[bug] matchPIDs is using first pid only

[arthur-zhang]

Fixes bug

Description

In the code, the function next_pid_value(index, f, ty) is called multiple times to update the index, but the updated value is not written back to sel->index. This wil cause external callers to be unable to obtain the updated state.

matchPIDs only use first pid

selectors:
- matchPIDs:
  - operator: NotIn
    values:
    - 0
    - 1

__u32 index = sel->index;

index = next_pid_value(index, f, ty);

FUNC_INLINE int next_pid_value(__u32 off, __u32 *f, __u32 ty)
{
	return off + 4;
}

offset use selecttor_filter->index

FUNC_INLINE int
process_filter_pid(struct selector_filter *sf, __u32 *f,
		   struct execve_map_value *enter, struct msg_ns *n,
		   struct msg_capabilities *c)
{
	__u32 sel, off = sf->index;  
	__u64 flags = sf->flags;
	__u64 pid;

	if (flags & PID_SELECTOR_FLAG_NSPID) {
		pid = enter->nspid;
	} else {
		pid = enter->key.pid;
	}

	if (off > 1000)
		sel = 0;
	else {
		__u64 o = (__u64)off;
		o = o / 4;
		asm volatile("%[o] &= 0x3ff;\n"
			     : [o] "+r"(o));
		sel = f[o];
	}
}

release note

Fix selector filter to properly update and assign `sel->index` in `pfilter.h`

[olsajiri]

nice catch, could you please add test for the 2 pids matching spec? thanks

[olsajiri]

could we do directly sel->index = next_pid_value(index, f, ty); ?

[arthur-zhang]

maybe not. If we do that, index is not changed. and sel->index will be 0 and 4(using first two pids), not more pids will be chosen. (I already tested this)

maybe we can remove index variable and use sel->index = next_pid_value(sel->index, f, ty) directly

[arthur-zhang]

nice catch, could you please add test for the 2 pids matching spec? thanks

OK，I will spend some time to figure out how to do that.