new: monitor only mode #4316

FedeDP · 2025-11-07T13:22:32Z

Description

Today, we default at enforce even for policies that do not support any enforcement.
Introduce a monitor_only mode (that is userspace-only) that:

stores monitor in ebpf map during startup to avoid falsely reporting enforce
denies further update to policy mode since the policy does not support enforcement

Example output:

$ ./tetra tracingpolicy list
ID   NAME              STATE     FILTERID   NAMESPACE   SENSORS          KERNELMEMORY   MODE           NPOST   NENFORCE   NMONITOR
1    read-etc-passwd   enabled   0          (global)    generic_kprobe   1.87 MB        monitor_only   0       0          0

$ ./tetra tracingpolicy set-mode read-etc-passwd enforce
Error: failed set mode to "enforce" tracing policy: rpc error: code = Unknown desc = setMode called in a collection that does not support enforcement mode

Changelog

new: monitor only mode

netlify · 2025-11-07T13:23:23Z

✅ Deploy Preview for tetragon ready!

Name	Link
🔨 Latest commit	`4f01264`
🔍 Latest deploy log	https://app.netlify.com/projects/tetragon/deploys/69134355fe211700084692ae
😎 Deploy Preview	https://deploy-preview-4316--tetragon.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

kkourt

Thanks!

Left some comments, but LGTM.

pkg/selectors/kernel.go

pkg/sensors/tracing/policyhandler_linux.go

pkg/sensors/sensors.go

kkourt

1 read-etc-passwd enabled 0 (global) generic_kprobe 1.87 MB monitor 0 0 0

One more comment: can we have monitor_only in the list?

FedeDP · 2025-11-11T08:32:31Z

One more comment: can we have monitor_only in the list?

Well, right now the mode we see there is the one seen by bpf.
I'd avoid having something like:

func (c *collection) mode() tetragon.TracingPolicyMode {
	if c.tracingpolicy == nil || c.state != EnabledState {
		return tetragon.TracingPolicyMode_TP_MODE_UNKNOWN
	}
	if !c.allowModeUpdate {
		return tetragon.TracingPolicyMode_TP_MODE_MONITOR_ONLY
	}

	mode, err := policyconf.PolicyMode(c.tracingpolicy)

because:

we'd need to add TracingPolicyMode_TP_MODE_MONITOR_ONLY to our grpc api
we are no more exposing the real bpf value
i'd prefer to keep the allowModeUpdate information bit private

Do you think that, from an UX perspective, is it that bad not to expose TracingPolicyMode_TP_MODE_MONITOR_ONLY ?

kkourt · 2025-11-11T10:41:36Z

One more comment: can we have monitor_only in the list?

Well, right now the mode we see there is the one seen by bpf. I'd avoid having something like:
func (c *collection) mode() tetragon.TracingPolicyMode {
	if c.tracingpolicy == nil || c.state != EnabledState {
		return tetragon.TracingPolicyMode_TP_MODE_UNKNOWN
	}
	if !c.allowModeUpdate {
		return tetragon.TracingPolicyMode_TP_MODE_MONITOR_ONLY
	}

	mode, err := policyconf.PolicyMode(c.tracingpolicy)
because:
* we'd need to add `TracingPolicyMode_TP_MODE_MONITOR_ONLY` to our grpc api

* we are no more exposing the real bpf value

* i'd prefer to keep the `allowModeUpdate` information bit private
Do you think that, from an UX perspective, is it that bad not to expose TracingPolicyMode_TP_MODE_MONITOR_ONLY ?

I would say exposing MONITOR_ONY is good to have (but not too bad if we don't do it).
If we do it, however, I would also read the bpf value and check that things make sense.
That is, if bpf is in enforcement mode but userspace is in monitor_only, then something is probably wrong.

FedeDP · 2025-11-11T10:53:34Z

If we do it, however, I would also read the bpf value and check that things make sense.
That is, if bpf is in enforcement mode but userspace is in monitor_only, then something is probably wrong.

Well i like this use of the new flag. I think it makes sense then, to have this check! Let me update the PR :)

FedeDP · 2025-11-11T11:01:20Z

Pushed the changes @kkourt !

Also, updated PR description with an updated output from tetra tracingpolicy list.

FedeDP · 2025-11-11T15:57:37Z

Windows static checks CI is having some problems tracked here: #4330
We can skip it i guess.

kkourt

Thanks!

Please find some comments below.

kkourt · 2025-11-12T09:03:35Z

pkg/policyconf/policyconf.go

-	MonitorMode Mode = 1
+	EnforceMode     Mode = 0
+	MonitorMode     Mode = 1
+	MonitorOnlyMode Mode = 2 // monitor and cannot be updated to enforce. Not visible to bpf.


Can you please add some information in the commit message for new(pkg/policyconf): introduce MonitorOnlyMode. on what is MonitorOnly mode and what is the motivation? I know it seems obvious now, but providing context is helpful both for people without the context we have now and also for our future selves.

Similarly for the other commits. Note that "why" we are doing something is equally (if not more) important that what. Usually, the what can be figured out by looking at the code, but the why is not so easy.

I force-pushed the reworded commits; feel free to tell me if there's anything else that you feel like should be improved :)

kkourt · 2025-11-12T09:09:02Z

pkg/sensors/collection.go

 	// state indicates the state of the collection
-	state TracingPolicyState
+	state           TracingPolicyState
+	allowModeUpdate bool


Suggestion: How about we keep the mode here? That is, monitor, monitor_only, enforce.

I think that using the ebpf map as source of truth is a good thing; i'd avoid storing that info bit in userspace.

If we want the mode to be everywhere, we should really push it down to ebpf; lots of ugliness in this PR would go away then.

pkg/sensors/tracing/policyhandler_linux.go

kkourt · 2025-11-12T09:13:51Z

pkg/sensors/collection.go

+		if mode != policyconf.MonitorMode {
+			logger.GetLogger().Warn("monitor-only bit is set but bpf map is not in monitor mode", "policy", c.name)
+		}
+		return tetragon.TracingPolicyMode_TP_MODE_MONITOR_ONLY


comment: I wonder if we could return something else here if the mode is not monitor mode, but I don't have any good ideas. We can leave it as is and revisit as needed.

I agree, don't really know what else to return :)

The new policyconf Mode will be used for policies that do not have any enforcement action. For those, nothing else but `monitor` mode should be available. The new mode is not exposed to ebpf (that will see `MonitorMode`), but is used in userspace to notify that the policy only supports monitoring. Also, add a small helper method `SupportEnforcement`. Signed-off-by: Federico Di Pierro <[email protected]>

Signed-off-by: Federico Di Pierro <[email protected]>

It will be used by sensors `handler` to deny mode updates when `HasEnforcement` is false for all sensors in a collection. Signed-off-by: Federico Di Pierro <[email protected]>

In case all sensors in a collection do not support enforcement, deny any col.mode update. Signed-off-by: Federico Di Pierro <[email protected]>

When there are no enforcers, and no enforcement action nor override action, for all kinds of probes. Signed-off-by: Federico Di Pierro <[email protected]>

It will be exposed by the new `SensorIface::HasEnforcement()` API. Signed-off-by: Federico Di Pierro <[email protected]>

Signed-off-by: Federico Di Pierro <[email protected]>

It will be returned by `collection.mode()` when `allowModeUpdate` is false. Signed-off-by: Federico Di Pierro <[email protected]> Co-authored-by: Kornilios Kourtis <[email protected]>

FedeDP marked this pull request as ready for review November 10, 2025 08:20

FedeDP requested a review from kkourt November 10, 2025 08:21

kkourt added the release-note/minor This PR introduces a minor user-visible change label Nov 10, 2025

kkourt reviewed Nov 10, 2025

View reviewed changes

pkg/selectors/kernel.go Outdated Show resolved Hide resolved

pkg/sensors/tracing/policyhandler_linux.go Outdated Show resolved Hide resolved

pkg/sensors/sensors.go Outdated Show resolved Hide resolved

FedeDP force-pushed the new/monitor_only_mode branch from f67e586 to 54304d1 Compare November 10, 2025 16:18

kkourt reviewed Nov 10, 2025

View reviewed changes

FedeDP force-pushed the new/monitor_only_mode branch 2 times, most recently from 6ef3c44 to 4f01264 Compare November 11, 2025 14:08

FedeDP requested a review from kkourt November 11, 2025 14:27

FedeDP force-pushed the new/monitor_only_mode branch from 4f01264 to 0862044 Compare November 11, 2025 15:39

FedeDP requested a review from a team as a code owner November 11, 2025 15:39

FedeDP force-pushed the new/monitor_only_mode branch from 0862044 to 288f179 Compare November 11, 2025 15:40

kkourt reviewed Nov 12, 2025

View reviewed changes

FedeDP and others added 8 commits November 12, 2025 10:22

new(pkg/selectors): introduce HasEnforcementAction helper.

39c8c28

Signed-off-by: Federico Di Pierro <[email protected]>

new(pkg/sensors): add new HasEnforcement method to SensorIface.

ced947d

It will be used by sensors `handler` to deny mode updates when `HasEnforcement` is false for all sensors in a collection. Signed-off-by: Federico Di Pierro <[email protected]>

new(pkg/sensors): deny mode update for collection without enforcement.

8b9db4a

In case all sensors in a collection do not support enforcement, deny any col.mode update. Signed-off-by: Federico Di Pierro <[email protected]>

new(pkg/sensors): set policyMode to MonitorOnlyMode.

cbf68ce

When there are no enforcers, and no enforcement action nor override action, for all kinds of probes. Signed-off-by: Federico Di Pierro <[email protected]>

new(pkg/sensors): set SupportsEnforcement in all kind of Sensors.

5a158cf

It will be exposed by the new `SensorIface::HasEnforcement()` API. Signed-off-by: Federico Di Pierro <[email protected]>

new(pkg/sensors): add HasEnforcement to TestDelayedSensor.

ff84d2b

Signed-off-by: Federico Di Pierro <[email protected]>

new(api,vendor,pkg): introduce TracingPolicyMode_TP_MODE_MONITOR_ONLY.

eaaa104

It will be returned by `collection.mode()` when `allowModeUpdate` is false. Signed-off-by: Federico Di Pierro <[email protected]> Co-authored-by: Kornilios Kourtis <[email protected]>

FedeDP force-pushed the new/monitor_only_mode branch from 288f179 to eaaa104 Compare November 12, 2025 09:29

new: monitor only mode #4316

Are you sure you want to change the base?

new: monitor only mode #4316

Uh oh!

Conversation

FedeDP commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Changelog

Uh oh!

netlify bot commented Nov 7, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for tetragon ready!

Uh oh!

kkourt left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

kkourt left a comment

Choose a reason for hiding this comment

Uh oh!

FedeDP commented Nov 11, 2025

Uh oh!

kkourt commented Nov 11, 2025

Uh oh!

FedeDP commented Nov 11, 2025

Uh oh!

FedeDP commented Nov 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

FedeDP commented Nov 11, 2025

Uh oh!

kkourt left a comment

Choose a reason for hiding this comment

Uh oh!

kkourt Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

FedeDP Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

kkourt Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

FedeDP Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

FedeDP Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

kkourt Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

FedeDP Nov 12, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

FedeDP commented Nov 7, 2025 •

edited

Loading

netlify bot commented Nov 7, 2025 •

edited

Loading

FedeDP commented Nov 11, 2025 •

edited

Loading