tetragon: fix the process exit signal when core dumped

[justin0u0]

Description

The ProcessExit event returns a signal that the process received when it exited. However, core dumped signals (SIGSEGV, SIGILL, etc.) are not returned.

This patch fixes the issue by checking if the process exit code has the core dump bit set (7th bit, 0x80), and returns the correct signal. I used the kernel code as a reference to fix it.

How to Verify

Launch the tetra CLI with the following command:

tetra getevents --process "run" --output compact

Then launch a random program and terminate it using different signals:

./run &
kill -9 $!
./run &
kill -11 $!

Expected Behavior:

Before: the signal for core dumped processes is not displayed correctly.

After: the correct signal for core dumped processes is displayed.

[mtardy]

Hey welcome to Tetragon 👋 , thanks for writing this patch!

Since you are adding something that was missing maybe we could add a test for your change, you can take a look at tests in pkg/sensors/exec/excit_test.go for example. We have some programs in contrib/tester-progs that you could reuse just to start some process that waits forever I think.

Please reach out if you need more pointers, that would be a pleasure.

[netlify]

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	62478de
🔍 Latest deploy log	https://app.netlify.com/sites/tetragon/deploys/671b3667eacc640008d522f9
😎 Deploy Preview	https://deploy-preview-3039--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[justin0u0]

Hey welcome to Tetragon 👋 , thanks for writing this patch!

Since you are adding something that was missing maybe we could add a test for your change, you can take a look at tests in pkg/sensors/exec/excit_test.go for example. We have some programs in contrib/tester-progs that you could reuse just to start some process that waits forever I think.

Please reach out if you need more pointers, that would be a pleasure.

Hi @mtardy,

I've added a test to verify process exit signals from numbers 1 to 15.

Since I couldn’t find a program in contrib/tester-progs that fits my use case, I added a simple pause program to achieve this.

Please take a look when you can. Thanks!

[mtardy]

Thanks that's great :) just a small git related change: