Add sentry/task_exit point

Updates #4805

PiperOrigin-RevId: 445222912

examples/seccheck/pod_init.json

@@ -7,6 +7,9 @@
       },
       {
         "name": "sentry/clone"
+      },
+      {
+        "name": "sentry/task_exit"
       }
     ],
     "sinks": [

examples/seccheck/server.cc

@@ -72,6 +72,7 @@ std::map<std::string, Callback> dispatchers = {
     {"gvisor.sentry.ExecveInfo", unpack<::gvisor::sentry::ExecveInfo>},
     {"gvisor.sentry.ExitNotifyParentInfo",
      unpack<::gvisor::sentry::ExitNotifyParentInfo>},
+    {"gvisor.sentry.TaskExit", unpack<::gvisor::sentry::TaskExit>},
 };
 
 void unpack(const absl::string_view buf) {

pkg/sentry/kernel/task_exit.go

@@ -204,6 +204,21 @@ type runExitMain struct{}
 
 func (*runExitMain) execute(t *Task) taskRunState {
 	t.traceExitEvent()
+
+	if seccheck.Global.Enabled(seccheck.PointTaskExit) {
+		info := &pb.TaskExit{
+			ExitStatus: int32(t.tg.exitStatus),
+		}
+		fields := seccheck.Global.GetFieldSet(seccheck.PointTaskExit)
+		if !fields.Context.Empty() {
+			info.ContextData = &pb.ContextData{}
+			LoadSeccheckData(t, fields.Context, info.ContextData)
+		}
+		seccheck.Global.SendToCheckers(func(c seccheck.Checker) error {
+			return c.TaskExit(t, fields, info)
+		})
+	}
+
 	lastExiter := t.exitThreadGroup()
 
 	t.ResetKcov()

pkg/sentry/seccheck/checkers/remote/remote.go

@@ -174,6 +174,13 @@ func (r *Remote) ExitNotifyParent(_ context.Context, _ seccheck.FieldSet, info *
 	return nil
 }
 
+// TaskExit implements seccheck.Checker.
+func (r *Remote) TaskExit(_ context.Context, _ seccheck.FieldSet, info *pb.TaskExit) error {
+	r.write(info)
+	return nil
+}
+
+// ContainerStart implements seccheck.Checker.
 func (r *Remote) ContainerStart(_ context.Context, _ seccheck.FieldSet, info *pb.Start) error {
 	r.write(info)
 	return nil

pkg/sentry/seccheck/metadata.go

@@ -192,4 +192,9 @@ func init() {
 		Name:          "sentry/exit_notify_parent",
 		ContextFields: defaultContextFields,
 	})
+	registerPoint(PointDesc{
+		ID:            PointTaskExit,
+		Name:          "sentry/task_exit",
+		ContextFields: defaultContextFields,
+	})
 }

pkg/sentry/seccheck/points/sentry.proto

@@ -65,3 +65,11 @@ message ExitNotifyParentInfo {
   // by wait*().
   int32 exit_status = 2;
 }
+
+message TaskExit {
+  gvisor.common.ContextData context_data = 1;
+
+  // ExitStatus is the exiting thread group's exit status, as reported
+  // by wait*().
+  int32 exit_status = 2;
+}

pkg/sentry/seccheck/seccheck.go

@@ -32,6 +32,7 @@ const (
 	PointExecve
 	PointExitNotifyParent
 	PointContainerStart
+	PointTaskExit
 	// Add new Points above this line.
 	pointLength
 
@@ -117,6 +118,7 @@ type Checker interface {
 	Clone(ctx context.Context, fields FieldSet, info *pb.CloneInfo) error
 	Execve(ctx context.Context, fields FieldSet, info *pb.ExecveInfo) error
 	ExitNotifyParent(ctx context.Context, fields FieldSet, info *pb.ExitNotifyParentInfo) error
+	TaskExit(context.Context, FieldSet, *pb.TaskExit) error
 	ContainerStart(context.Context, FieldSet, *pb.Start) error
 }
 
@@ -146,6 +148,11 @@ func (CheckerDefaults) ContainerStart(context.Context, FieldSet, *pb.Start) erro
 	return nil
 }
 
+// TaskExit implements Checker.TaskExit.
+func (CheckerDefaults) TaskExit(context.Context, FieldSet, *pb.TaskExit) error {
+	return nil
+}
+
 // PointReq indicates what Point a corresponding Checker runs at, and what
 // information it requires at those Points.
 type PointReq struct {