Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

event: set_task_comm #1811

Merged
merged 1 commit into from
Jun 16, 2022
Merged

event: set_task_comm #1811

merged 1 commit into from
Jun 16, 2022

Conversation

roikol
Copy link
Contributor

@roikol roikol commented Jun 8, 2022 •
edited
Loading

create new event indicating process name change

Initial Checklist

  • There is an issue describing the need for this PR.
  • Git log contains summary of the change.
  • Git log contains motivation and context of the change.
  • If part of an EPIC, PR git log contains EPIC number.
  • If part of an EPIC, PR was added to EPIC description.

Description (git log)

using __set_task_comm kprobe to indicate event of process name change

Fixes: #1810

Type of change

  • Bug fix (non-breaking change fixing an issue, preferable).
  • Quick fix (minor non-breaking change requiring no issue, use with care)
  • Code refactor (code improvement and/or code removal)
  • New feature (non-breaking change adding functionality).
  • Breaking change (cause existing functionality not to work as expected).

How Has This Been Tested?

Tests being included in this PR:

  • Test File A
  • Test File B

Reproduce the test by running:

  • command 01
  • command 02

Final Checklist:

Pick "Bug Fix" or "Feature", delete the other and mark appropriate checks.

  • I have made corresponding changes to the documentation.
  • My code follows the style guidelines (C and Go) of this project.
  • I have performed a self-review of my own code.
  • I have commented all functions/methods created explaining what they do.
  • I have commented my code, particularly in hard-to-understand areas.
  • My changes generate no new warnings.
  • I have added tests that prove my fix, or feature, is effective.
  • New and existing unit tests pass locally with my changes.
  • Any dependent changes have been merged and published before.

Git Log Checklist:

My commits logs have:

  • Subject starts with "subsystem|file: description".
  • Do not end the subject line with a period.
  • Limit the subject line to 50 characters.
  • Separate subject from body with a blank line.
  • Use the imperative mood in the subject line.
  • Wrap the body at 72 characters.
  • Use the body to explain what and why instead of how.

yanivagman
yanivagman requested changes Jun 8, 2022
View reviewed changes
Copy link
Collaborator

@yanivagman yanivagman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You should probably use task_rename tracepoint which is more stable than this kprobe:
https://elixir.bootlin.com/linux/v5.18.2/source/fs/exec.c#L1231

@roikol
Copy link
Contributor Author

roikol commented Jun 8, 2022

You should probably use task_rename tracepoint which is more stable than this kprobe: https://elixir.bootlin.com/linux/v5.18.2/source/fs/exec.c#L1231

thanks @yanivagman !
i've updated the PR so now it works with the tracepoint.

@roikol roikol requested a review from yanivagman June 8, 2022 14:17
yanivagman
yanivagman reviewed Jun 8, 2022
View reviewed changes
pkg/ebpf/c/tracee.bpf.c Outdated
// this tracepoint is invoked for task renaming - this also happens when a process first starts.
// so check if this is new execution or not.
// this arg was inspired by __set_task_comm() - https://elixir.bootlin.com/linux/v5.18.2/source/fs/exec.c#L1228.
bool exec = (get_task_host_pid(tsk) == get_task_host_tgid(tsk));
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is that always true?
What if the main thread (which has tgid) renamed itself?

Copy link
Contributor Author

@roikol roikol Jun 16, 2022 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

your'e right, good point.

i think the way to tackle this is to create a map indicating an exec. this map would be updated in sched_process_fork, and deleted from in sched_process_exec and task_rename.

another is option is to go back to using kprobe __set_task_comm (https://elixir.bootlin.com/linux/latest/source/fs/exec.c#L1228) which gets this information as an argument.

WDYT?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

can't we just check if the current syscall is execve/execveat?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes we can

@roikol
event: task_rename
4863a90 
create new event indicating process name change
yanivagman
yanivagman reviewed Jun 16, 2022
View reviewed changes
pkg/ebpf/c/tracee.bpf.c
if (data.options & OPT_SHOW_SYSCALL) {
syscall_data_t *sys = bpf_map_lookup_elem(&syscall_data_map, &data.context.host_tid);
if (sys) {
save_to_submit_buf(&data, (void *) &sys->id, sizeof(int), 2);
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As you now send it as an argument, let's add this to the argument parser to get the syscall name

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i've added it to argprinters.go. should i do it elsewhere?

Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

sorry, I missed that

yanivagman
yanivagman approved these changes Jun 16, 2022
View reviewed changes
Copy link
Collaborator

@yanivagman yanivagman left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@yanivagman yanivagman merged commit 9b77a4c into aquasecurity:main Jun 16, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@yanivagman yanivagman yanivagman approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

[FEAT] create event of process name change
2 participants
@roikol @yanivagman