tentative fix to address bash problem #490

kern/bash_kern.c

@@ -15,6 +15,7 @@
 #include "ecapture.h"
 
 struct event {
+    u32 type;
     u32 pid;
     u32 uid;
     u8 line[MAX_DATA_SIZE_BASH];
@@ -58,11 +59,14 @@ int uretprobe_bash_readline(struct pt_regs *ctx) {
     struct event event = {};
     event.pid = pid;
     event.uid = uid;
+    event.type = BASH_EVENT_TYPE_READLINE;
     // bpf_printk("!! uretprobe_bash_readline pid:%d",target_pid );
     bpf_probe_read_user(&event.line, sizeof(event.line),
                         (void *)PT_REGS_RC(ctx));
     bpf_get_current_comm(&event.comm, sizeof(event.comm));
     bpf_map_update_elem(&events_t, &pid, &event, BPF_ANY);
+    bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &event,
+                          sizeof(struct event));
 
     return 0;
 }
@@ -89,17 +93,51 @@ int uretprobe_bash_retval(struct pt_regs *ctx) {
 #ifndef KERNEL_LESS_5_2
     // if target_errno is 128 then we target all
     if (target_errno != BASH_ERRNO_DEFAULT && target_errno != retval) {
-        if (event_p) bpf_map_delete_elem(&events_t, &pid);
+        if (event_p)
+        {   
+            event_p->retval = BASH_ERRNO_DEFAULT;
+            event_p->type = BASH_EVENT_TYPE_RETVAL;
+            bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, event_p,
+                                  sizeof(struct event));
+            bpf_map_delete_elem(&events_t, &pid);
+        }
         return 0;
     }
 #endif
 
     if (event_p) {
         event_p->retval = retval;
+        event_p->type = BASH_EVENT_TYPE_RETVAL;
         //        bpf_map_update_elem(&events_t, &pid, event_p, BPF_ANY);
         bpf_map_delete_elem(&events_t, &pid);
         bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, event_p,
                               sizeof(struct event));
     }
     return 0;
 }
+
+static __always_inline int send_bash_exit_event(struct pt_regs *ctx){
+    u64 pid_tgid = bpf_get_current_pid_tgid();
+    u32 pid = pid_tgid >> 32;
+    u64 current_uid_gid = bpf_get_current_uid_gid();
+    u32 uid = current_uid_gid;
+    struct event event = {
+        .type = BASH_EVENT_TYPE_EXIT_OR_EXEC,
+        .pid = pid,
+        .uid = uid,
+    };
+    bpf_get_current_comm(&event.comm, sizeof(event.comm));
+    bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &event,
+                          sizeof(struct event));
+    return 0;
+}
+
+SEC("uprobe/exec_builtin")
+int uprobe_exec_builtin(struct pt_regs *ctx){
+    return send_bash_exit_event(ctx);
+}
+
+SEC("uprobe/exit_builtin")
+int uprobe_exit_builtin(struct pt_regs *ctx){
+    return send_bash_exit_event(ctx);
+}

kern/common.h

@@ -41,6 +41,9 @@
 #define SA_DATA_LEN 14
 #define BASH_ERRNO_DEFAULT 128
 
+#define BASH_EVENT_TYPE_READLINE 0
+#define BASH_EVENT_TYPE_RETVAL 1
+#define BASH_EVENT_TYPE_EXIT_OR_EXEC 2
 ///////// for TC & XDP ebpf programs in tc.h
 #define TC_ACT_OK 0
 #define ETH_P_IP 0x0800 /* Internet Protocol packet        */

user/event/event_bash.go

@@ -22,6 +22,8 @@ import (
 	"golang.org/x/sys/unix"
 )
 
+var lineMap map[string]string = make(map[string]string)
+
 /*
  u32 pid;
  u8 line[MAX_DATE_SIZE_BASH];
@@ -30,9 +32,16 @@ import (
 */
 
 const MaxDataSizeBash = 256
+const BASH_ERRNO_DEFAULT = 128
+const (
+	BASH_EVENT_TYPE_READLINE     = 0
+	BASH_EVENT_TYPE_RETVAL       = 1
+	BASH_EVENT_TYPE_EXIT_OR_EXEC = 2
+)
 
 type BashEvent struct {
 	eventType EventType
+	Type      uint32                 `json:"type"`
 	Pid       uint32                 `json:"pid"`
 	Uid       uint32                 `json:"uid"`
 	Line      [MaxDataSizeBash]uint8 `json:"line"`
@@ -42,6 +51,9 @@ type BashEvent struct {
 
 func (be *BashEvent) Decode(payload []byte) (err error) {
 	buf := bytes.NewBuffer(payload)
+	if err = binary.Read(buf, binary.LittleEndian, &be.Type); err != nil {
+		return
+	}
 	if err = binary.Read(buf, binary.LittleEndian, &be.Pid); err != nil {
 		return
 	}
@@ -62,13 +74,51 @@ func (be *BashEvent) Decode(payload []byte) (err error) {
 }
 
 func (be *BashEvent) String() string {
-	s := fmt.Sprintf("PID:%d, UID:%d, \tComm:%s, \tRetvalue:%d, \tLine:\n%s", be.Pid, be.Uid, be.Comm, be.Retval, unix.ByteSliceToString((be.Line[:])))
-	return s
+	return be.handleLine(false)
 }
 
 func (be *BashEvent) StringHex() string {
-	s := fmt.Sprintf("PID:%d, UID:%d, \tComm:%s, \tRetvalue:%d, \tLine:\n%s,", be.Pid, be.Uid, be.Comm, be.Retval, dumpByteSlice([]byte(unix.ByteSliceToString((be.Line[:]))), ""))
-	return s
+	return be.handleLine(true)
+}
+
+func (be *BashEvent) handleLine(isHex bool) string {
+	switch be.Type {
+	case BASH_EVENT_TYPE_READLINE:
+		newline := unix.ByteSliceToString((be.Line[:]))
+		line := lineMap[be.GetUUID()]
+		if line != "" {
+			line += "\n" + newline
+		} else {
+			line += newline
+		}
+		lineMap[be.GetUUID()] = line
+		return ""
+	case BASH_EVENT_TYPE_RETVAL:
+		line := lineMap[be.GetUUID()]
+		delete(lineMap, be.GetUUID())
+		if line == "" || be.Retval == BASH_ERRNO_DEFAULT {
+			return ""
+		}
+		return be.printMsg(line, isHex)
+	case BASH_EVENT_TYPE_EXIT_OR_EXEC:
+		line := lineMap[be.GetUUID()]
+		delete(lineMap, be.GetUUID())
+		if line == "" {
+			return ""
+		}
+		be.Retval = BASH_EVENT_TYPE_EXIT_OR_EXEC // we do not know the return value here
+		return be.printMsg(line, isHex)
+	}
+	return "unknown"
+}
+
+func (be *BashEvent) printMsg(line string, isHex bool) string {
+	if isHex {
+		return fmt.Sprintf("PID:%d, UID:%d, \tComm:%s, \tRetvalue:%d, \tLine:\n%s,", be.Pid, be.Uid, be.Comm, be.Retval, dumpByteSlice([]byte(line), ""))
+	} else {
+		return fmt.Sprintf("PID:%d, UID:%d, \tComm:%s, \tRetvalue:%d, \tLine:\n%s", be.Pid, be.Uid, be.Comm, be.Retval, line)
+	}
+
 }
 
 func (be *BashEvent) Clone() IEventStruct {

user/module/imodule.go

@@ -292,7 +292,11 @@ func (m *Module) Dispatcher(e event.IEventStruct) {
 	// If Hex mode is enabled, data in hex format is directly printed for event processor and output events
 	if m.conf.GetHex() {
 		if e.EventType() == event.EventTypeEventProcessor || e.EventType() == event.EventTypeOutput {
-			m.logger.Println(e.StringHex())
+			s := e.StringHex()
+			if s == "" {
+				return
+			}
+			m.logger.Println(s)
 			return
 		}
 	}
@@ -301,7 +305,11 @@ func (m *Module) Dispatcher(e event.IEventStruct) {
 	// they will be handled according to multiple branches of the switch
 	switch e.EventType() {
 	case event.EventTypeOutput:
-		m.logger.Println(e.String())
+		s := e.String()
+		if s == "" {
+			return
+		}
+		m.logger.Println(s)
 	case event.EventTypeEventProcessor:
 		m.processor.Write(e)
 	case event.EventTypeModuleData:

user/module/probe_bash.go

@@ -173,7 +173,8 @@ func (b *MBashProbe) setupManagers() {
 
 	b.logger.Printf("%s\tHOOK binrayPath:%s, FunctionName:%s\n", b.Name(), binaryPath, readlineFuncName)
 	b.logger.Printf("%s\tHOOK binrayPath:%s, FunctionName:execute_command\n", b.Name(), binaryPath)
-
+	b.logger.Printf("%s\tHOOK binrayPath:%s, FunctionName:exit_builtin\n", b.Name(), binaryPath)
+	b.logger.Printf("%s\tHOOK binrayPath:%s, FunctionName:exec_builtin\n", b.Name(), binaryPath)
 	b.bpfManager = &manager.Manager{
 		Probes: []*manager.Probe{
 			{
@@ -189,6 +190,18 @@ func (b *MBashProbe) setupManagers() {
 				AttachToFuncName: "execute_command",
 				BinaryPath:       binaryPath, // 可能是 /bin/bash 也可能是 readline.so的真实地址
 			},
+			{
+				Section:          "uprobe/exec_builtin",
+				EbpfFuncName:     "uprobe_exec_builtin",
+				AttachToFuncName: "exec_builtin",
+				BinaryPath:       binaryPath,
+			},
+			{
+				Section:          "uprobe/exit_builtin",
+				EbpfFuncName:     "uprobe_exit_builtin",
+				AttachToFuncName: "exit_builtin",
+				BinaryPath:       binaryPath,
+			},
 		},
 
 		Maps: []*manager.Map{