fix(userspace/libsinsp): use comm file instead of status to get proc comm

[FedeDP]

What type of PR is this?

/kind bug

Any specific area of the project related to this PR?

/area libscap

What this PR does / why we need it:

When scanning proc from scap, make sure to use comm file to parse threadinfo comm field, instead of using status file and grepping for Name:%1024s. Also, using sscanf in that way does not support strings with spaces, ie: if a status file was like

Name: foo bar

we would only load foo.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

fix(userspace/libsinsp): use `comm` file instead of `status` to get proc comm

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [FedeDP]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[FedeDP]

/milestone 0.20.0

[github-actions]

Perf diff from master - unit tests

     9.90%     -0.94%  [.] sinsp::next
     5.82%     +0.76%  [.] next_event_from_file
     3.19%     -0.63%  [.] sinsp_parser::process_event
     2.33%     +0.61%  [.] next
     4.78%     +0.51%  [.] gzfile_read
     9.66%     -0.42%  [.] sinsp_parser::reset
     8.21%     -0.39%  [.] sinsp_evt::get_type
     0.47%     +0.39%  [.] std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >::_M_construct<char*>
     0.71%     -0.32%  [.] sinsp_fdtable::find
     1.13%     +0.30%  [.] std::_Hashtable<unsigned long, std::pair<unsigned long const, std::shared_ptr<ppm_evt_hdr> >, std::allocator<std::pair<unsigned long const, std::shared_ptr<ppm_evt_hdr> > >, std::__detail::_Select1st, std::equal_to<unsigned long>, std::hash<unsigned long>, std::__detail::_Mod_range_hashing, std::__detail::_Default_ranged_hash, std::__detail::_Prime_rehash_policy, std::__detail::_Hashtable_traits<false, false, true> >::_M_find_before_node

Heap diff from master - unit tests

peak heap memory consumption: 2B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Heap diff from master - scap file

peak heap memory consumption: 2B
peak RSS (including heaptrack overhead): 0B
total memory leaked: 0B

Benchmarks diff from master

Comparing gbench_data.json to /root/actions-runner/_work/libs/libs/build/gbench_data.json
Benchmark                                                         Time             CPU      Time Old      Time New       CPU Old       CPU New
----------------------------------------------------------------------------------------------------------------------------------------------
BM_sinsp_split_mean                                            -0.0493         -0.0492           152           145           152           145
BM_sinsp_split_median                                          -0.0468         -0.0467           152           144           152           144
BM_sinsp_split_stddev                                          -0.4997         -0.4999             2             1             2             1
BM_sinsp_split_cv                                              -0.4738         -0.4741             0             0             0             0
BM_sinsp_concatenate_paths_relative_path_mean                  +0.0213         +0.0214            56            57            56            57
BM_sinsp_concatenate_paths_relative_path_median                +0.0309         +0.0310            55            57            55            57
BM_sinsp_concatenate_paths_relative_path_stddev                -0.8726         -0.8725             1             0             1             0
BM_sinsp_concatenate_paths_relative_path_cv                    -0.8752         -0.8752             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_mean                     +0.0386         +0.0386            24            25            24            25
BM_sinsp_concatenate_paths_empty_path_median                   +0.0312         +0.0313            24            25            24            25
BM_sinsp_concatenate_paths_empty_path_stddev                   +5.7653         +5.7721             0             0             0             0
BM_sinsp_concatenate_paths_empty_path_cv                       +5.5142         +5.5205             0             0             0             0
BM_sinsp_concatenate_paths_absolute_path_mean                  +0.0285         +0.0286            54            56            54            56
BM_sinsp_concatenate_paths_absolute_path_median                +0.0335         +0.0336            54            56            54            56
BM_sinsp_concatenate_paths_absolute_path_stddev                -0.8689         -0.8690             2             0             2             0
BM_sinsp_concatenate_paths_absolute_path_cv                    -0.8725         -0.8726             0             0             0             0
BM_sinsp_split_container_image_mean                            -0.0156         -0.0155           394           388           394           388
BM_sinsp_split_container_image_median                          -0.0095         -0.0095           392           388           392           388
BM_sinsp_split_container_image_stddev                          -0.6631         -0.6628             5             2             5             2
BM_sinsp_split_container_image_cv                              -0.6577         -0.6575             0             0             0             0

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 75.19%. Comparing base (230ddfb) to head (1120ca4).
Report is 4 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2197      +/-   ##
==========================================
- Coverage   75.19%   75.19%   -0.01%     
==========================================
  Files         259      259              
  Lines       33875    33878       +3     
  Branches     5800     5801       +1     
==========================================
+ Hits        25473    25475       +2     
- Misses       8402     8403       +1     

Flag	Coverage Δ
libsinsp	75.19% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[github-actions]

X64 kernel testing matrix

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-4.19	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2-5.10	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2-5.15	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	🟢
amazonlinux2023-6.1	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.0	🟢	🟢	🟢	🟢	🟢	🟢
archlinux-6.7	🟢	🟢	🟢	🟢	🟢	🟢
centos-3.10	🟢	🟢	🟢	🟡	🟡	🟡
centos-4.18	🟢	🟢	🟢	🟢	🟢	🟢
centos-5.14	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.17	🟢	🟢	🟢	🟢	🟢	🟢
fedora-5.8	🟢	🟢	🟢	🟢	🟢	🟢
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-3.10	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-4.14	🟢	🟢	🟢	🟢	🟢	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-5.4	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-4.15	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-5.8	🟢	🟢	🟢	🟢	🟢	🟡
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

ARM64 kernel testing matrix

KERNEL	CMAKE-CONFIGURE	KMOD BUILD	KMOD SCAP-OPEN	BPF-PROBE BUILD	BPF-PROBE SCAP-OPEN	MODERN-BPF SCAP-OPEN
amazonlinux2-5.4	🟢	🟢	🟢	🟢	🟢	🟡
amazonlinux2022-5.15	🟢	🟢	🟢	🟢	🟢	🟢
fedora-6.2	🟢	🟢	🟢	🟢	🟢	🟢
oraclelinux-4.14	🟢	🟢	🟢	🟡	🟡	🟡
oraclelinux-5.15	🟢	🟢	🟢	🟢	🟢	🟢
ubuntu-6.5	🟢	🟢	🟢	🟢	🟢	🟢

[leogr]

Good catch! 👍

SGTM, just some nits:

1. See my comment below
2. I guess we need to update the documentation of the proc.name and switch from /proc/PID/status to /proc/PID/comm
   

   libs/userspace/libsinsp/sinsp_filtercheck_thread.cpp

   Line 114 in 0fd43cb

   "from the syscalls args or, as a fallback, extracted from /proc/PID/status. The name of "

[FedeDP]

@leogr fixed the filtercheck description, thanks for the catch!