[CWS] Implement fsmount syscall (fix runc init path resolution) #37906

kovagsm · 2025-06-12T17:46:04Z

What does this PR do?

Adds support for the fsmount syscall, both to the mount resolver and also creates fsmount event.

Motivation

This syscall is used extensively by programs such as runc and the lack of coverage was causing multiple mountpoint resolution errors, that resulted in abnormal paths.

Describe how you validated your changes

Manually, locally
Deployed on a cluster
Automated tests

Possible Drawbacks / Trade-offs

N/A

Additional Notes

This syscall is relatively new and documentation is lacking

kovagsm · 2025-06-12T17:48:43Z

/trigger-ci

dd-devflow · 2025-06-12T17:51:50Z

View all feedbacks in Devflow UI.

2025-06-12 17:48:45 UTC ℹ️ Start processing command /trigger-ci
If you need support, contact us on Slack #devflow!

2025-06-12 17:51:49 UTC 🚨 Devflow

Post "https://gitlab.ddbuild.io/api/v4/projects/DataDog%2Fdatadog-agent/pipeline": net/http: request canceled (Client.Timeout exceeded while awaiting headers)

Details

child workflow execution error (type: devflow.Devflow_TriggerCiFromPr, workflowID: 22ea7dd8-ece5-412e-a5b4-2ac818f30e6a_26, runID: 607bb387-a6f2-4e99-8535-685bb08c1853, initiatedEventID: 26, startedEventID: 27): child workflow execution error (type: devflow.Devflow_TriggerCi, workflowID: 607bb387-a6f2-4e99-8535-685bb08c1853_14, runID: 3a083afc-1cb6-487a-8105-3e18ba4c1edd, initiatedEventID: 14, startedEventID: 15): activity error (type: gitlab.GitlabService_CreatePipeline, scheduledEventID: 26, startedEventID: 27, identity: ): activity ScheduleToClose timeout (type: ScheduleToClose): Post "https://gitlab.ddbuild.io/api/v4/projects/DataDog%2Fdatadog-agent/pipeline": net/http: request canceled (Client.Timeout exceeded while awaiting headers) (type: Error, retryable: true): net/http: request canceled (Client.Timeout exceeded while awaiting headers) (type: timeoutError, retryable: true)

If you need support, contact us on Slack #devflow with those details!

cit-pr-commenter · 2025-06-12T18:45:08Z

Regression Detector

Regression Detector Results

Metrics dashboard
Target profiles
Run ID: d7674a6b-fdd8-40e0-b530-1958be102017

Baseline: 292b4a1
Comparison: fd202b6
Diff

Optimization Goals: ❌ Regression(s) detected

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
❌	docker_containers_cpu	% cpu utilization	+6.73	[+3.53, +9.93]	1	Logs

Fine details of change detection per experiment

perf	experiment	goal	Δ mean %	Δ mean % CI	trials	links
❌	docker_containers_cpu	% cpu utilization	+6.73	[+3.53, +9.93]	1	Logs
➖	docker_containers_memory	memory utilization	+2.13	[+1.97, +2.29]	1	Logs
➖	uds_dogstatsd_to_api_cpu	% cpu utilization	+1.92	[+1.03, +2.81]	1	Logs
➖	quality_gate_logs	% cpu utilization	+1.02	[-1.74, +3.78]	1	Logs bounds checks dashboard
➖	tcp_syslog_to_blackhole	ingress throughput	+0.97	[+0.89, +1.05]	1	Logs
➖	otlp_ingest_logs	memory utilization	+0.57	[+0.44, +0.70]	1	Logs
➖	ddot_metrics	memory utilization	+0.30	[+0.18, +0.42]	1	Logs
➖	quality_gate_idle	memory utilization	+0.14	[+0.09, +0.20]	1	Logs bounds checks dashboard
➖	otlp_ingest_metrics	memory utilization	+0.09	[-0.07, +0.25]	1	Logs
➖	file_to_blackhole_100ms_latency	egress throughput	+0.09	[-0.44, +0.61]	1	Logs
➖	file_to_blackhole_500ms_latency	egress throughput	+0.06	[-0.54, +0.66]	1	Logs
➖	file_to_blackhole_0ms_latency_http2	egress throughput	+0.05	[-0.50, +0.60]	1	Logs
➖	file_to_blackhole_1000ms_latency_linear_load	egress throughput	+0.03	[-0.21, +0.26]	1	Logs
➖	uds_dogstatsd_to_api	ingress throughput	+0.02	[-0.24, +0.28]	1	Logs
➖	file_to_blackhole_0ms_latency	egress throughput	+0.01	[-0.59, +0.61]	1	Logs
➖	tcp_dd_logs_filter_exclude	ingress throughput	-0.00	[-0.02, +0.02]	1	Logs
➖	file_to_blackhole_0ms_latency_http1	egress throughput	-0.02	[-0.59, +0.55]	1	Logs
➖	quality_gate_idle_all_features	memory utilization	-0.02	[-0.10, +0.06]	1	Logs bounds checks dashboard
➖	file_to_blackhole_1000ms_latency	egress throughput	-0.06	[-0.64, +0.53]	1	Logs
➖	file_to_blackhole_300ms_latency	egress throughput	-0.07	[-0.69, +0.55]	1	Logs
➖	file_tree	memory utilization	-0.13	[-0.28, +0.01]	1	Logs
➖	ddot_logs	memory utilization	-0.47	[-0.56, -0.38]	1	Logs
➖	uds_dogstatsd_20mb_12k_contexts_20_senders	memory utilization	-0.47	[-0.53, -0.42]	1	Logs

Bounds Checks: ✅ Passed

perf	experiment	bounds_check_name	replicates_passed	links
✅	docker_containers_cpu	simple_check_run	10/10
✅	docker_containers_memory	memory_usage	10/10
✅	docker_containers_memory	simple_check_run	10/10
✅	file_to_blackhole_0ms_latency	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency	memory_usage	10/10
✅	file_to_blackhole_0ms_latency_http1	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency_http1	memory_usage	10/10
✅	file_to_blackhole_0ms_latency_http2	lost_bytes	10/10
✅	file_to_blackhole_0ms_latency_http2	memory_usage	10/10
✅	file_to_blackhole_1000ms_latency	memory_usage	10/10
✅	file_to_blackhole_1000ms_latency_linear_load	memory_usage	10/10
✅	file_to_blackhole_100ms_latency	lost_bytes	10/10
✅	file_to_blackhole_100ms_latency	memory_usage	10/10
✅	file_to_blackhole_300ms_latency	lost_bytes	10/10
✅	file_to_blackhole_300ms_latency	memory_usage	10/10
✅	file_to_blackhole_500ms_latency	lost_bytes	10/10
✅	file_to_blackhole_500ms_latency	memory_usage	10/10
✅	quality_gate_idle	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_idle	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_idle_all_features	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_idle_all_features	memory_usage	10/10	bounds checks dashboard
✅	quality_gate_logs	intake_connections	10/10	bounds checks dashboard
✅	quality_gate_logs	lost_bytes	10/10	bounds checks dashboard
✅	quality_gate_logs	memory_usage	10/10	bounds checks dashboard

Explanation

Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%

Performance changes are noted in the perf column of each table:

✅ = significantly better comparison variant performance
❌ = significantly worse comparison variant performance
➖ = no significant change in performance

A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".

For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following crit 8000 eria are true:

Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
Its configuration does not mark it "erratic".

CI Pass/Fail Decision

✅ Passed. All Quality Gates passed.

quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
quality_gate_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.

agent-platform-auto-pr · 2025-06-13T20:07:59Z

Static quality checks

✅ Please find below the results from static quality gates
Comparison made with ancestor 292b4a1

Successful checks

Info

	Quality gate	Delta	On disk size (MiB)	Delta	On wire size (MiB)
✅	agent_deb_amd64	$${+0.12}$$	$${697.15}$$ < $${697.37}$$	$${+0.05}$$	$${176.09}$$ < $${177.03}$$
✅	agent_deb_amd64_fips	$${+0.13}$$	$${695.43}$$ < $${695.59}$$	$${-0}$$	$${175.52}$$ < $${176.51}$$
✅	agent_heroku_amd64	$${0}$$	$${358.68}$$ < $${359.67}$$	$${-0}$$	$${96.53}$$ < $${97.47}$$
✅	agent_msi	$${0}$$	$${959.13}$$ < $${959.86}$$	$${-0.01}$$	$${146.25}$$ < $${147.27}$$
✅	agent_rpm_amd64	$${+0.12}$$	$${697.14}$$ < $${697.36}$$	$${+0.03}$$	$${177.67}$$ < $${178.56}$$
✅	agent_rpm_amd64_fips	$${+0.13}$$	$${695.42}$$ < $${695.58}$$	$${-0.02}$$	$${177.48}$$ < $${178.43}$$
✅	agent_rpm_arm64	$${+0.12}$$	$${687.16}$$ < $${687.37}$$	$${+0.01}$$	$${161.09}$$ < $${161.99}$$
✅	agent_rpm_arm64_fips	$${+0.12}$$	$${685.54}$$ < $${685.72}$$	$${+0.01}$$	$${160.23}$$ < $${161.11}$$
✅	agent_suse_amd64	$${+0.12}$$	$${697.14}$$ < $${697.36}$$	$${+0.03}$$	$${177.67}$$ < $${178.56}$$
✅	agent_suse_amd64_fips	$${+0.13}$$	$${695.42}$$ < $${695.58}$$	$${-0.02}$$	$${177.48}$$ < $${178.43}$$
✅	agent_suse_arm64	$${+0.12}$$	$${687.16}$$ < $${687.37}$$	$${+0.01}$$	$${161.09}$$ < $${161.99}$$
✅	agent_suse_arm64_fips	$${+0.12}$$	$${685.54}$$ < $${685.72}$$	$${+0.01}$$	$${160.23}$$ < $${161.11}$$
✅	docker_agent_amd64	$${+0.12}$$	$${780.96}$$ < $${781.16}$$	$${+0.02}$$	$${268.79}$$ < $${269.63}$$
✅	docker_agent_arm64	$${+0.12}$$	$${794.42}$$ < $${794.62}$$	$${+0.01}$$	$${256.14}$$ < $${257.0}$$
✅	docker_agent_jmx_amd64	$${+0.12}$$	$${972.15}$$ < $${972.35}$$	$${+0.01}$$	$${337.76}$$ < $${338.6}$$
✅	docker_agent_jmx_arm64	$${+0.12}$$	$${974.21}$$ < $${974.41}$$	$${+0.02}$$	$${321.09}$$ < $${321.97}$$
✅	docker_agent_windows1809	$${+0.11}$$	$${1180.67}$$ < $${1185.29}$$	$${-0.04}$$	$${416.16}$$ < $${420.95}$$
✅	docker_agent_windows1809_core	$${+0}$$	$${5910.64}$$ < $${5915.25}$$	$${0}$$	$${2048.0}$$ < $${2049.0}$$
✅	docker_agent_windows1809_core_jmx	$${+0.13}$$	$${6032.34}$$ < $${6059.4}$$	$${0}$$	$${2048.0}$$ < $${2049.0}$$
✅	docker_agent_windows1809_jmx	$${+0}$$	$${1302.3}$$ < $${1306.92}$$	$${+0.07}$$	$${458.5}$$ < $${463.21}$$
✅	docker_agent_windows2022	$${+0.25}$$	$${1200.13}$$ < $${1204.42}$$	$${+0.04}$$	$${428.95}$$ < $${433.71}$$
✅	docker_agent_windows2022_core	$${+0.04}$$	$${5883.91}$$ < $${5888.56}$$	$${0}$$	$${2048.0}$$ < $${2049.0}$$
✅	docker_agent_windows2022_core_jmx	$${+0.2}$$	$${6005.57}$$ < $${6009.95}$$	$${0}$$	$${2048.0}$$ < $${2049.0}$$
✅	docker_agent_windows2022_jmx	$${+0.02}$$	$${1321.72}$$ < $${1326.13}$$	$${-0}$$	$${471.19}$$ < $${475.99}$$
✅	docker_cluster_agent_amd64	$${-0}$$	$${212.88}$$ < $${213.79}$$	$${0}$$	$${72.39}$$ < $${73.33}$$
✅	docker_cluster_agent_arm64	$${+0}$$	$${228.76}$$ < $${229.64}$$	$${-0}$$	$${68.67}$$ < $${69.6}$$
✅	docker_cws_instrumentation_amd64	$${-0}$$	$${7.08}$$ < $${7.12}$$	$${-0}$$	$${2.95}$$ < $${3.29}$$
✅	docker_cws_instrumentation_arm64	$${0}$$	$${6.69}$$ < $${6.92}$$	$${-0}$$	$${2.7}$$ < $${3.07}$$
✅	docker_dogstatsd_amd64	$${-0}$$	$${39.22}$$ < $${39.57}$$	$${-0}$$	$${15.12}$$ < $${15.76}$$
✅	docker_dogstatsd_arm64	$${-0}$$	$${37.88}$$ < $${38.2}$$	$${-0}$$	$${14.54}$$ < $${14.83}$$
✅	dogstatsd_deb_amd64	$${0}$$	$${30.45}$$ < $${31.4}$$	$${-0}$$	$${8.0}$$ < $${8.95}$$
✅	dogstatsd_deb_arm64	$${0}$$	$${29.02}$$ < $${29.97}$$	$${-0}$$	$${6.94}$$ < $${7.89}$$
✅	dogstatsd_rpm_amd64	$${0}$$	$${30.45}$$ < $${31.4}$$	$${-0}$$	$${8.0}$$ < $${8.96}$$
✅	dogstatsd_suse_amd64	$${0}$$	$${30.45}$$ < $${31.4}$$	$${-0}$$	$${8.0}$$ < $${8.96}$$
✅	iot_agent_deb_amd64	$${0}$$	$${50.47}$$ < $${51.38}$$	$${-0}$$	$${12.85}$$ < $${13.79}$$
✅	iot_agent_deb_arm64	$${0}$$	$${47.94}$$ < $${48.85}$$	$${+0}$$	$${11.15}$$ < $${12.09}$$
✅	iot_agent_deb_armhf	$${0}$$	$${47.51}$$ < $${48.42}$$	$${-0.01}$$	$${11.21}$$ < $${12.16}$$
✅	iot_agent_rpm_amd64	$${0}$$	$${50.47}$$ < $${51.38}$$	$${-0}$$	$${12.87}$$ < $${13.81}$$
✅	iot_agent_rpm_arm64	$${0}$$	$${47.94}$$ < $${48.85}$$	$${-0}$$	$${11.16}$$ < $${12.11}$$
✅	iot_agent_suse_amd64	$${0}$$	$${50.47}$$ < $${51.38}$$	$${-0}$$	$${12.87}$$ < $${13.81}$$

safchain · 2025-06-18T15:56:30Z

pkg/security/ebpf/c/include/hooks/mount.h

+
+
+HOOK_SYSCALL_EXIT(fsmount) {
+    struct syscall_cache_t *syscall = peek_syscall(EVENT_FSMOUNT);


nit: pop instead of peek

it's not a nit, it's pretty important to not fill the syscall cache

so yeah good catch !

safchain · 2025-06-18T15:59:48Z

pkg/security/serializers/serializers_linux.go

@@ -495,6 +495,17 @@ type MountEventSerializer struct {
 	MountSourcePathResolutionError string `json:"source.path_error,omitempty"`
 }

+// FsmountEventSerializer serializes an fsmount event to JSON
+// easyjson:json
+type FsmountEventSerializer struct {


nit: you can remove it

safchain · 2025-06-18T16:03:35Z

pkg/security/tests/fsmount_test.go

+		}
+		defer unix.Close(mountfd)
+
+		time.Sleep(500 * time.Millisecond)


nit: maybe useGetProbeEvent

safchain · 2025-06-20T11:39:54Z

pkg/security/probe/probe_ebpf.go

@@ -1060,6 +1060,9 @@ func (p *EBPFProbe) handleEvent(CPU int, data []byte) {
 			seclog.Errorf("failed to insert exec event: %s (pid %d, offset %d, len %d)", err, event.PIDContext.Pid, offset, len(data))
 			return
 		}
+
+		event.Exec.FileEvent.PathnameStr = p.fieldHandlers.ResolveFilePath(event, &event.Exec.FileEvent)


Why do you need to call this two function here, the path should have been resolved in the AddExecEntry ?

Not needed. It was an attempt to solve some still failing resolutions for runc init in the case it was a race condition. I removed it

kovagsm · 2025-06-20T13:35:19Z

/trigger-ci

dd-devflow · 2025-06-20T13:35:21Z

View all feedbacks in Devflow UI.

2025-06-20 13:35:21 UTC ℹ️ Start processing command /trigger-ci

2025-06-20 13:36:18 UTC ℹ️ Gitlab pipeline started

Started pipeline #68313419

pkg/security/resolvers/mount/resolver.go

pkg/security/tests/fsmount_test.go

pkg/security/secl/model/unmarshallers_linux.go

pkg/security/tests/fsmount_test.go

kovagsm · 2025-06-24T13:09:17Z

/merge

dd-devflow · 2025-06-24T13:09:21Z

View all feedbacks in Devflow UI.

2025-06-24 13:09:21 UTC ℹ️ Start processing command /merge
Use /merge -c to cancel this operation!

2025-06-24 13:09:32 UTC ℹ️ MergeQueue: waiting for PR to be ready

This merge request is not mergeable yet, because of pending checks/missing approvals. It will be added to the queue as soon as checks pass and/or get approvals.
Note: if you pushed new commits since the last approval, you may need additional approval.
You can remove it from the waiting list with /remove command.

Use /merge -c to cancel this operation!

⏳ Processing

github-actions bot added component/system-probe team/agent-security medium review PR review might take time labels Jun 12, 2025

kovagsm force-pushed the CWS-3772_Abnormal_Path_Fix branch 2 times, most recently from 650cb67 to 99d8ab9 Compare June 12, 2025 17:48

github-actions bot added long review PR is complex, plan time to review it and removed medium review PR review might take time labels Jun 13, 2025

kovagsm force-pushed the CWS-3772_Abnormal_Path_Fix branch from a2059c1 to ae9bf4f Compare June 13, 2025 15:35

kovagsm force-pushed the CWS-3772_Abnormal_Path_Fix branch 3 times, most recently from 3205641 to b49f9ac Compare June 17, 2025 13:31

kovagsm added the qa/done QA done before merge and regressions are covered by tests label Jun 17, 2025

kovagsm force-pushed the CWS-3772_Abnormal_Path_Fix branch from b49f9ac to 24e0a47 Compare June 17, 2025 13:36

kovagsm added changelog/no-changelog category/feature labels Jun 17, 2025

kovagsm changed the title ~~[CWS] Fix runc init path resolution~~ [CWS] Implement fsmount syscall (fix runc init path resolution) Jun 17, 2025

kovagsm marked this pull request as ready for review June 17, 2025 13:52

kovagsm requested review from a team as code owners June 17, 2025 13:52

maycmlee approved these changes Jun 17, 2025

View reviewed changes

kovagsm force-pushed the CWS-3772_Abnormal_Path_Fix branch from 8356f46 to 0e94c1b Compare June 18, 2025 11:37

safchain reviewed Jun 18, 2025

View reviewed changes

kovagsm force-pushed the CWS-3772_Abnormal_Path_Fix branch from ff44d42 to bb7f17e Compare June 20, 2025 09:39

safchain reviewed Jun 20, 2025

View reviewed changes

spikat reviewed Jun 20, 2025

View reviewed changes

pkg/security/resolvers/mount/resolver.go Show resolved Hide resolved

pkg/security/tests/fsmount_test.go Outdated Show resolved Hide resolved

spikat reviewed Jun 20, 2025

View reviewed changes

pkg/security/tests/fsmount_test.go Show resolved Hide resolved

kovagsm added 15 commits June 23, 2025 17:44

Create fsmount event

9a73066

add fsmount tests

2ab30ee

restore fn handleNewMount prev impl

0d7bf5a

change test to not use the event

a0e4f4c

remove event fsmount

1c59234

remove more stuff

bb460e4

skip unsupported kernels

d607157

remove line

e39cf0c

address pr comments

fcd5c81

fix some failing tests

9ff9ccf

remove early path resolution

a50d075

add more checks on the test

879c47e

add new test

14e6ce1

add err check

850bcdd

fix failing test

5db5b62

kovagsm force-pushed the CWS-3772_Abnormal_Path_Fix branch from 0b43f05 to 5db5b62 Compare June 23, 2025 15:44

add one more test

fd202b6

spikat reviewed Jun 24, 2025

View reviewed changes

pkg/security/secl/model/unmarshallers_linux.go Outdated Show resolved Hide resolved

pkg/security/tests/fsmount_test.go Outdated Show resolved Hide resolved

pkg/security/tests/fsmount_test.go Outdated Show resolved Hide resolved

remove prints

16b7ae3

spikat approved these changes Jun 24, 2025

View reviewed changes

Merge branch 'main' into CWS-3772_Abnormal_Path_Fix

2591f5a

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

[CWS] Implement fsmount syscall (fix runc init path resolution) #37906

[CWS] Implement fsmount syscall (fix runc init path resolution) #37906

Uh oh!

Uh oh!

Uh oh!

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

Uh oh!

Info

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!



		HOOK_SYSCALL_EXIT(fsmount) {
		struct syscall_cache_t *syscall = peek_syscall(EVENT_FSMOUNT);

[CWS] Implement fsmount syscall (fix runc init path resolution) #37906

Are you sure you want to change the base?

[CWS] Implement fsmount syscall (fix runc init path resolution) #37906

Conversation

Uh oh!

What does this PR do?

Motivation

Describe how you validated your changes

Possible Drawbacks / Trade-offs

Additional Notes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Regression Detector

Regression Detector Results

Optimization Goals: ❌ Regression(s) detected

Fine details of change detection per experiment

Bounds Checks: ✅ Passed

Explanation

CI Pass/Fail Decision

Uh oh!

Uh oh!

Static quality checks

Info

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!