for the expected /dev/pts/0 behavior. Verify the trace_exec gadget is updated to v0.55.0 and run the relevant tests or reproduction rules to confirm hasTty and ttyMajor work for both terminals.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes
Domain
security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
78/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.