[Backport 7.76.x] [networks] Remove faulty PID reuse detection logic

pkg/network/containers/container_item_linux.go

@@ -27,7 +27,6 @@ import (
 	"github.com/DataDog/datadog-agent/pkg/util/funcs"
 	utilintern "github.com/DataDog/datadog-agent/pkg/util/intern"
 	"github.com/DataDog/datadog-agent/pkg/util/kernel"
-	"github.com/DataDog/datadog-agent/pkg/util/log"
 )
 
 var hostRoot = funcs.MemoizeNoError(func() string {
@@ -51,13 +50,11 @@ type resolvConfReader interface {
 type containerReader struct {
 	resolvConfReader
 	isProcessStillRunning func(ctx context.Context, entry *events.Process) (bool, error)
-	debugLimit            *log.Limit
 }
 
-func newContainerReader(reader resolvConfReader, debugLimit *log.Limit) containerReader {
+func newContainerReader(reader resolvConfReader) containerReader {
 	cr := containerReader{
 		resolvConfReader: reader,
-		debugLimit:       debugLimit,
 	}
 	cr.isProcessStillRunning = cr.isProcessStillRunningImpl
 	return cr
@@ -199,36 +196,12 @@ func errIsProcessNotRunning(err error) bool {
 }
 
 func (cr *containerReader) isProcessStillRunningImpl(ctx context.Context, entry *events.Process) (bool, error) {
-	proc, err := process.NewProcessWithContext(ctx, int32(entry.Pid))
+	_, err := process.NewProcessWithContext(ctx, int32(entry.Pid))
 	if errIsProcessNotRunning(err) {
 		return false, nil
 	}
 	if err != nil {
 		return false, fmt.Errorf("isProcessStillRunning failed to create NewProcessWithContext: %w", err)
 	}
-
-	createTime, err := proc.CreateTimeWithContext(ctx)
-	if errIsProcessNotRunning(err) {
-		return false, nil
-	}
-	if err != nil {
-		return false, fmt.Errorf("isProcessStillRunning failed to get createTime: %w", err)
-	}
-	// StartTime is recorded as nanoseconds by security's EBPFResolver
-	createTime *= int64(time.Millisecond)
-
-	// detect (rare) PID reuse by comparing the StartTime
-	if entry.StartTime != createTime {
-		if log.ShouldLog(log.DebugLvl) && cr.debugLimit.ShouldLog() {
-			logDetectedProcessReuse(entry, createTime)
-		}
-		return false, nil
-	}
-
 	return true, nil
 }
-
-// logDetectedProcessReuse logs in a separate function to avoid allocation
-func logDetectedProcessReuse(entry *events.Process, newTime int64) {
-	log.Debugf("CNM ContainerStore detected process reuse on pid=%d: timestamps %d vs %d", entry.Pid, entry.StartTime, newTime)
-}

pkg/network/containers/container_item_linux_test.go

@@ -13,14 +13,12 @@ import (
 	"os"
 	"strings"
 	"testing"
-	"time"
 
 	"github.com/shirou/gopsutil/v4/process"
 	"github.com/stretchr/testify/require"
 	"go4.org/intern"
 
 	"github.com/DataDog/datadog-agent/pkg/network/events"
-	"github.com/DataDog/datadog-agent/pkg/util/log"
 )
 
 func TestStripResolvConf(t *testing.T) {
@@ -270,7 +268,6 @@ func TestReadContainerItemProcessRunningVsNotRunning(t *testing.T) {
 					result: tt.readResolvConfResult,
 					err:    tt.readResolvConfErr,
 				},
-				log.NewLogLimit(999, time.Second),
 			)
 			// Override isProcessStillRunning for mocking
 			cr.isProcessStillRunning = func(_ context.Context, _ *events.Process) (bool, error) {

pkg/network/containers/container_store_linux.go

@@ -107,7 +107,7 @@ func NewContainerStore(maxContainers int) (*ContainerStore, error) {
 		errorLimit: errorLimit,
 		debugLimit: debugLimit,
 
-		containerReader: newContainerReader(makeResolvStripper(resolvConfInputMaxSizeBytes), debugLimit),
+		containerReader: newContainerReader(makeResolvStripper(resolvConfInputMaxSizeBytes)),
 	}
 	// this function is only ever replaced in tests for mocking purposes
 	cs.readContainerItem = cs.containerReader.readContainerItem

pkg/network/tracer/tracer_linux_test.go

@@ -3381,8 +3381,8 @@ func (s *TracerSuite) TestDNSWorkload() {
 	// Container ID resolution (not resolv.conf resolution) fails in this test before 5.11.
 	// I think it's related to this patch:
 	// https://github.com/torvalds/linux/commit/3ae700ecfae913316e3b4fe5f60c72b6131aaa1f#diff-360c5854af72f475f4ebbf588f1c163c9b9694f618088f5ff1e399b36e339901
-	// It changes the way that timestamps are offered in /proc/<pid>/stat.
-	// It's likely my test's injection of process events via HandleEvents is wrong on older kernels
+	// It changes the way that timestamps are offered in /proc/<pid>/stat to respect time namespaces.
+	// This means the processCache doesn't always work properly in pre-5.11
 	if kv < kernel.VersionCode(5, 11, 0) {
 		t.Skip("Not supported before 5.11")
 	}