Skip to content

Commit

Permalink
tracee: skip golang plugin for static binaries
Browse files Browse the repository at this point in the history
  • Loading branch information
josedonizetti committed Jun 14, 2023
1 parent d79107c commit 3b908dd
Showing 1 changed file with 30 additions and 0 deletions.
30 changes: 30 additions & 0 deletions pkg/signatures/signature/signature.go
Expand Up @@ -2,6 +2,7 @@ package signature

import (
"bytes"
"debug/elf"
"fmt"
"io/fs"
"os"
Expand Down Expand Up @@ -58,6 +59,11 @@ func Find(target string, partialEval bool, signaturesDir string, signatures []st
func findGoSigs(dir string) ([]detect.Signature, error) {
var res []detect.Signature

if isBinaryStatic() {
logger.Warnw("The tracee static can't load golang signatures. Skipping ...")
return res, nil
}

errWD := filepath.WalkDir(dir,
func(path string, d fs.DirEntry, err error) error {
if err != nil {
Expand Down Expand Up @@ -188,3 +194,27 @@ func isRegoFile(name string) bool {
func isHelper(name string) bool {
return strings.HasSuffix(name, "helpers.rego")
}

func isBinaryStatic() bool {
exePath, err := os.Executable()
if err != nil {
logger.Errorw("Getting executable path: " + err.Error())
return false
}

loadedObject, err := elf.Open(exePath)
if err != nil {
logger.Errorw("Error opening /proc/self/exe", "error", err)
return false
}

defer func() {
if err = loadedObject.Close(); err != nil {
logger.Errorw("Error closing file", "error", err)
}
}()

_, err = loadedObject.DynamicSymbols()

return err != nil
}

0 comments on commit 3b908dd

Please sign in to comment.