File system monitor improvements #68
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
MatteoNardi
changed the title
banditopazzo
approved these changes
Oct 6, 2022
Hook into LSM `path_link` and `path_symlink` to get events about new symbolic and hard links. As usual, we use kprobes as a fallback. Refactor `get_path_str` to accept the `struct vfsmount *` as a second parameter. This allows to use a single version of the function, which can be used both for `struct dentry` and `struct path`. Fix #64
This fixes path resolution across mount points for the delete event. Ref #11
This fixes path resolution across mount points for the create event. Fix #11
This macro makes it easy to hook into LSM attach points, keeping a kprobe
fallback.
PULSAR_LSM_HOOK(hook_point, args) will attach to `lsm/<hook_point>` and
`kprobe/security_<hook_point>`. It calls function `on_<hook_point>`, which
must be defined by the user and accept the specified args args.
Example:
```c
PULSAR_LSM_HOOK(file_open, struct file *, file);
```
Expands to:
```c
SEC("lsm/file_open")
int BPF_PROG(file_open, struct file *file, int ret) {
on_file_open(ctx, file);
return ret;
}
SEC("kprobe/security_file_open")
int BPF_KPROBE(security_file_open, struct file *file) {
on_file_open(ctx, file);
return 0;
}
```
MatteoNardi
force-pushed
the
probe_links
branch
from
20cac1c
to
45e373c
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
New events: file rename, directory creation, directory deletion, symbolic link, hard link
Hook into LSM
path_rename,path_rmdir,path_mkdir,path_linkandpath_symlink. As usual, we use kprobes as a fallback.Fix #64 and #67
Fix bug #11
I fixed bug #11 by using the LSM hooks accepting a path argument. This requires the
CONFIG_SECURITY_PATHconfig variable.Unify the two path extraction functions to require a
struct path*.I have
cargo fmt;cargo clippy;cargo testand all tests pass;