Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

handle 32-bit socketcall syscall #3707

Closed
wants to merge 4 commits into from
Closed

handle 32-bit socketcall syscall #3707

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7d3d385
fix(ebpf): 32-bit syscall numbers
geyslan Nov 22, 2023
ebdd285
fix(ebpf): handle x86 32-bit socketcall syscall
geyslan Nov 23, 2023
59158d5
chore: libbpfgo/helpers bump
geyslan Nov 23, 2023
26475aa
feat(events): parse call arg for socketcall
geyslan Nov 23, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
4 changes: 2 additions & 2 deletions go.mod
View file
Open in desktop
Expand Up @@ -6,7 +6,7 @@ require (
github.com/IBM/fluent-forward-go v0.2.1
github.com/Masterminds/sprig/v3 v3.2.3
github.com/aquasecurity/libbpfgo v0.5.0-libbpf-1.2
github.com/aquasecurity/libbpfgo/helpers v0.4.6-0.20230321190037-f591a2c5734f
github.com/aquasecurity/libbpfgo/helpers v0.4.6-0.20231123142329-37c4b843a539
github.com/aquasecurity/tracee/api v0.0.0-20231013014739-b32a168ee6a8
github.com/aquasecurity/tracee/types v0.0.0-20231123143520-9a6b89efc320
github.com/containerd/containerd v1.7.0
Expand All @@ -28,7 +28,7 @@ require (
github.com/urfave/cli/v2 v2.3.0
go.uber.org/goleak v1.2.1
go.uber.org/zap v1.25.0
golang.org/x/sys v0.13.0
golang.org/x/sys v0.14.0
google.golang.org/grpc v1.58.3
google.golang.org/protobuf v1.31.0
gopkg.in/yaml.v2 v2.4.0
Expand Down
8 changes: 4 additions & 4 deletions go.sum
View file
Open in desktop
Expand Up @@ -65,8 +65,8 @@ github.com/agnivade/levenshtein v1.1.1/go.mod h1:veldBMzWxcCG2ZvUTKD2kJNRdCk5hVb
github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
github.com/aquasecurity/libbpfgo v0.5.0-libbpf-1.2 h1:Yywi9wC3GPDOgR8wr6P9geY2qvFqKxH5sctMOssw+MQ=
github.com/aquasecurity/libbpfgo v0.5.0-libbpf-1.2/go.mod h1:0rEApF1YBHGuZ4C8OYI9q5oDBVpgqtRqYATePl9mCDk=
github.com/aquasecurity/libbpfgo/helpers v0.4.6-0.20230321190037-f591a2c5734f h1:l127H3NqJBmw+XMt+haBOeZIrBppuw7TJz26cWMI9kY=
github.com/aquasecurity/libbpfgo/helpers v0.4.6-0.20230321190037-f591a2c5734f/go.mod h1:j/TQLmsZpOIdF3CnJODzYngG4yu1YoDCoRMELxkQSSA=
github.com/aquasecurity/libbpfgo/helpers v0.4.6-0.20231123142329-37c4b843a539 h1:axIHZ3la2/wcqMYO9TUyKO/lMGYizEKyNIodbwQBOkE=
github.com/aquasecurity/libbpfgo/helpers v0.4.6-0.20231123142329-37c4b843a539/go.mod h1:1fGKke5pgH4xYvZ7HqDbLSi/R5zfRFH2K+c9kLp9L34=
github.com/aquasecurity/tracee/api v0.0.0-20231013014739-b32a168ee6a8 h1:NGzPDvQofEG04CoPZjSSRoFMxnSd3Brh39BY1dmdyZM=
github.com/aquasecurity/tracee/api v0.0.0-20231013014739-b32a168ee6a8/go.mod h1:l1W65+m4KGg2i61fiPaQ/o4OQCrNtNnkPTEdysF5Zpw=
github.com/aquasecurity/tracee/types v0.0.0-20231123143520-9a6b89efc320 h1:p98V5N6wwG1TLpHGSeUsXbC96XdkdJDhRkcMo+xxXNE=
Expand Down Expand Up @@ -645,8 +645,8 @@ golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBc
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.3.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.13.0 h1:Af8nKPmuFypiUBjVoU9V20FiaFXOcuZI21p0ycVYYGE=
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
golang.org/x/sys v0.14.0 h1:Vz7Qs629MkJkGyHxUlRHizWJRG2j8fbQKjELVSNhy7Q=
golang.org/x/sys v0.14.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
Expand Down
2 changes: 2 additions & 0 deletions pkg/ebpf/c/common/arch.h
View file
Open in desktop
Expand Up @@ -181,6 +181,8 @@ statfunc struct pt_regs *get_task_pt_regs(struct task_struct *task)
#define SYSCALL_LANDLOCK_RESTRICT_SELF 446
#define SYSCALL_PROCESS_MRELEASE 448

#define SYSCALL_SOCKETCALL 473 // x86 only

#elif defined(bpf_target_arm64)
#define SYSCALL_READ 63
#define SYSCALL_WRITE 64
Expand Down
79 changes: 69 additions & 10 deletions pkg/ebpf/c/tracee.bpf.c
View file
Open in desktop
Expand Up @@ -2455,10 +2455,22 @@ int BPF_KPROBE(trace_security_socket_listen)

// Load the arguments given to the listen syscall (which eventually invokes this function)
syscall_data_t *sys = &p.task_info->syscall_data;
if (!p.task_info->syscall_traced || sys->id != SYSCALL_LISTEN)
if (!p.task_info->syscall_traced)
return 0;

save_to_submit_buf(&p.event->args_buf, (void *) &sys->args.args[0], sizeof(u32), 0);
switch (sys->id) {
case SYSCALL_LISTEN:
save_to_submit_buf(&p.event->args_buf, (void *) &sys->args.args[0], sizeof(u32), 0);
break;
#if defined(bpf_target_x86) // armhf makes use of SYSCALL_LISTEN
case SYSCALL_SOCKETCALL:
save_to_submit_buf(&p.event->args_buf, (void *) sys->args.args[1], sizeof(u32), 0);
break;
#endif
default:
return 0;
}

save_sockaddr_to_buf(&p.event->args_buf, sock, 1);
save_to_submit_buf(&p.event->args_buf, (void *) &backlog, sizeof(int), 2);

Expand Down Expand Up @@ -2490,10 +2502,21 @@ int BPF_KPROBE(trace_security_socket_connect)

// Load the arguments given to the connect syscall (which eventually invokes this function)
syscall_data_t *sys = &p.task_info->syscall_data;
if (!p.task_info->syscall_traced || sys->id != SYSCALL_CONNECT)
if (!p.task_info->syscall_traced)
return 0;

save_to_submit_buf(&p.event->args_buf, (void *) &sys->args.args[0], sizeof(u32), 0);
switch (sys->id) {
case SYSCALL_CONNECT:
save_to_submit_buf(&p.event->args_buf, (void *) &sys->args.args[0], sizeof(u32), 0);
break;
#if defined(bpf_target_x86) // armhf makes use of SYSCALL_CONNECT
case SYSCALL_SOCKETCALL:
save_to_submit_buf(&p.event->args_buf, (void *) sys->args.args[1], sizeof(u32), 0);
break;
#endif
default:
return 0;
}

if (sa_fam == AF_INET) {
save_to_submit_buf(&p.event->args_buf, (void *) address, sizeof(struct sockaddr_in), 1);
Expand Down Expand Up @@ -2541,10 +2564,23 @@ int BPF_KPROBE(trace_security_socket_accept)
return 0;

// Load the arguments given to the accept syscall (which eventually invokes this function)
if (!p.task_info->syscall_traced || (sys->id != SYSCALL_ACCEPT && sys->id != SYSCALL_ACCEPT4))
if (!p.task_info->syscall_traced)
return 0;

save_to_submit_buf(&p.event->args_buf, (void *) &sys->args.args[0], sizeof(u32), 0);
switch (sys->id) {
case SYSCALL_ACCEPT:
case SYSCALL_ACCEPT4:
save_to_submit_buf(&p.event->args_buf, (void *) &sys->args.args[0], sizeof(u32), 0);
break;
#if defined(bpf_target_x86) // armhf makes use of SYSCALL_ACCEPT/4
case SYSCALL_SOCKETCALL:
save_to_submit_buf(&p.event->args_buf, (void *) sys->args.args[1], sizeof(u32), 0);
break;
#endif
default:
return 0;
}

save_sockaddr_to_buf(&p.event->args_buf, sock, 1);

return events_perf_submit(&p, SECURITY_SOCKET_ACCEPT, 0);
Expand Down Expand Up @@ -2578,10 +2614,21 @@ int BPF_KPROBE(trace_security_socket_bind)

// Load the arguments given to the bind syscall (which eventually invokes this function)
syscall_data_t *sys = &p.task_info->syscall_data;
if (!p.task_info->syscall_traced || sys->id != SYSCALL_BIND)
if (!p.task_info->syscall_traced)
return 0;

save_to_submit_buf(&p.event->args_buf, (void *) &sys->args.args[0], sizeof(u32), 0);
switch (sys->id) {
case SYSCALL_BIND:
save_to_submit_buf(&p.event->args_buf, (void *) &sys->args.args[0], sizeof(u32), 0);
break;
#if defined(bpf_target_x86) // armhf makes use of SYSCALL_BIND
case SYSCALL_SOCKETCALL:
save_to_submit_buf(&p.event->args_buf, (void *) sys->args.args[1], sizeof(u32), 0);
break;
#endif
default:
return 0;
}

u16 protocol = get_sock_protocol(sk);
net_id_t connect_id = {0};
Expand Down Expand Up @@ -2644,10 +2691,22 @@ int BPF_KPROBE(trace_security_socket_setsockopt)
return -1;
}

if (!p.task_info->syscall_traced || sys->id != SYSCALL_SETSOCKOPT)
if (!p.task_info->syscall_traced)
return 0;

save_to_submit_buf(&p.event->args_buf, (void *) &sys->args.args[0], sizeof(u32), 0);
switch (sys->id) {
case SYSCALL_SETSOCKOPT:
save_to_submit_buf(&p.event->args_buf, (void *) &sys->args.args[0], sizeof(u32), 0);
break;
#if defined(bpf_target_x86) // armhf makes use of SYSCALL_SETSOCKOPT
case SYSCALL_SOCKETCALL:
save_to_submit_buf(&p.event->args_buf, (void *) sys->args.args[1], sizeof(u32), 0);
break;
#endif
default:
return 0;
}

save_to_submit_buf(&p.event->args_buf, (void *) &level, sizeof(int), 1);
save_to_submit_buf(&p.event->args_buf, (void *) &optname, sizeof(int), 2);
save_sockaddr_to_buf(&p.event->args_buf, sock, 3);
Expand Down
4 changes: 2 additions & 2 deletions pkg/ebpf/tracee.go
View file
Open in desktop
Expand Up @@ -1031,9 +1031,9 @@ func (t *Tracee) populateBPFMaps() error {
if err != nil {
return errfmt.WrapError(err)
}
for eventDefID, eventDefinition := range events.Core.GetDefinitions() {
for _, eventDefinition := range events.Core.GetDefinitions() {
id32BitU32 := uint32(eventDefinition.GetID32Bit()) // ID32Bit is int32
idU32 := uint32(eventDefID) // ID is int32
idU32 := uint32(eventDefinition.GetID()) // ID is int32
err := sys32to64BPFMap.Update(unsafe.Pointer(&id32BitU32), unsafe.Pointer(&idU32))
if err != nil {
return errfmt.WrapError(err)
Expand Down
7 changes: 7 additions & 0 deletions pkg/events/parse_args.go
View file
Open in desktop
Expand Up @@ -112,6 +112,13 @@ func ParseArgs(event *trace.Event) error {
parseOrEmptyString(optArg, prctlOptionArgument, err)
}
}
case Socketcall:
if callArg := GetArg(event, "call"); callArg != nil {
if call, isInt32 := callArg.Value.(int32); isInt32 {
socketcallArgument, err := helpers.ParseSocketcallCall(uint64(call))
parseOrEmptyString(callArg, socketcallArgument, err)
}
}
case Socket:
if domArg := GetArg(event, "domain"); domArg != nil {
if dom, isInt32 := domArg.Value.(int32); isInt32 {
Expand Down