aquasecurity · yanivagman · Aug 30, 2021 · Aug 29, 2021 · Aug 30, 2021 · Aug 30, 2021
diff --git a/tracee-ebpf/tracee/consts.go b/tracee-ebpf/tracee/consts.go
@@ -103,6 +103,7 @@ const (
 	bytesT
 	u16T
 	credT
+	intArr2T
 )
 
 // argTag is an enum that encodes the argument types that the BPF program may write to the shared buffer
@@ -848,7 +849,7 @@ var EventsIDToParams = map[int32][]external.ArgMeta{
 	Eventfd2EventID:               {{Type: "unsigned int", Name: "initval"}, {Type: "int", Name: "flags"}},
 	EpollCreate1EventID:           {{Type: "int", Name: "flags"}},
 	Dup3EventID:                   {{Type: "int", Name: "oldfd"}, {Type: "int", Name: "newfd"}, {Type: "int", Name: "flags"}},
-	Pipe2EventID:                  {{Type: "int*", Name: "pipefd"}, {Type: "int", Name: "flags"}},
+	Pipe2EventID:                  {{Type: "int[2]", Name: "pipefd"}, {Type: "int", Name: "flags"}},
 	InotifyInit1EventID:           {{Type: "int", Name: "flags"}},
 	PreadvEventID:                 {{Type: "int", Name: "fd"}, {Type: "const struct iovec*", Name: "iov"}, {Type: "unsigned long", Name: "iovcnt"}, {Type: "unsigned long", Name: "pos_l"}, {Type: "unsigned long", Name: "pos_h"}},
 	PwritevEventID:                {{Type: "int", Name: "fd"}, {Type: "const struct iovec*", Name: "iov"}, {Type: "unsigned long", Name: "iovcnt"}, {Type: "unsigned long", Name: "pos_l"}, {Type: "unsigned long", Name: "pos_h"}},

diff --git a/tracee-ebpf/tracee/events_decoder.go b/tracee-ebpf/tracee/events_decoder.go
@@ -94,6 +94,15 @@ func readArgFromBuff(dataBuff io.Reader) (argTag, interface{}, error) {
 			return argTag, nil, fmt.Errorf("byte array size too big: %d", size)
 		}
 		res, err = readByteSliceFromBuff(dataBuff, int(size))
+	case intArr2T:
+		var intArray [2]int32
+
+		err = binary.Read(dataBuff, binary.LittleEndian, &intArray)
+		if err != nil {
+			return argTag, nil, fmt.Errorf("error reading int elements: %v", err)
+		}
+
+		res = intArray
 	default:
 		// if we don't recognize the arg type, we can't parse the rest of the buffer
 		return argTag, nil, fmt.Errorf("error unknown arg type %v", argType)

diff --git a/tracee-ebpf/tracee/tracee.bpf.c b/tracee-ebpf/tracee/tracee.bpf.c
@@ -128,6 +128,7 @@ extern bool CONFIG_ARCH_HAS_SYSCALL_WRAPPER __kconfig;
 #define BYTES_T       14UL
 #define U16_T         15UL
 #define CRED_T        16UL
+#define INT_ARR_2_T   17UL
 #define TYPE_MAX      255UL
 
 #define TAG_NONE           0UL
@@ -1795,9 +1796,14 @@ static __always_inline int save_args_to_submit_buf(u64 types, u64 tags, args_t *
                     rc = save_to_submit_buf(submit_p, &family, sizeof(short), type, tag);
                 }
                 break;
+            case INT_ARR_2_T:
+                size = sizeof(int[2]);
+                rc = save_to_submit_buf(submit_p, (void*)(args->args[i]), size, type, tag);
+                break;
         }
-        if ((type != NONE_T) && (type != STR_T) && (type != SOCKADDR_T))
+        if ((type != NONE_T) && (type != STR_T) && (type != SOCKADDR_T) && (type != INT_ARR_2_T)) {
             rc = save_to_submit_buf(submit_p, (void*)&(args->args[i]), size, type, tag);
+        }
 
         if (rc > 0) {
             arg_num++;

diff --git a/tracee-ebpf/tracee/tracee.go b/tracee-ebpf/tracee/tracee.go
@@ -528,6 +528,8 @@ func (t *Tracee) initEventsParams() map[int32][]eventParam {
 				paramT = sockAddrT
 			case "bytes":
 				paramT = bytesT
+			case "int[2]":
+				paramT = intArr2T
 			default:
 				// Default to pointer (printed as hex) for unsupported types
 				paramT = pointerT