`hasTty` is false on /dev/pts/0: bump trace_exec gadget to v0.55.0+
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
Research direction
Start with the gadget pin and exec tracer reference in pkg/containerwatcher/v2/tracers/exec.go, then read Test_35_ExecTTYFieldTest for the expected /dev/pts/0 behavior. Verify the trace_exec gadget is updated to v0.55.0 and run the relevant tests or reproduction rules to confirm hasTty and ttyMajor work for both terminals.
Written by the indexing model from the issue text.
Description
Description
Hi 👋, and thanks for the TTY fields and the very clear docs/features/exec-tty-field.md!
event.hasTty is false for a shell on /dev/pts/0, which is where the first kubectl exec -it into a container lands. node-agent pins ghcr.io/inspektor-gadget/gadget/trace_exec:v0.48.1 (pkg/containerwatcher/v2/tracers/exec.go), which only emits the tty index, so has(event.ttyMajor) is never true and hasTty falls back to an index where 0 means both "no terminal" and /dev/pts/0.
Good news: inspektor-gadget/inspektor-gadget#5714 landed in v0.55.0 and emits the terminal device number. Since node-agent already reads tty_major when it's present, a gadget bump might be all it takes.
Environment
OS: Amazon Linux 2023 (EKS 1.34), kernel 6.12, arm64, containerd 2.2
Version: node-agent v0.3.219 (kubescape-operator chart 1.40.4)
Steps To Reproduce
- Bind these three rules to a namespace running a
busyboxpod (sleepas its command):- id: TLX901 # control expressions: message: "'control: ' + event.comm + ' tty=' + string(event.tty)" uniqueId: "event.comm + '_' + string(event.pid)" ruleExpression: - eventType: exec expression: 'event.comm == "sh"' - id: TLX902 # same, with expression: 'event.comm == "sh" && event.hasTty' - id: TLX903 # same, with expression: 'event.comm == "sh" && has(event.ttyMajor)' kubectl exec -it <pod> -- sh -c 'tty; sleep 3'→ prints/dev/pts/0kubectl exec -it <pod> -- sh -c 'tty; sleep 5'while a pts index is still held → prints/dev/pts/1
Expected behavior
All three rules fire for both shells: each has a terminal (major 136).
Actual Behavior
| Terminal | TLX901 control | TLX902 hasTty |
TLX903 has(ttyMajor) |
tty |
|---|---|---|---|---|
/dev/pts/0 |
fired | not fired | not fired | 0 |
/dev/pts/1 |
fired | fired | not fired | 1 |
Additional context
This matches the phase-1 expectations in Test_35_ExecTTYFieldTest (c-pts0=0), and v0.3.231 still pins the same gadget. Our use case is a rule reporting interactive shells that stays quiet for containers whose start command is a shell (sh -c ... in CronJobs). For now we keep a per-workload exception list, which we'd happily drop. Happy to help test a bump. Thanks!
- Dominant language
- Go
- Stars
- 37
- Forks
- 28
- Avg merge
- 23h 31m
- Merged PRs (30d)
- 29
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from kubescape/node-agent
-
Difficulty 4/5 3-5 days Newbie friendliness 55/100
kubescape/node-agent#963 ·
-
Difficulty 4/5 3-5 days Newbie friendliness 58/100
kubescape/node-agent#962 ·
-
Difficulty 5/5 Over a week Newbie friendliness 38/100
kubescape/node-agent#918 · 6 comments ·
-
Difficulty 5/5 Over a week Newbie friendliness 35/100
kubescape/node-agent#912 · 2 comments ·
-
Difficulty 3/5 1-2 days Newbie friendliness 55/100
kubescape/node-agent#896 · 1 comment ·
All issues in kubescape/node-agent
Similar issues
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
-
enhancement needs triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
kind/cleanup
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
kubernetes-sigs/kueue#15947 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100