diff --git a/osquery/events/linux/bpf/setrlimit.cpp b/osquery/events/linux/bpf/setrlimit.cpp index 6e022103885..529e6c4bf87 100644 --- a/osquery/events/linux/bpf/setrlimit.cpp +++ b/osquery/events/linux/bpf/setrlimit.cpp @@ -20,10 +20,11 @@ DECLARE_bool(enable_bpf_events); namespace { std::once_flag setrlimit_flag; +bool setrlimit_succeeded{false}; -void configureBPFMemoryLimitsHelper() { +bool configureBPFMemoryLimitsHelper() { if (!FLAGS_enable_bpf_events) { - return; + return true; } struct rlimit rl = {}; @@ -32,21 +33,26 @@ void configureBPFMemoryLimitsHelper() { auto err = setrlimit(RLIMIT_MEMLOCK, &rl); if (err != 0) { - throw std::runtime_error( - "Failed to setup the memory lock limits. The BPF tables may not work " - "correctly."); + return false; } + + return true; } } // namespace Status configureBPFMemoryLimits() { - try { - std::call_once(setrlimit_flag, configureBPFMemoryLimitsHelper); - return Status::success(); + std::call_once(setrlimit_flag, [&]() { + setrlimit_succeeded = configureBPFMemoryLimitsHelper(); + }); - } catch (const std::exception& e) { - return Status::failure(e.what()); + if (!setrlimit_succeeded) { + return Status::failure( + "Failed to setup the memory lock limits. The BPF tables may not work " + "correctly."); } + + return Status::success(); } } // namespace osquery + diff --git a/osquery/experimental/experiments/linuxevents/src/bpfprocesseventstable.cpp b/osquery/experimental/experiments/linuxevents/src/bpfprocesseventstable.cpp index 7a01bdd7e1b..5201273b3cb 100644 --- a/osquery/experimental/experiments/linuxevents/src/bpfprocesseventstable.cpp +++ b/osquery/experimental/experiments/linuxevents/src/bpfprocesseventstable.cpp @@ -31,29 +31,34 @@ const std::vector> kKnownCgroupPrefixList{ {"/libpod-", "podman"}, }; -std::string getProcUptimeContents() { - std::string uptime_contents; +Status getProcUptimeContents(std::string& uptime_contents) { + uptime_contents.clear(); { std::ifstream uptime_file(kProcUptimeFilePath.c_str(), std::ios::in); if (!uptime_file) { - throw std::runtime_error("Failed to access the following path: " + - kProcUptimeFilePath); + return Status::failure("Failed to access the following path: " + + kProcUptimeFilePath); } std::getline(uptime_file, uptime_contents); } - return uptime_contents; + return Status::success(); } -std::uint64_t getSystemBootTime() { +Status getSystemBootTime(std::uint64_t& boot_time) { auto current_time = std::time(nullptr); - auto uptime_contents = getProcUptimeContents(); + + std::string uptime_contents; + auto status = getProcUptimeContents(uptime_contents); + if (!status.ok()) { + return status; + } auto separator_index = uptime_contents.find('.'); if (separator_index == std::string::npos) { - throw std::runtime_error("Invalid data read from " + kProcUptimeFilePath); + return Status::failure("Invalid data read from " + kProcUptimeFilePath); } auto string_uptime = uptime_contents.substr(0, separator_index); @@ -63,10 +68,11 @@ std::uint64_t getSystemBootTime() { std::strtoull(string_uptime.c_str(), &last_parsed_char, 10); if (integer_uptime == 0 || last_parsed_char == nullptr || *last_parsed_char != 0) { - throw std::runtime_error("Invalid data read from " + kProcUptimeFilePath); + return Status::failure("Invalid data read from " + kProcUptimeFilePath); } - return current_time - integer_uptime; + boot_time = current_time - integer_uptime; + return Status::success(); } } // namespace @@ -131,7 +137,11 @@ TableRows BPFProcessEventsTable::generate(QueryContext& context) { TableRows row_list; std::stringstream buffer; - auto system_boot_time = getSystemBootTime(); + std::uint64_t system_boot_time{0U}; + auto status = getSystemBootTime(system_boot_time); + if (!status.ok()) { + return row_list; + } for (const auto& event : d->event_list) { auto row = make_table_row(); @@ -214,4 +224,4 @@ TableRows BPFProcessEventsTable::generate(QueryContext& context) { return row_list; } -} // namespace osquery \ No newline at end of file +} // namespace osquery