`hasTty` is false on /dev/pts/0: bump trace_exec gadget to v0.55.0+

Open Beginner friendly
#975 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
78/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
go, kubernetes
Domain
security

Research direction

Start with the gadget pin and exec tracer reference in pkg/containerwatcher/v2/tracers/exec.go, then read Test_35_ExecTTYFieldTest for the expected /dev/pts/0 behavior. Verify the trace_exec gadget is updated to v0.55.0 and run the relevant tests or reproduction rules to confirm hasTty and ttyMajor work for both terminals.

Written by the indexing model from the issue text.

Description

Description

Hi 👋, and thanks for the TTY fields and the very clear docs/features/exec-tty-field.md!

event.hasTty is false for a shell on /dev/pts/0, which is where the first kubectl exec -it into a container lands. node-agent pins ghcr.io/inspektor-gadget/gadget/trace_exec:v0.48.1 (pkg/containerwatcher/v2/tracers/exec.go), which only emits the tty index, so has(event.ttyMajor) is never true and hasTty falls back to an index where 0 means both "no terminal" and /dev/pts/0.

Good news: inspektor-gadget/inspektor-gadget#5714 landed in v0.55.0 and emits the terminal device number. Since node-agent already reads tty_major when it's present, a gadget bump might be all it takes.

Environment

OS: Amazon Linux 2023 (EKS 1.34), kernel 6.12, arm64, containerd 2.2
Version: node-agent v0.3.219 (kubescape-operator chart 1.40.4)

Steps To Reproduce

  1. Bind these three rules to a namespace running a busybox pod (sleep as its command):
    - id: TLX901 # control
      expressions:
        message: "'control: ' + event.comm + ' tty=' + string(event.tty)"
        uniqueId: "event.comm + '_' + string(event.pid)"
        ruleExpression:
          - eventType: exec
            expression: 'event.comm == "sh"'
    - id: TLX902
      # same, with expression: 'event.comm == "sh" && event.hasTty'
    - id: TLX903
      # same, with expression: 'event.comm == "sh" && has(event.ttyMajor)'
    
  2. kubectl exec -it <pod> -- sh -c 'tty; sleep 3' → prints /dev/pts/0
  3. kubectl exec -it <pod> -- sh -c 'tty; sleep 5' while a pts index is still held → prints /dev/pts/1

Expected behavior

All three rules fire for both shells: each has a terminal (major 136).

Actual Behavior

Terminal TLX901 control TLX902 hasTty TLX903 has(ttyMajor) tty
/dev/pts/0 fired not fired not fired 0
/dev/pts/1 fired fired not fired 1

Additional context

This matches the phase-1 expectations in Test_35_ExecTTYFieldTest (c-pts0=0), and v0.3.231 still pins the same gadget. Our use case is a rule reporting interactive shells that stays quiet for containers whose start command is a shell (sh -c ... in CronJobs). For now we keep a per-workload exception list, which we'd happily drop. Happy to help test a bump. Thanks!

Dominant language
Go
Stars
37
Forks
28
Avg merge
23h 31m
Merged PRs (30d)
29

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from kubescape/node-agent

All issues in kubescape/node-agent

Similar issues

More Go issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.