From 97ac3c4895e454916ac82dbbb574e3ed5a91b91c Mon Sep 17 00:00:00 2001 From: Roberto Scolaro Date: Thu, 9 May 2024 20:47:09 +0000 Subject: [PATCH] fix(deps): apply patch to enable podman on scap files Signed-off-by: Roberto Scolaro --- .../falcosecurity-libs-repo/CMakeLists.txt | 1 + .../falcosecurity-libs-repo/podman.patch | 673 ++++++++++++++++++ 2 files changed, 674 insertions(+) create mode 100644 cmake/modules/falcosecurity-libs-repo/podman.patch diff --git a/cmake/modules/falcosecurity-libs-repo/CMakeLists.txt b/cmake/modules/falcosecurity-libs-repo/CMakeLists.txt index eed2f34727..c11c9ef72e 100644 --- a/cmake/modules/falcosecurity-libs-repo/CMakeLists.txt +++ b/cmake/modules/falcosecurity-libs-repo/CMakeLists.txt @@ -31,4 +31,5 @@ ExternalProject_Add( BUILD_COMMAND "" INSTALL_COMMAND "" TEST_COMMAND "" + PATCH_COMMAND sh -c "patch -p1 <${CMAKE_SOURCE_DIR}/podman.patch" ) diff --git a/cmake/modules/falcosecurity-libs-repo/podman.patch b/cmake/modules/falcosecurity-libs-repo/podman.patch new file mode 100644 index 0000000000..2850d7ef36 --- /dev/null +++ b/cmake/modules/falcosecurity-libs-repo/podman.patch @@ -0,0 +1,673 @@ +diff --git a/test/drivers/test_suites/syscall_exit_suite/fork_x.cpp b/test/drivers/test_suites/syscall_exit_suite/fork_x.cpp +index 5fe38ee9c..5f5c32892 100644 +--- a/test/drivers/test_suites/syscall_exit_suite/fork_x.cpp ++++ b/test/drivers/test_suites/syscall_exit_suite/fork_x.cpp +@@ -132,9 +132,9 @@ TEST(SyscallExit, forkX_father) + + TEST(SyscallExit, forkX_child) + { +- auto evt_test = new event_test(__NR_fork, EXIT_EVENT); ++ event_test evt_test(__NR_fork, EXIT_EVENT); + +- evt_test->enable_capture(); ++ evt_test.enable_capture(); + + /*=============================== TRIGGER SYSCALL ===========================*/ + +@@ -166,7 +166,7 @@ TEST(SyscallExit, forkX_child) + + /*=============================== TRIGGER SYSCALL ===========================*/ + +- evt_test->disable_capture(); ++ evt_test.disable_capture(); + + /* In some architectures we are not able to catch the `clone exit child + * event` from the `sys_exit` tracepoint. This is because there is no +@@ -174,61 +174,61 @@ TEST(SyscallExit, forkX_child) + * info in `driver/feature_gates.h`. + */ + #ifdef CAPTURE_SCHED_PROC_FORK +- evt_test->assert_event_absence(ret_pid); ++ evt_test.assert_event_absence(ret_pid); + #else +- evt_test->assert_event_presence(ret_pid); ++ evt_test.assert_event_presence(ret_pid); + + if(HasFatalFailure()) + { + return; + } + +- evt_test->parse_event(); ++ evt_test.parse_event(); + +- evt_test->assert_header(); ++ evt_test.assert_header(); + + /*=============================== ASSERT PARAMETERS ===========================*/ + + /* Parameter 1: res (type: PT_PID)*/ +- evt_test->assert_numeric_param(1, (int64_t)0); ++ evt_test.assert_numeric_param(1, (int64_t)0); + + /* Parameter 2: exe (type: PT_CHARBUF) */ + #ifndef __powerpc64__ // Page fault +- evt_test->assert_charbuf_param(2, info.args[0]); ++ evt_test.assert_charbuf_param(2, info.args[0]); + + /* Parameter 3: args (type: PT_CHARBUFARRAY) */ + /* Starting from `1` because the first is `exe`. */ +- evt_test->assert_charbuf_array_param(3, &info.args[1]); ++ evt_test.assert_charbuf_array_param(3, &info.args[1]); + #endif + /* Parameter 4: tid (type: PT_PID) */ +- evt_test->assert_numeric_param(4, (int64_t)ret_pid); ++ evt_test.assert_numeric_param(4, (int64_t)ret_pid); + + /* Parameter 5: pid (type: PT_PID) */ + /* We are the main thread of the process so it's equal to `tid`. */ +- evt_test->assert_numeric_param(5, (int64_t)ret_pid); ++ evt_test.assert_numeric_param(5, (int64_t)ret_pid); + + /* Parameter 6: ptid (type: PT_PID) */ +- evt_test->assert_numeric_param(6, (int64_t)::getpid()); ++ evt_test.assert_numeric_param(6, (int64_t)::getpid()); + + /* Parameter 7: cwd (type: PT_CHARBUF) */ + /* leave the current working directory empty like in the old probe. */ +- evt_test->assert_empty_param(7); ++ evt_test.assert_empty_param(7); + + /* Parameter 14: comm (type: PT_CHARBUF) */ +- evt_test->assert_charbuf_param(14, TEST_EXECUTABLE_NAME); ++ evt_test.assert_charbuf_param(14, TEST_EXECUTABLE_NAME); + + /* Parameter 15: cgroups (type: PT_CHARBUFARRAY) */ +- evt_test->assert_cgroup_param(15); ++ evt_test.assert_cgroup_param(15); + + /* Parameter 16: flags (type: PT_FLAGS32) */ +- evt_test->assert_numeric_param(16, (uint32_t)0); ++ evt_test.assert_numeric_param(16, (uint32_t)0); + + /* Parameter 21: pid_namespace init task start_time monotonic time in ns (type: PT_UINT64) */ +- evt_test->assert_numeric_param(21, (uint64_t)0, GREATER_EQUAL); ++ evt_test.assert_numeric_param(21, (uint64_t)0, GREATER_EQUAL); + + /*=============================== ASSERT PARAMETERS ===========================*/ + +- evt_test->assert_num_params_pushed(21); ++ evt_test.assert_num_params_pushed(21); + + #endif + } +diff --git a/userspace/libsinsp/container_engine/docker/podman.cpp b/userspace/libsinsp/container_engine/docker/podman.cpp +index e42f2c7bd..3ed3daed5 100644 +--- a/userspace/libsinsp/container_engine/docker/podman.cpp ++++ b/userspace/libsinsp/container_engine/docker/podman.cpp +@@ -191,12 +191,20 @@ bool podman::resolve(sinsp_threadinfo *tinfo, bool query_os_for_missing_info) + { + std::string container_id, api_sock; + +- if(m_api_sock_can_exist == nullptr) ++ if(!m_api_sock_can_exist.has_value()) + { +- m_api_sock_can_exist.reset(new bool(can_api_sock_exist())); ++ if (query_os_for_missing_info) ++ { ++ m_api_sock_can_exist = can_api_sock_exist(); ++ } ++ else ++ { ++ // Short-circuit: always enable podman when running from a capture file. ++ m_api_sock_can_exist = true; ++ } + } + +- if(! (*(m_api_sock_can_exist.get()))) ++ if(!m_api_sock_can_exist.value()) + { + return false; + } +diff --git a/userspace/libsinsp/container_engine/docker/podman.h b/userspace/libsinsp/container_engine/docker/podman.h +index 15e9eccb5..28d43734f 100644 +--- a/userspace/libsinsp/container_engine/docker/podman.h ++++ b/userspace/libsinsp/container_engine/docker/podman.h +@@ -2,6 +2,8 @@ + + #include + ++#include ++ + namespace libsinsp { + namespace container_engine { + +@@ -16,7 +18,7 @@ private: + + // true if any file matching any possible api socket pattern + // exists. Is set at the first call to resolve() +- std::unique_ptr m_api_sock_can_exist; ++ std::optional m_api_sock_can_exist; + + // Return true if any possible api socket pattern exists. + bool can_api_sock_exist(); +diff --git a/userspace/libsinsp/fdinfo.h b/userspace/libsinsp/fdinfo.h +index c66589135..31302a671 100644 +--- a/userspace/libsinsp/fdinfo.h ++++ b/userspace/libsinsp/fdinfo.h +@@ -120,9 +120,7 @@ public: + + virtual std::unique_ptr clone() const + { +- auto ret = std::make_unique(); +- *(ret.get()) = *this; +- return ret; ++ return std::make_unique(*this); + } + + /*! +@@ -462,7 +460,7 @@ public: + { + for(auto it = m_table.begin(); it != m_table.end(); ++it) + { +- if (!callback(it->first, *(it->second.get()))) ++ if (!callback(it->first, *it->second)) + { + return false; + } +@@ -474,7 +472,7 @@ public: + { + for(auto it = m_table.begin(); it != m_table.end(); ++it) + { +- if (!callback(it->first, *(it->second.get()))) ++ if (!callback(it->first, *it->second)) + { + return false; + } +diff --git a/userspace/libsinsp/filter.cpp b/userspace/libsinsp/filter.cpp +index 300ce5c62..e1a741a8a 100644 +--- a/userspace/libsinsp/filter.cpp ++++ b/userspace/libsinsp/filter.cpp +@@ -192,30 +192,25 @@ void sinsp_filter::add_check(std::unique_ptr chk) + sinsp_filter_compiler::sinsp_filter_compiler( + sinsp* inspector, + const std::string& fltstr) ++ : m_flt_str(fltstr), ++ m_factory(std::make_shared(inspector, m_default_filterlist)) + { +- m_factory.reset(new sinsp_filter_factory(inspector, m_default_filterlist)); +- m_filter = NULL; +- m_flt_str = fltstr; +- m_flt_ast = NULL; + } + + sinsp_filter_compiler::sinsp_filter_compiler( + std::shared_ptr factory, + const std::string& fltstr) ++ : m_flt_str(fltstr), ++ m_factory(factory) + { +- m_factory = factory; +- m_filter = NULL; +- m_flt_str = fltstr; +- m_flt_ast = NULL; + } + + sinsp_filter_compiler::sinsp_filter_compiler( + std::shared_ptr factory, + const libsinsp::filter::ast::expr* fltast) ++ : m_flt_ast(fltast), ++ m_factory(factory) + { +- m_factory = factory; +- m_filter = NULL; +- m_flt_ast = fltast; + } + + std::unique_ptr sinsp_filter_compiler::compile() +diff --git a/userspace/libsinsp/filter.h b/userspace/libsinsp/filter.h +index 734cf7a00..90a5816f5 100644 +--- a/userspace/libsinsp/filter.h ++++ b/userspace/libsinsp/filter.h +@@ -258,7 +258,7 @@ private: + std::unique_ptr m_filter; + std::vector m_field_values; + std::shared_ptr m_internal_flt_ast; +- const libsinsp::filter::ast::expr* m_flt_ast; ++ const libsinsp::filter::ast::expr* m_flt_ast = nullptr; + std::shared_ptr m_factory; + sinsp_filter_check_list m_default_filterlist; + }; +diff --git a/userspace/libsinsp/mpsc_priority_queue.h b/userspace/libsinsp/mpsc_priority_queue.h +index 0348efd36..567c30982 100644 +--- a/userspace/libsinsp/mpsc_priority_queue.h ++++ b/userspace/libsinsp/mpsc_priority_queue.h +@@ -111,7 +111,7 @@ public: + // we just checked. + elm_ptr top = m_queue_top.load(); + auto should_pop = pred(*top); +- ++ + // we must not pop the element + if (!should_pop) + { +@@ -166,8 +166,8 @@ private: + // gives the same result when inverting the operands, then we can + // assume them being equal. + Cmp c{}; +- auto res = c(*elm.get(), *r.elm.get()); +- if (res == c(*r.elm.get(), *elm.get())) ++ auto res = c(*elm, *r.elm); ++ if (res == c(*r.elm, *elm)) + { + // if elements have the same priority, order them by + // temporal order of arrival in the queue by using an atomic +diff --git a/userspace/libsinsp/sinsp_filtercheck_container.cpp b/userspace/libsinsp/sinsp_filtercheck_container.cpp +index 40f4de0ea..1cf79d36c 100644 +--- a/userspace/libsinsp/sinsp_filtercheck_container.cpp ++++ b/userspace/libsinsp/sinsp_filtercheck_container.cpp +@@ -344,6 +344,9 @@ uint8_t* sinsp_filter_check_container::extract_single(sinsp_evt *evt, OUT uint32 + case sinsp_container_type::CT_BPM: + m_tstr = "bpm"; + break; ++ case sinsp_container_type::CT_PODMAN: ++ m_tstr = "podman"; ++ break; + default: + ASSERT(false); + break; +diff --git a/userspace/libsinsp/sinsp_filtercheck_thread.cpp b/userspace/libsinsp/sinsp_filtercheck_thread.cpp +index df460ec1b..c9284edd1 100644 +--- a/userspace/libsinsp/sinsp_filtercheck_thread.cpp ++++ b/userspace/libsinsp/sinsp_filtercheck_thread.cpp +@@ -398,7 +398,8 @@ int32_t sinsp_filter_check_thread::parse_field_name(const char* str, bool alloc_ + if(alloc_state) + { + auto acc = m_inspector->m_thread_manager->dynamic_fields()->add_field("_tmp_sinsp_filter_thread_totexectime"); +- m_thread_dyn_field_accessor.reset(new libsinsp::state::dynamic_struct::field_accessor(acc.new_accessor())); ++ m_thread_dyn_field_accessor = ++ std::make_unique>(acc.new_accessor()); + } + + return sinsp_filter_check::parse_field_name(str, alloc_state, needed_for_filtering); +@@ -416,7 +417,8 @@ int32_t sinsp_filter_check_thread::parse_field_name(const char* str, bool alloc_ + if(alloc_state) + { + auto acc = m_inspector->m_thread_manager->dynamic_fields()->add_field("_tmp_sinsp_filter_thread_cpu"); +- m_thread_dyn_field_accessor.reset(new libsinsp::state::dynamic_struct::field_accessor(acc.new_accessor())); ++ m_thread_dyn_field_accessor = ++ std::make_unique>(acc.new_accessor()); + } + + return sinsp_filter_check::parse_field_name(str, alloc_state, needed_for_filtering); +@@ -488,7 +490,7 @@ uint8_t* sinsp_filter_check_thread::extract_thread_cpu(sinsp_evt *evt, OUT uint3 + tcpu = user + system; + + uint64_t last_t_tot_cpu = 0; +- tinfo->get_dynamic_field(*m_thread_dyn_field_accessor.get(), last_t_tot_cpu); ++ tinfo->get_dynamic_field(*m_thread_dyn_field_accessor, last_t_tot_cpu); + if(last_t_tot_cpu != 0) + { + uint64_t deltaval = tcpu - last_t_tot_cpu; +@@ -503,7 +505,7 @@ uint8_t* sinsp_filter_check_thread::extract_thread_cpu(sinsp_evt *evt, OUT uint3 + m_dval = 0; + } + +- tinfo->set_dynamic_field(*m_thread_dyn_field_accessor.get(), tcpu); ++ tinfo->set_dynamic_field(*m_thread_dyn_field_accessor, tcpu); + + RETURN_EXTRACT_VAR(m_dval); + } +@@ -980,9 +982,9 @@ uint8_t* sinsp_filter_check_thread::extract_single(sinsp_evt *evt, OUT uint32_t* + if(tinfo != NULL) + { + uint64_t ptot = 0; +- tinfo->get_dynamic_field(*m_thread_dyn_field_accessor.get(), ptot); ++ tinfo->get_dynamic_field(*m_thread_dyn_field_accessor, ptot); + m_u64val += ptot; +- tinfo->set_dynamic_field(*m_thread_dyn_field_accessor.get(), m_u64val); ++ tinfo->set_dynamic_field(*m_thread_dyn_field_accessor, m_u64val); + RETURN_EXTRACT_VAR(m_u64val); + } + else +diff --git a/userspace/libsinsp/test/filter_compiler.ut.cpp b/userspace/libsinsp/test/filter_compiler.ut.cpp +index c974cd54a..0082c40c0 100644 +--- a/userspace/libsinsp/test/filter_compiler.ut.cpp ++++ b/userspace/libsinsp/test/filter_compiler.ut.cpp +@@ -83,8 +83,7 @@ public: + void test_filter_run(bool result, string filter_str) + { + sinsp inspector; +- std::shared_ptr factory; +- factory.reset(new mock_compiler_filter_factory(&inspector)); ++ auto factory = std::make_shared(&inspector); + sinsp_filter_compiler compiler(factory, filter_str); + try + { +diff --git a/userspace/libsinsp/test/helpers/scoped_pipe.cpp b/userspace/libsinsp/test/helpers/scoped_pipe.cpp +index 71c7235b2..fdbfd6ecd 100644 +--- a/userspace/libsinsp/test/helpers/scoped_pipe.cpp ++++ b/userspace/libsinsp/test/helpers/scoped_pipe.cpp +@@ -30,7 +30,7 @@ limitations under the License. + + using namespace test_helpers; + +-scoped_pipe::scoped_pipe() : m_read_end(), m_write_end() ++scoped_pipe::scoped_pipe() + { + int fds[2] = {}; + +@@ -43,18 +43,18 @@ scoped_pipe::scoped_pipe() : m_read_end(), m_write_end() + throw std::runtime_error(out.str()); + } + +- m_read_end.reset(new scoped_file_descriptor(fds[0])); +- m_write_end.reset(new scoped_file_descriptor(fds[1])); ++ m_read_end = std::make_unique(fds[0]); ++ m_write_end = std::make_unique(fds[1]); + } + + scoped_file_descriptor& scoped_pipe::read_end() + { +- return *m_read_end.get(); ++ return *m_read_end; + } + + scoped_file_descriptor& scoped_pipe::write_end() + { +- return *m_write_end.get(); ++ return *m_write_end; + } + + void scoped_pipe::close() +diff --git a/userspace/libsinsp/test/mpsc_priority_queue.ut.cpp b/userspace/libsinsp/test/mpsc_priority_queue.ut.cpp +index 04b5de556..ba9552c35 100644 +--- a/userspace/libsinsp/test/mpsc_priority_queue.ut.cpp ++++ b/userspace/libsinsp/test/mpsc_priority_queue.ut.cpp +@@ -36,7 +36,7 @@ TEST(mpsc_priority_queue, order_consistency) + return std::greater_equal{}(l.v, r.v); + } + }; +- ++ + using val_t = std::unique_ptr; + + mpsc_priority_queue q; +@@ -98,14 +98,14 @@ TEST(mpsc_priority_queue, single_concurrent_producer) + { + continue; + } +- ++ + if (!q.try_pop(v)) + { + failed++; + continue; + } + +- failed += (*v.get() != i) ? 1 : 0; ++ failed += (*v != i) ? 1 : 0; + i++; + } + +@@ -167,7 +167,7 @@ TEST(mpsc_priority_queue, multi_concurrent_producers) + failed++; + } + +- last_val = *v.get(); ++ last_val = *v; + i++; + } + +diff --git a/userspace/libsinsp/test/plugins.ut.cpp b/userspace/libsinsp/test/plugins.ut.cpp +index b0917f59d..e640a488e 100644 +--- a/userspace/libsinsp/test/plugins.ut.cpp ++++ b/userspace/libsinsp/test/plugins.ut.cpp +@@ -64,83 +64,88 @@ static void add_plugin_filterchecks( + TEST(plugins, broken_source_capability) + { + plugin_api api; +- auto inspector = std::unique_ptr(new sinsp()); +- get_plugin_api_sample_plugin_source(api); + +- // The example plugin has id 999 so `!= 0`. For this reason, +- // the event source name should be different from "syscall" +- api.get_id = [](){ return (uint32_t)999; }; +- api.get_event_source = [](){ return sinsp_syscall_event_source_name; }; +- ASSERT_ANY_THROW(register_plugin_api(inspector.get(), api)); +- +- // `get_event_source` is implemented so also `get_id` should be implemented +- api.get_id = NULL; +- api.get_event_source = [](){ return sinsp_syscall_event_source_name; }; +- ASSERT_ANY_THROW(register_plugin_api(inspector.get(), api)); +- +- // Now both methods are NULL so we are ok! +- api.get_id = NULL; +- api.get_event_source = NULL; +- ASSERT_NO_THROW(register_plugin_api(inspector.get(), api)); ++ { ++ get_plugin_api_sample_plugin_source(api); ++ sinsp inspector; ++ ++ // The example plugin has id 999 so `!= 0`. For this reason, ++ // the event source name should be different from "syscall" ++ api.get_id = [](){ return (uint32_t)999; }; ++ api.get_event_source = [](){ return sinsp_syscall_event_source_name; }; ++ ASSERT_ANY_THROW(register_plugin_api(&inspector, api)); ++ ++ // `get_event_source` is implemented so also `get_id` should be implemented ++ api.get_id = NULL; ++ api.get_event_source = [](){ return sinsp_syscall_event_source_name; }; ++ ASSERT_ANY_THROW(register_plugin_api(&inspector, api)); ++ ++ // Now both methods are NULL so we are ok! ++ api.get_id = NULL; ++ api.get_event_source = NULL; ++ ASSERT_NO_THROW(register_plugin_api(&inspector, api)); ++ } + + // restore inspector and source API +- inspector.reset(new sinsp()); +- get_plugin_api_sample_plugin_source(api); +- +- // `open`, `close`, `next_batch` must be all defined to provide source capability +- api.open = NULL; +- ASSERT_ANY_THROW(register_plugin_api(inspector.get(), api)); +- api.close = NULL; +- ASSERT_ANY_THROW(register_plugin_api(inspector.get(), api)); +- api.next_batch = NULL; +- +- // Now that all the 3 methods are NULL the plugin has no more capabilities +- // so we should throw an exception because every plugin should implement at least one +- // capability +- ASSERT_ANY_THROW(register_plugin_api(inspector.get(), api)); ++ { ++ get_plugin_api_sample_plugin_source(api); ++ sinsp inspector; ++ ++ // `open`, `close`, `next_batch` must be all defined to provide source capability ++ api.open = NULL; ++ ASSERT_ANY_THROW(register_plugin_api(&inspector, api)); ++ api.close = NULL; ++ ASSERT_ANY_THROW(register_plugin_api(&inspector, api)); ++ api.next_batch = NULL; ++ ++ // Now that all the 3 methods are NULL the plugin has no more capabilities ++ // so we should throw an exception because every plugin should implement at least one ++ // capability ++ ASSERT_ANY_THROW(register_plugin_api(&inspector, api)); ++ } + } + + TEST(plugins, broken_extract_capability) + { + plugin_api api; +- auto inspector = std::unique_ptr(new sinsp()); + get_plugin_api_sample_plugin_extract(api); ++ sinsp inspector; + + // `extract_fields` is defined but `get_fields` no + api.get_fields = NULL; +- ASSERT_ANY_THROW(register_plugin_api(inspector.get(), api)); ++ ASSERT_ANY_THROW(register_plugin_api(&inspector, api)); + + // Both NULL, the plugin has no capabilities + api.get_fields = NULL; + api.extract_fields = NULL; +- ASSERT_ANY_THROW(register_plugin_api(inspector.get(), api)); ++ ASSERT_ANY_THROW(register_plugin_api(&inspector, api)); + } + + TEST(plugins, broken_parsing_capability) + { + plugin_api api; +- auto inspector = std::unique_ptr(new sinsp()); + get_plugin_api_sample_syscall_parse(api); ++ sinsp inspector; + + // The plugin has no capabilities + api.parse_event = NULL; +- ASSERT_ANY_THROW(register_plugin_api(inspector.get(), api)); ++ ASSERT_ANY_THROW(register_plugin_api(&inspector, api)); + } + + TEST(plugins, broken_async_capability) + { + plugin_api api; +- auto inspector = std::unique_ptr(new sinsp()); + get_plugin_api_sample_syscall_async(api); ++ sinsp inspector; + + /* `set_async_event_handler` is defined but `get_async_events` is not */ + api.get_async_events = NULL; +- ASSERT_ANY_THROW(register_plugin_api(inspector.get(), api)); ++ ASSERT_ANY_THROW(register_plugin_api(&inspector, api)); + + // Both NULL, the plugin has no capabilities + api.get_async_events = NULL; + api.set_async_event_handler = NULL; +- ASSERT_ANY_THROW(register_plugin_api(inspector.get(), api)); ++ ASSERT_ANY_THROW(register_plugin_api(&inspector, api)); + } + + // scenario: a plugin with field extraction capability compatible with the +@@ -658,7 +663,7 @@ TEST(sinsp_plugin, plugin_logging) + api.get_name = [](){ return "plugin_name"; }; + + libsinsp_logger()->add_callback_log([](std::string&& str, sinsp_logger::severity sev) { +- std::string expected = "plugin_name: initializing plugin..."; ++ std::string expected = "plugin_name: initializing plugin..."; + ASSERT_TRUE(std::equal(expected.rbegin(), expected.rend(), str.rbegin())); + }); + +@@ -667,7 +672,7 @@ TEST(sinsp_plugin, plugin_logging) + + libsinsp_logger()->remove_callback_log(); + libsinsp_logger()->add_callback_log([](std::string&& str, sinsp_logger::severity sev) { +- std::string expected = "plugin_name: destroying plugin..."; ++ std::string expected = "plugin_name: destroying plugin..."; + ASSERT_TRUE(std::equal(expected.rbegin(), expected.rend(), str.rbegin())); + }); + } +@@ -690,7 +695,7 @@ TEST(sinsp_plugin, plugin_set_config) + p->init("", tmp); + + libsinsp_logger()->add_callback_log([](std::string&& str, sinsp_logger::severity sev) { +- std::string expected = "plugin_name: new config!"; ++ std::string expected = "plugin_name: new config!"; + ASSERT_TRUE(std::equal(expected.rbegin(), expected.rend(), str.rbegin())); + }); + +diff --git a/userspace/libsinsp/test/state.ut.cpp b/userspace/libsinsp/test/state.ut.cpp +index 3dd21001f..2caebfdc4 100644 +--- a/userspace/libsinsp/test/state.ut.cpp ++++ b/userspace/libsinsp/test/state.ut.cpp +@@ -206,7 +206,7 @@ TEST(dynamic_struct, defs_and_access) + s.set_dynamic_field(acc_str, std::string("hello")); + s.get_dynamic_field(acc_str, tmpstr); + ASSERT_EQ(tmpstr, std::string("hello")); +- ++ + s.set_dynamic_field(acc_str, std::string("")); + const char* ctmpstr = "sample"; + s.get_dynamic_field(acc_str, ctmpstr); +@@ -251,7 +251,7 @@ TEST(table_registry, defs_and_access) + { + for (const auto& e : m_entries) + { +- if (!pred(*e.second.get())) ++ if (!pred(*e.second)) + { + return false; + } +@@ -306,7 +306,7 @@ TEST(thread_manager, table_access) + + sinsp inspector; + auto table = static_cast*>(inspector.m_thread_manager.get()); +- ++ + // empty table state and info + ASSERT_EQ(table->name(), "threads"); + ASSERT_EQ(table->key_info(), libsinsp::state::typeinfo::of()); +diff --git a/userspace/libsinsp/threadinfo.cpp b/userspace/libsinsp/threadinfo.cpp +index 1358969c6..24fbccbce 100644 +--- a/userspace/libsinsp/threadinfo.cpp ++++ b/userspace/libsinsp/threadinfo.cpp +@@ -272,7 +272,7 @@ void sinsp_threadinfo::add_fd_from_scap(scap_fdinfo *fdi) + { + newfdi->m_flags |= sinsp_fdinfo::FLAGS_SOCKET_CONNECTED; + } +- m_inspector->get_ifaddr_list().update_fd(*(newfdi.get())); ++ m_inspector->get_ifaddr_list().update_fd(*newfdi); + newfdi->m_name = ipv4tuple_to_string(&newfdi->m_sockinfo.m_ipv4info, m_inspector->is_hostname_and_port_resolution_enabled()); + break; + case SCAP_FD_IPV4_SERVSOCK: +@@ -306,7 +306,7 @@ void sinsp_threadinfo::add_fd_from_scap(scap_fdinfo *fdi) + { + newfdi->m_flags |= sinsp_fdinfo::FLAGS_SOCKET_CONNECTED; + } +- m_inspector->get_ifaddr_list().update_fd((*(newfdi.get()))); ++ m_inspector->get_ifaddr_list().update_fd(*newfdi); + newfdi->m_name = ipv4tuple_to_string(&newfdi->m_sockinfo.m_ipv4info, m_inspector->is_hostname_and_port_resolution_enabled()); + } + else +diff --git a/userspace/libsinsp/threadinfo.h b/userspace/libsinsp/threadinfo.h +index 92b40ee2e..814ca3529 100644 +--- a/userspace/libsinsp/threadinfo.h ++++ b/userspace/libsinsp/threadinfo.h +@@ -685,7 +685,7 @@ public: + { + return m_lastevent_type; + } +- ++ + inline void set_lastevent_type(uint16_t v) + { + m_lastevent_type = v; +@@ -695,7 +695,7 @@ public: + { + return m_lastevent_cpuid; + } +- ++ + inline void set_lastevent_cpuid(uint16_t v) + { + m_lastevent_cpuid = v; +@@ -817,7 +817,7 @@ public: + { + for (const auto& it : m_threads) + { +- if (!callback(*it.second.get())) ++ if (!callback(*it.second)) + { + return false; + } +@@ -829,7 +829,7 @@ public: + { + for (auto& it : m_threads) + { +- if (!callback(*it.second.get())) ++ if (!callback(*it.second)) + { + return false; + }