Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

fix(driver): fixed kmod build on 6.3 kernels arm64. #1147

Merged
merged 3 commits into from
Jun 12, 2023
Merged

fix(driver): fixed kmod build on 6.3 kernels arm64. #1147

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
5c264d2
fix(driver): fixed kmod build om 6.3 kernels arm64.
FedeDP Jun 12, 2023
5b1c14b
update(driver): bumped API_VERSION patch.
FedeDP Jun 12, 2023
b232eed
fix(bpf): fixed bpf probe on arm64 linux >= 6.3.
FedeDP Jun 12, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion driver/API_VERSION
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
4.0.1
4.0.2
12 changes: 12 additions & 0 deletions driver/bpf/fillers.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6340,17 +6340,29 @@ FILLER(sched_prog_exec_4, false)

/* Parameter 21: cap_inheritable (type: PT_UINT64) */
kernel_cap_t cap = _READ(cred->cap_inheritable);
#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
res = bpf_push_u64_to_ring(data, capabilities_to_scap(((unsigned long)cap.cap[1] << 32) | cap.cap[0]));
#else
res = bpf_push_u64_to_ring(data, capabilities_to_scap((unsigned long)cap.val));
#endif
CHECK_RES(res);

/* Parameter 22: cap_permitted (type: PT_UINT64) */
cap = _READ(cred->cap_permitted);
#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
res = bpf_push_u64_to_ring(data, capabilities_to_scap(((unsigned long)cap.cap[1] << 32) | cap.cap[0]));
#else
res = bpf_push_u64_to_ring(data, capabilities_to_scap((unsigned long)cap.val));
#endif
CHECK_RES(res);

/* Parameter 23: cap_effective (type: PT_UINT64) */
cap = _READ(cred->cap_effective);
#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
res = bpf_push_u64_to_ring(data, capabilities_to_scap(((unsigned long)cap.cap[1] << 32) | cap.cap[0]));
#else
res = bpf_push_u64_to_ring(data, capabilities_to_scap((unsigned long)cap.val));
#endif
CHECK_RES(res);

/* Parameter 24: exe_file ino (type: PT_UINT64) */
Expand Down
12 changes: 10 additions & 2 deletions driver/ppm_fillers.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1412,7 +1412,6 @@ int f_proc_startupdate(struct event_filler_arguments *args)
#if LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 39)
if (file_inode(exe_file) != NULL)
{

/* Support exe_writable */
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
exe_writable |= (file_permission(exe_file, MAY_WRITE) == 0);
Expand Down Expand Up @@ -7459,7 +7458,10 @@ int f_sched_prog_exec(struct event_filler_arguments *args)
if(file_inode(exe_file) != NULL)
{
/* Support exe_writable */
#if LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
#if LINUX_VERSION_CODE >= KERNEL_VERSION(6, 3, 0)
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We forgot to fix the arm64 f_sched_prog_exec tracepoint.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cc @Andreagit97

exe_writable |= (file_permission(exe_file, MAY_WRITE) == 0);
exe_writable |= inode_owner_or_capable(file_mnt_idmap(exe_file), file_inode(exe_file));
#elif LINUX_VERSION_CODE >= KERNEL_VERSION(5, 12, 0)
exe_writable |= (inode_permission(current_user_ns(), file_inode(exe_file), MAY_WRITE) == 0);
exe_writable |= inode_owner_or_capable(current_user_ns(), file_inode(exe_file));
#else
Expand Down Expand Up @@ -7513,9 +7515,15 @@ int f_sched_prog_exec(struct event_filler_arguments *args)
*/

cred = get_current_cred();
#if LINUX_VERSION_CODE < KERNEL_VERSION(6, 3, 0)
cap_inheritable = ((uint64_t)cred->cap_inheritable.cap[1] << 32) | cred->cap_inheritable.cap[0];
cap_permitted = ((uint64_t)cred->cap_permitted.cap[1] << 32) | cred->cap_permitted.cap[0];
cap_effective = ((uint64_t)cred->cap_effective.cap[1] << 32) | cred->cap_effective.cap[0];
#else
cap_inheritable = (uint64_t)cred->cap_inheritable.val;
cap_permitted = (uint64_t)cred->cap_permitted.val;
cap_effective = (uint64_t)cred->cap_effective.val;
#endif
put_cred(cred);

/* Parameter 21: cap_inheritable (type: PT_UINT64) */
Expand Down
Loading