Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

"renameat2" syscall support #1603

Closed
budenny opened this issue Mar 16, 2020 · 1 comment · Fixed by #1654
Closed

"renameat2" syscall support #1603

budenny opened this issue Mar 16, 2020 · 1 comment · Fixed by #1654

Comments

@budenny
Copy link

budenny commented Mar 16, 2020

Some applications like "mv" on RHEL 8.1 are using renameat2 syscall for file rename operations. Sysdig driver doesn't provide information about this syscall.

RHEL8.1:

[user@localhost ~]$ sudo sysdig proc.name=mv | grep newname
...

[user@localhost ~]$ sudo strace mv oldname newname 2>&1 | grep rename
renameat2(AT_FDCWD, "oldname", AT_FDCWD, "newname", RENAME_NOREPLACE) = 0

Ubuntu 18.04:
sudo sysdig proc.name=mv | grep newname
...
8853 05:32:48.621815439 1 mv (5522) < rename res=0 oldpath=old(/home/user/old) newpath=newname(/home/user/newname)
@leogr
Copy link
Member

leogr commented Jun 4, 2020

The same issue on Arch 5.6.15-arch1-1.

@leodido leodido mentioned this issue Jun 4, 2020
Closed
5 tasks
leogr added a commit to falcosecurity/falco that referenced this issue Jun 4, 2020
@leogr
rule(macro bin_dir_rename): correct condition to catch all variants
6ceebac 
Since `evt.arg[1]` does not work for all syscalls, switch to
 - `evt.arg.path` for `rmdir`, `unlink`, and `unlinkat` (used by `remove` macro)
 - `evt.arg.oldpath/newpath` for `rename` and `renameat` (used by `rename` macro)

That ensures `Modify binary dirs` works properly.

Note that we cannot yet use `renameat2` (not supported by sinsp, see draios/sysdig#1603 )

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
leogr added a commit to falcosecurity/falco that referenced this issue Jun 4, 2020
@leogr
rule(macro bin_dir_rename): correct condition to catch all variants
02c26e2 
Since `evt.arg[1]` does not work for all syscalls, switch to
 - `evt.arg.path` for `rmdir`, `unlink`, and `unlinkat` (used by `remove` macro)
 - `evt.arg.oldpath/newpath` for `rename` and `renameat` (used by `rename` macro)

That ensures `Modify binary dirs` works properly.

Note that we cannot yet use `renameat2` (not supported by sinsp, see draios/sysdig#1603 )

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
leogr added a commit to falcosecurity/falco that referenced this issue Jun 4, 2020
@leogr
rule(macro bin_dir_rename): correct condition to catch all variants
26030f4 
Since `evt.arg[1]` does not work for all syscalls, switch to
 - `evt.arg.path` for `rmdir`, `unlink`, and `unlinkat` (used by `remove` macro)
 - `evt.arg.oldpath/newpath` for `rename` and `renameat` (used by `rename` macro)

That ensures `Modify binary dirs` works properly.

Note that we cannot yet use `renameat2` (not supported by sinsp, see draios/sysdig#1603 )

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
leogr added a commit to falcosecurity/falco that referenced this issue Jun 4, 2020
@leogr
rule(macro bin_dir_rename): correct condition to catch all variants
564b9d1 
Since `evt.arg[1]` does not work for all syscalls, switch to:
 - `evt.arg.path` for `rmdir` and `unlink` (used by `remove` macro)
 - `evt.arg.name` for `unlinkat` (used by `remove` macro)
 - `evt.arg.oldpath/newpath` for `rename` and `renameat` (used by `rename` macro)

That ensures `Modify binary dirs` works properly.

Note that we cannot yet use `renameat2` (not supported by sinsp, see draios/sysdig#1603 )

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
@leogr leogr mentioned this issue Jun 4, 2020
Merged
3 tasks
poiana pushed a commit to falcosecurity/falco that referenced this issue Jun 10, 2020
@leogr @poiana
rule(macro bin_dir_rename): correct condition to catch all variants
a5ce61f 
Since `evt.arg[1]` does not work for all syscalls, switch to:
 - `evt.arg.path` for `rmdir` and `unlink` (used by `remove` macro)
 - `evt.arg.name` for `unlinkat` (used by `remove` macro)
 - `evt.arg.oldpath/newpath` for `rename` and `renameat` (used by `rename` macro)

That ensures `Modify binary dirs` works properly.

Note that we cannot yet use `renameat2` (not supported by sinsp, see draios/sysdig#1603 )

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
fntlnz pushed a commit to fntlnz/falco that referenced this issue Jun 26, 2020
@leogr @fntlnz
rule(macro bin_dir_rename): correct condition to catch all variants
1a25881 
Since `evt.arg[1]` does not work for all syscalls, switch to:
 - `evt.arg.path` for `rmdir` and `unlink` (used by `remove` macro)
 - `evt.arg.name` for `unlinkat` (used by `remove` macro)
 - `evt.arg.oldpath/newpath` for `rename` and `renameat` (used by `rename` macro)

That ensures `Modify binary dirs` works properly.

Note that we cannot yet use `renameat2` (not supported by sinsp, see draios/sysdig#1603 )

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
@fntlnz fntlnz mentioned this issue Jul 10, 2020
Merged
leogr added a commit to falcosecurity/rules that referenced this issue Dec 21, 2022
@leogr @poiana
rule(macro bin_dir_rename): correct condition to catch all variants
9f996c0 
Since `evt.arg[1]` does not work for all syscalls, switch to:
 - `evt.arg.path` for `rmdir` and `unlink` (used by `remove` macro)
 - `evt.arg.name` for `unlinkat` (used by `remove` macro)
 - `evt.arg.oldpath/newpath` for `rename` and `renameat` (used by `rename` macro)

That ensures `Modify binary dirs` works properly.

Note that we cannot yet use `renameat2` (not supported by sinsp, see draios/sysdig#1603 )

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
leogr added a commit to falcosecurity/rules that referenced this issue Dec 21, 2022
@leogr @poiana
rule(macro bin_dir_rename): correct condition to catch all variants
c24fbc1 
Since `evt.arg[1]` does not work for all syscalls, switch to:
 - `evt.arg.path` for `rmdir` and `unlink` (used by `remove` macro)
 - `evt.arg.name` for `unlinkat` (used by `remove` macro)
 - `evt.arg.oldpath/newpath` for `rename` and `renameat` (used by `rename` macro)

That ensures `Modify binary dirs` works properly.

Note that we cannot yet use `renameat2` (not supported by sinsp, see draios/sysdig#1603 )

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

update(driver): renameat2 support draios/sysdig
2 participants
@leogr @budenny