From d597d4832305bf1dbca380d126c8267777e14ae2 Mon Sep 17 00:00:00 2001 From: Melissa Kilby Date: Fri, 28 Jul 2023 23:25:12 +0000 Subject: [PATCH 1/5] fix(driver, userspace): fix loginuid, euid and tty types * loginuid, tty and euid now consistently uint32_t * not a breaking UX change since we still expose -1 in case of an invalid uid in the filterchecks, user.loginuid now int64_t Signed-off-by: Melissa Kilby --- driver/bpf/fillers.h | 30 +++++------ driver/event_table.c | 4 +- .../helpers/extract/extract_from_kernel.h | 3 +- .../attached/events/sched_process_exec.bpf.c | 16 +++--- .../syscall_dispatched_events/execve.bpf.c | 14 ++--- .../syscall_dispatched_events/execveat.bpf.c | 16 +++--- driver/ppm_events_public.h | 4 ++ driver/ppm_fillers.c | 54 ++++++++++--------- test/drivers/helpers/proc_parsing.h | 4 +- .../sched_process_exec.cpp | 2 +- .../syscall_exit_suite/execve_x.cpp | 8 +-- .../syscall_exit_suite/execveat_x.cpp | 8 +-- test/e2e/README.md | 2 +- .../test_db_program_spawned_process.py | 2 +- .../test_run_shell_untrusted.py | 4 +- .../test_system_user_interactive.py | 2 +- userspace/libscap/engine/gvisor/parsers.cpp | 8 +-- .../libscap/engine/savefile/scap_savefile.c | 14 ++--- userspace/libscap/linux/scap_procs.c | 10 ++-- userspace/libscap/scap.h | 4 +- userspace/libscap/scap_savefile.c | 4 +- userspace/libsinsp/filterchecks.cpp | 11 ++-- userspace/libsinsp/filterchecks.h | 1 + userspace/libsinsp/parsers.cpp | 4 +- userspace/libsinsp/test/events_proc.ut.cpp | 5 +- .../libsinsp/test/sinsp_with_test_input.h | 2 +- userspace/libsinsp/threadinfo.h | 3 +- 27 files changed, 126 insertions(+), 113 deletions(-) diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h index f75c76f839..74d44cc995 100644 --- a/driver/bpf/fillers.h +++ b/driver/bpf/fillers.h @@ -1627,7 +1627,7 @@ FILLER(sys_execveat_e, true) return bpf_push_u32_to_ring(data, flags); } -static __always_inline int bpf_ppm_get_tty(struct task_struct *task) +static __always_inline uint32_t bpf_ppm_get_tty(struct task_struct *task) { struct signal_struct *sig; struct tty_struct *tty; @@ -2639,7 +2639,7 @@ FILLER(proc_startupdate_3, true) */ long env_len = 0; kuid_t loginuid; - int tty; + uint32_t tty; struct file *exe_file; /* @@ -2706,7 +2706,7 @@ FILLER(proc_startupdate_3, true) */ tty = bpf_ppm_get_tty(task); - res = bpf_push_s32_to_ring(data, tty); + res = bpf_push_u32_to_ring(data, tty); CHECK_RES(res); /* @@ -2726,17 +2726,17 @@ FILLER(proc_startupdate_3, true) if (audit) { loginuid = _READ(audit->loginuid); } else { - loginuid = INVALID_UID; + loginuid = UINT32_MAX; } } #else loginuid = _READ(task->loginuid); #endif /* COS_73_WORKAROUND */ #else - loginuid.val = -1; + loginuid.val = UINT32_MAX; #endif /* CONFIG_AUDIT... */ - res = bpf_push_s32_to_ring(data, loginuid.val); + res = bpf_push_u32_to_ring(data, loginuid.val); CHECK_RES(res); bpf_tail_call(data->ctx, &tail_map, PPM_FILLER_execve_family_flags); @@ -2846,7 +2846,7 @@ FILLER(execve_family_flags, true) res = bpf_push_u64_to_ring(data, bpf_epoch_ns_from_time(time)); CHECK_RES(res); - /* Parameter 27: uid */ + /* Parameter 27: euid (type: PT_UID) */ euid = _READ(cred->euid); return bpf_push_u32_to_ring(data, euid.val); } @@ -6504,9 +6504,9 @@ FILLER(sched_prog_exec_3, false) res = __bpf_val_to_ring(data, 0, env_len, PT_BYTEBUF, -1, false, KERNEL); CHECK_RES(res); - /* Parameter 17: tty (type: PT_INT32) */ - int tty = bpf_ppm_get_tty(task); - res = bpf_push_s32_to_ring(data, tty); + /* Parameter 17: tty (type: PT_UINT32) */ + uint32_t tty = bpf_ppm_get_tty(task); + res = bpf_push_u32_to_ring(data, tty); CHECK_RES(res); /* Parameter 18: pgid (type: PT_PID) */ @@ -6525,18 +6525,18 @@ FILLER(sched_prog_exec_3, false) } else { - loginuid = INVALID_UID; + loginuid = UINT32_MAX; } } #else loginuid = _READ(task->loginuid); #endif /* COS_73_WORKAROUND */ #else - loginuid.val = -1; + loginuid.val = UINT32_MAX; #endif /* CONFIG_AUDIT... */ - /* Parameter 19: loginuid (type: PT_INT32) */ - res = bpf_push_s32_to_ring(data, loginuid.val); + /* Parameter 19: loginuid (type: PT_UID) */ + res = bpf_push_u32_to_ring(data, loginuid.val); CHECK_RES(res); bpf_tail_call(data->ctx, &tail_map, PPM_FILLER_sched_prog_exec_4); @@ -6641,7 +6641,7 @@ FILLER(sched_prog_exec_4, false) res = bpf_push_u64_to_ring(data, bpf_epoch_ns_from_time(time)); CHECK_RES(res); - /* Parameter 27: uid */ + /* Parameter 27: euid (type: PT_UID) */ euid = _READ(cred->euid); return bpf_push_u32_to_ring(data, euid.val); } diff --git a/driver/event_table.c b/driver/event_table.c index c287e60069..4ccdc1c298 100644 --- a/driver/event_table.c +++ b/driver/event_table.c @@ -342,7 +342,7 @@ const struct ppm_event_info g_event_info[] = { [PPME_PAGE_FAULT_E] = {"page_fault", EC_OTHER | EC_TRACEPOINT, EF_SKIPPARSERESET, 3, {{"addr", PT_UINT64, PF_HEX}, {"ip", PT_UINT64, PF_HEX}, {"error", PT_FLAGS32, PF_HEX, pf_flags} } }, [PPME_PAGE_FAULT_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0}, [PPME_SYSCALL_EXECVE_19_E] = {"execve", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 1, {{"filename", PT_FSPATH, PF_NA} } }, - [PPME_SYSCALL_EXECVE_19_X] = {"execve", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 27, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC}, {"pgid", PT_PID, PF_DEC}, {"loginuid", PT_INT32, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, execve_flags}, {"cap_inheritable", PT_UINT64, PF_HEX}, {"cap_permitted", PT_UINT64, PF_HEX}, {"cap_effective", PT_UINT64, PF_HEX}, {"exe_ino", PT_UINT64, PF_DEC}, {"exe_ino_ctime", PT_ABSTIME, PF_DEC}, {"exe_ino_mtime", PT_ABSTIME, PF_DEC}, {"uid", PT_INT32, PF_DEC} } }, + [PPME_SYSCALL_EXECVE_19_X] = {"execve", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 27, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_UINT32, PF_DEC}, {"pgid", PT_PID, PF_DEC}, {"loginuid", PT_UID, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, execve_flags}, {"cap_inheritable", PT_UINT64, PF_HEX}, {"cap_permitted", PT_UINT64, PF_HEX}, {"cap_effective", PT_UINT64, PF_HEX}, {"exe_ino", PT_UINT64, PF_DEC}, {"exe_ino_ctime", PT_ABSTIME, PF_DEC}, {"exe_ino_mtime", PT_ABSTIME, PF_DEC}, {"uid", PT_UID, PF_DEC} } }, [PPME_SYSCALL_SETPGID_E] = {"setpgid", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 2, {{"pid", PT_PID, PF_DEC}, {"pgid", PT_PID, PF_DEC} } }, [PPME_SYSCALL_SETPGID_X] = {"setpgid", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 1, {{"res", PT_PID, PF_DEC} } }, [PPME_SYSCALL_BPF_E] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_OLD_VERSION, 1, {{"cmd", PT_INT64, PF_DEC} } }, @@ -380,7 +380,7 @@ const struct ppm_event_info g_event_info[] = { [PPME_SYSCALL_MPROTECT_E] = {"mprotect", EC_MEMORY | EC_SYSCALL, EF_NONE, 3, {{"addr", PT_UINT64, PF_HEX}, {"length", PT_UINT64, PF_DEC}, {"prot", PT_FLAGS32, PF_HEX, prot_flags} } }, [PPME_SYSCALL_MPROTECT_X] = {"mprotect", EC_MEMORY | EC_SYSCALL, EF_NONE, 1, {{"res", PT_ERRNO, PF_DEC} } }, [PPME_SYSCALL_EXECVEAT_E] = {"execveat", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 3, {{"dirfd", PT_FD, PF_DEC}, {"pathname", PT_FSRELPATH, PF_NA, DIRFD_PARAM(0)}, {"flags", PT_FLAGS32, PF_HEX, execveat_flags} } }, - [PPME_SYSCALL_EXECVEAT_X] = {"execveat", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 27, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC}, {"pgid", PT_PID, PF_DEC}, {"loginuid", PT_INT32, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, execve_flags}, {"cap_inheritable", PT_UINT64, PF_HEX}, {"cap_permitted", PT_UINT64, PF_HEX}, {"cap_effective", PT_UINT64, PF_HEX}, {"exe_ino", PT_UINT64, PF_DEC}, {"exe_ino_ctime", PT_ABSTIME, PF_DEC}, {"exe_ino_mtime", PT_ABSTIME, PF_DEC}, {"uid", PT_INT32, PF_DEC} } }, + [PPME_SYSCALL_EXECVEAT_X] = {"execveat", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 27, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_UINT32, PF_DEC}, {"pgid", PT_PID, PF_DEC}, {"loginuid", PT_UID, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, execve_flags}, {"cap_inheritable", PT_UINT64, PF_HEX}, {"cap_permitted", PT_UINT64, PF_HEX}, {"cap_effective", PT_UINT64, PF_HEX}, {"exe_ino", PT_UINT64, PF_DEC}, {"exe_ino_ctime", PT_ABSTIME, PF_DEC}, {"exe_ino_mtime", PT_ABSTIME, PF_DEC}, {"uid", PT_UID, PF_DEC} } }, [PPME_SYSCALL_COPY_FILE_RANGE_E] = {"copy_file_range", EC_FILE | EC_SYSCALL, EF_USES_FD | EF_READS_FROM_FD | EF_WRITES_TO_FD, 3, {{"fdin", PT_FD, PF_DEC}, {"offin", PT_UINT64, PF_DEC}, {"len", PT_UINT64, PF_DEC} } }, [PPME_SYSCALL_COPY_FILE_RANGE_X] = {"copy_file_range", EC_FILE | EC_SYSCALL, EF_USES_FD | EF_READS_FROM_FD | EF_WRITES_TO_FD, 3, {{"res", PT_ERRNO, PF_DEC}, {"fdout", PT_FD, PF_DEC}, {"offout", PT_UINT64, PF_DEC} } }, [PPME_SYSCALL_CLONE3_E] = {"clone3", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 0}, diff --git a/driver/modern_bpf/helpers/extract/extract_from_kernel.h b/driver/modern_bpf/helpers/extract/extract_from_kernel.h index 4104ad8e0d..3242b73633 100644 --- a/driver/modern_bpf/helpers/extract/extract_from_kernel.h +++ b/driver/modern_bpf/helpers/extract/extract_from_kernel.h @@ -618,7 +618,7 @@ static __always_inline u32 exctract__tty(struct task_struct *task) */ static __always_inline void extract__loginuid(struct task_struct *task, u32 *loginuid) { - *loginuid = -1; + *loginuid = UINT32_MAX; if(bpf_core_field_exists(task->loginuid)) { @@ -686,6 +686,7 @@ static __always_inline unsigned long extract__clone_flags(struct task_struct *ta */ static __always_inline void extract__euid(struct task_struct *task, u32 *euid) { + *euid = UINT32_MAX; READ_TASK_FIELD_INTO(euid, task, cred, euid.val); } diff --git a/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c b/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c index 8f3d9ff874..b938ca446b 100644 --- a/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c +++ b/driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c @@ -161,18 +161,18 @@ int BPF_PROG(t1_sched_p_exec, */ auxmap__store_bytebuf_param(auxmap, env_start_pointer, total_env_len & (MAX_PROC_ARG_ENV - 1), USER); - /* Parameter 17: tty (type: PT_INT32) */ + /* Parameter 17: tty (type: PT_UINT32) */ u32 tty = exctract__tty(task); - auxmap__store_s32_param(auxmap, (s32)tty); + auxmap__store_u32_param(auxmap, (u32)tty); /* Parameter 18: pgid (type: PT_PID) */ pid_t pgid = extract__task_xid_vnr(task, PIDTYPE_PGID); auxmap__store_s64_param(auxmap, (s64)pgid); - /* Parameter 19: loginuid (type: PT_INT32) */ + /* Parameter 19: loginuid (type: PT_UID) */ u32 loginuid; extract__loginuid(task, &loginuid); - auxmap__store_s32_param(auxmap, (s32)loginuid); + auxmap__store_u32_param(auxmap, (u32)loginuid); /* Parameter 20: flags (type: PT_FLAGS32) */ u32 flags = 0; @@ -220,10 +220,10 @@ int BPF_PROG(t1_sched_p_exec, BPF_CORE_READ_INTO(&time, exe_inode, i_mtime); auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time)); - /* Parameter 27: uid (type: PT_UINT32) */ - u32 uid = 0; - extract__euid(task, &uid); - auxmap__store_u32_param(auxmap, uid); + /* Parameter 27: euid (type: PT_UID) */ + u32 euid; + extract__euid(task, &euid); + auxmap__store_u32_param(auxmap, euid); /*=============================== COLLECT PARAMETERS ===========================*/ diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c index 6d1f7c0f9d..216a93f278 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c @@ -227,16 +227,16 @@ int BPF_PROG(t1_execve_x, /* Parameter 17: tty (type: PT_INT32) */ u32 tty = exctract__tty(task); - auxmap__store_s32_param(auxmap, (s32)tty); + auxmap__store_u32_param(auxmap, (u32)tty); /* Parameter 18: pgid (type: PT_PID) */ pid_t pgid = extract__task_xid_vnr(task, PIDTYPE_PGID); auxmap__store_s64_param(auxmap, (s64)pgid); - /* Parameter 19: loginuid (type: PT_INT32) */ + /* Parameter 19: loginuid (type: PT_UID) */ u32 loginuid; extract__loginuid(task, &loginuid); - auxmap__store_s32_param(auxmap, (s32)loginuid); + auxmap__store_u32_param(auxmap, (u32)loginuid); /* Parameter 20: flags (type: PT_FLAGS32) */ u32 flags = 0; @@ -284,10 +284,10 @@ int BPF_PROG(t1_execve_x, BPF_CORE_READ_INTO(&time, exe_inode, i_mtime); auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time)); - /* Parameter 27: uid (type: PT_UINT32) */ - u32 uid = 0; - extract__euid(task, &uid); - auxmap__store_u32_param(auxmap, uid); + /* Parameter 27: euid (type: PT_UID) */ + u32 euid; + extract__euid(task, &euid); + auxmap__store_u32_param(auxmap, euid); /*=============================== COLLECT PARAMETERS ===========================*/ diff --git a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c index fe2c54291b..437435d86b 100644 --- a/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c +++ b/driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c @@ -242,18 +242,18 @@ int BPF_PROG(t1_execveat_x, auxmap__store_execve_args(auxmap, (char **)envp, 0); } - /* Parameter 17: tty (type: PT_INT32) */ + /* Parameter 17: tty (type: PT_UID) */ u32 tty = exctract__tty(task); - auxmap__store_s32_param(auxmap, (s32)tty); + auxmap__store_u32_param(auxmap, (u32)tty); /* Parameter 18: pgid (type: PT_PID) */ pid_t pgid = extract__task_xid_vnr(task, PIDTYPE_PGID); auxmap__store_s64_param(auxmap, (s64)pgid); - /* Parameter 19: loginuid (type: PT_INT32) */ + /* Parameter 19: loginuid (type: PT_UID) */ u32 loginuid; extract__loginuid(task, &loginuid); - auxmap__store_s32_param(auxmap, (s32)loginuid); + auxmap__store_u32_param(auxmap, (u32)loginuid); /* Parameter 20: flags (type: PT_FLAGS32) */ u32 flags = 0; @@ -300,10 +300,10 @@ int BPF_PROG(t1_execveat_x, BPF_CORE_READ_INTO(&time, exe_inode, i_mtime); auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time)); - /* Parameter 27: uid (type: PT_UINT32) */ - u32 uid = 0; - extract__euid(task, &uid); - auxmap__store_u32_param(auxmap, uid); + /* Parameter 27: euid (type: PT_UID) */ + u32 euid; + extract__euid(task, &euid); + auxmap__store_u32_param(auxmap, euid); /*=============================== COLLECT PARAMETERS ===========================*/ diff --git a/driver/ppm_events_public.h b/driver/ppm_events_public.h index 69b3fc8aee..cfaf0f6af5 100644 --- a/driver/ppm_events_public.h +++ b/driver/ppm_events_public.h @@ -20,6 +20,10 @@ or GPL2.txt for full copies of the license. #include "./feature_gates.h" +#ifndef UINT32_MAX +#define UINT32_MAX (4294967295U) +#endif + /* * Macros for packing in different build environments */ diff --git a/driver/ppm_fillers.c b/driver/ppm_fillers.c index 5c7a1736ae..1883618134 100644 --- a/driver/ppm_fillers.c +++ b/driver/ppm_fillers.c @@ -851,7 +851,7 @@ static int compat_accumulate_argv_or_env(compat_uptr_t argv, #endif -static int ppm_get_tty(void) +static uint32_t ppm_get_tty(void) { /* Locking of the signal structures seems too complicated across * multiple kernel versions to get it right, so simply do protected @@ -865,7 +865,7 @@ static int ppm_get_tty(void) int major; int minor_start; int index; - int tty_nr = 0; + uint32_t tty_nr = 0; sig = current->signal; if (!sig) @@ -1212,14 +1212,14 @@ int f_proc_startupdate(struct event_filler_arguments *args) * clone-only parameters */ #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0) - uint64_t euid = from_kuid_munged(current_user_ns(), current_euid()); - uint64_t egid = from_kgid_munged(current_user_ns(), current_egid()); + uint32_t euid = from_kuid_munged(current_user_ns(), current_euid()); + uint32_t egid = from_kgid_munged(current_user_ns(), current_egid()); #elif LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 20) - uint64_t euid = current_euid(); - uint64_t egid = current_egid(); + uint32_t euid = current_euid(); + uint32_t egid = current_egid(); #else - uint64_t euid = current->euid; - uint64_t egid = current->egid; + uint32_t euid = current->euid; + uint32_t egid = current->egid; #endif int64_t in_pidns = 0; #if LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 20) @@ -1329,7 +1329,7 @@ int f_proc_startupdate(struct event_filler_arguments *args) * execve family parameters. */ long env_len = 0; - int tty_nr = 0; + uint32_t tty_nr = 0; bool exe_writable = false; bool exe_upper_layer = false; struct file *exe_file = NULL; @@ -1337,10 +1337,11 @@ int f_proc_startupdate(struct event_filler_arguments *args) unsigned long i_ino = 0; unsigned long ctime = 0; unsigned long mtime = 0; + uint32_t loginuid = UINT32_MAX; uint64_t cap_inheritable = 0; uint64_t cap_permitted = 0; uint64_t cap_effective = 0; - uint64_t euid = 0; + uint32_t euid = UINT32_MAX; if (likely(retval >= 0)) { /* @@ -1421,13 +1422,13 @@ int f_proc_startupdate(struct event_filler_arguments *args) * loginuid */ #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0) - val = from_kuid(current_user_ns(), audit_get_loginuid(current)); + loginuid = from_kuid(current_user_ns(), audit_get_loginuid(current)); #elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 25) - val = audit_get_loginuid(current); + loginuid = audit_get_loginuid(current); #else - val = audit_get_loginuid(current->audit_context); + loginuid = audit_get_loginuid(current->audit_context); #endif - res = val_to_ring(args, val, 0, false, 0); + res = val_to_ring(args, loginuid, 0, false, 0); if (unlikely(res != PPM_SUCCESS)) return res; @@ -1538,7 +1539,7 @@ int f_proc_startupdate(struct event_filler_arguments *args) res = val_to_ring(args, mtime, 0, false, 0); CHECK_RES(res); - /* Parameter 27: uid */ + /* Parameter 27: euid (type: PT_UID) */ #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0) euid = from_kuid_munged(current_user_ns(), current_euid()); #elif LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 20) @@ -7374,7 +7375,7 @@ int f_sched_prog_exec(struct event_filler_arguments *args) long swap = 0; int available = STR_STORAGE_SIZE; long env_len = 0; - int tty_nr = 0; + uint32_t tty_nr = 0; uint32_t flags = 0; bool exe_writable = false; bool exe_upper_layer = false; @@ -7383,10 +7384,11 @@ int f_sched_prog_exec(struct event_filler_arguments *args) unsigned long i_ino = 0; unsigned long ctime = 0; unsigned long mtime = 0; + uint32_t loginuid = UINT32_MAX; uint64_t cap_inheritable = 0; uint64_t cap_permitted = 0; uint64_t cap_effective = 0; - uint64_t euid = 0; + uint32_t euid = UINT32_MAX; /* Parameter 1: res (type: PT_ERRNO) */ /* Please note: if this filler is called the execve is correctly @@ -7589,7 +7591,7 @@ int f_sched_prog_exec(struct event_filler_arguments *args) return res; } - /* Parameter 17: tty (type: PT_INT32) */ + /* Parameter 17: tty (type: PT_UINT32) */ tty_nr = ppm_get_tty(); res = val_to_ring(args, tty_nr, 0, false, 0); if(unlikely(res != PPM_SUCCESS)) @@ -7604,13 +7606,13 @@ int f_sched_prog_exec(struct event_filler_arguments *args) return res; } - /* Parameter 19: loginuid (type: PT_INT32) */ + /* Parameter 19: loginuid (type: PT_UID) */ #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0) - val = from_kuid(current_user_ns(), audit_get_loginuid(current)); + loginuid = from_kuid(current_user_ns(), audit_get_loginuid(current)); #else - val = audit_get_loginuid(current); + loginuid = audit_get_loginuid(current); #endif - res = val_to_ring(args, val, 0, false, 0); + res = val_to_ring(args, loginuid, 0, false, 0); if(unlikely(res != PPM_SUCCESS)) { return res; @@ -7722,7 +7724,7 @@ int f_sched_prog_exec(struct event_filler_arguments *args) res = val_to_ring(args, mtime, 0, false, 0); CHECK_RES(res); - /* Parameter 27: uid */ + /* Parameter 27: euid (type: PT_UID) */ #if LINUX_VERSION_CODE >= KERNEL_VERSION(3, 5, 0) euid = from_kuid_munged(current_user_ns(), current_euid()); #elif LINUX_VERSION_CODE > KERNEL_VERSION(2, 6, 20) @@ -7752,8 +7754,8 @@ int f_sched_prog_fork(struct event_filler_arguments *args) long swap = 0; int available = STR_STORAGE_SIZE; uint32_t flags = 0; - uint64_t euid = task_euid(child).val; - uint64_t egid = child->cred->egid.val; + uint32_t euid = task_euid(child).val; + uint32_t egid = child->cred->egid.val; struct pid_namespace *pidns = task_active_pid_ns(child); u64 pidns_init_start_time = 0; @@ -7969,7 +7971,7 @@ int f_sched_prog_fork(struct event_filler_arguments *args) return res; } - /* Parameter 17: uid (type: PT_UINT32) */ + /* Parameter 17: uid (type: PT_UID) */ res = val_to_ring(args, euid, 0, false, 0); if(unlikely(res != PPM_SUCCESS)) { diff --git a/test/drivers/helpers/proc_parsing.h b/test/drivers/helpers/proc_parsing.h index ffb3744578..23d9137aa0 100644 --- a/test/drivers/helpers/proc_parsing.h +++ b/test/drivers/helpers/proc_parsing.h @@ -13,7 +13,7 @@ */ struct proc_info { - int tty; + uint32_t tty; pid_t ppid; /* The PID of the parent of this process. */ pid_t pgid; /* The process group ID of the process. */ char raw_args[MAX_NUM_ARGS][MAX_PATH]; @@ -23,7 +23,7 @@ struct proc_info uint32_t vpid; uint32_t vtid; struct rlimit file_rlimit; - int loginuid; + uint32_t loginuid; }; bool get_proc_info(pid_t pid, proc_info* info); diff --git a/test/drivers/test_suites/generic_tracepoints_suite/sched_process_exec.cpp b/test/drivers/test_suites/generic_tracepoints_suite/sched_process_exec.cpp index 5d6f68c5ee..1a619da4e4 100644 --- a/test/drivers/test_suites/generic_tracepoints_suite/sched_process_exec.cpp +++ b/test/drivers/test_suites/generic_tracepoints_suite/sched_process_exec.cpp @@ -108,7 +108,7 @@ TEST(GenericTracepoints, sched_proc_exec) /* Parameter 26: exe_file mtime (last modification time, epoch value in nanoseconds) (type: PT_ABSTIME) */ evt_test->assert_numeric_param(26, (uint64_t)1000000000000000000, GREATER_EQUAL); - /* Parameter 27: uid (type: PT_UINT32) */ + /* Parameter 27: euid (type: PT_UID) */ evt_test->assert_numeric_param(27, (uint32_t)geteuid(), EQUAL); /*=============================== ASSERT PARAMETERS ===========================*/ diff --git a/test/drivers/test_suites/syscall_exit_suite/execve_x.cpp b/test/drivers/test_suites/syscall_exit_suite/execve_x.cpp index 3f6e5fd021..f070651f72 100644 --- a/test/drivers/test_suites/syscall_exit_suite/execve_x.cpp +++ b/test/drivers/test_suites/syscall_exit_suite/execve_x.cpp @@ -122,7 +122,7 @@ TEST(SyscallExit, execveX_failure) /* Parameter 18: pgid (type: PT_PID) */ evt_test->assert_numeric_param(18, (int64_t)info.pgid); - /* Parameter 19: loginuid (type: PT_UINT32) */ + /* Parameter 19: loginuid (type: PT_UID) */ evt_test->assert_numeric_param(19, (uint32_t)info.loginuid); /* PPM_EXE_WRITABLE is set when the user that executed a process can also write to the executable @@ -148,7 +148,7 @@ TEST(SyscallExit, execveX_failure) /* Parameter 26: exe_file mtime (last modification time, epoch value in nanoseconds) (type: PT_ABSTIME) */ evt_test->assert_numeric_param(26, (uint64_t)1000000000000000000, GREATER_EQUAL); - /* Parameter 27: uid (type: PT_UINT32) */ + /* Parameter 27: euid (type: PT_UID) */ evt_test->assert_numeric_param(27, (uint32_t)geteuid(), EQUAL); /*=============================== ASSERT PARAMETERS ===========================*/ @@ -262,7 +262,7 @@ TEST(SyscallExit, execveX_success) /* Parameter 26: exe_file mtime (last modification time, epoch value in nanoseconds) (type: PT_ABSTIME) */ evt_test->assert_numeric_param(26, (uint64_t)1000000000000000000, GREATER_EQUAL); - /* Parameter 27: uid (type: PT_UINT32) */ + /* Parameter 27: euid (type: PT_UID) */ evt_test->assert_numeric_param(27, (uint32_t)geteuid(), EQUAL); /*=============================== ASSERT PARAMETERS ===========================*/ @@ -456,7 +456,7 @@ TEST(SyscallExit, execveX_upperlayer_success) /* Parameter 26: exe_file mtime (last modifitrueion time, epoch value in nanoseconds) (type: PT_ABSTIME) */ evt_test->assert_numeric_param(26, (uint64_t)1000000000000000000, GREATER_EQUAL); - /* Parameter 27: uid (type: PT_UINT32) */ + /* Parameter 27: euid (type: PT_UID) */ evt_test->assert_numeric_param(27, (uint32_t)geteuid(), EQUAL); /*=============================== ASSERT PARAMETERS ===========================*/ diff --git a/test/drivers/test_suites/syscall_exit_suite/execveat_x.cpp b/test/drivers/test_suites/syscall_exit_suite/execveat_x.cpp index 24dc6a1235..3b35249330 100644 --- a/test/drivers/test_suites/syscall_exit_suite/execveat_x.cpp +++ b/test/drivers/test_suites/syscall_exit_suite/execveat_x.cpp @@ -125,7 +125,7 @@ TEST(SyscallExit, execveatX_failure) /* If we run in a namespace different from the init one probably this will fail. */ evt_test->assert_numeric_param(18, (int64_t)info.pgid); - /* Parameter 19: loginuid (type: PT_UINT32) */ + /* Parameter 19: loginuid (type: PT_UID) */ evt_test->assert_numeric_param(19, (uint32_t)info.loginuid); /* PPM_EXE_WRITABLE is set when the user that executed a process can also write to the executable @@ -151,7 +151,7 @@ TEST(SyscallExit, execveatX_failure) /* Parameter 26: exe_file mtime (last modification time, epoch value in nanoseconds) (type: PT_ABSTIME) */ evt_test->assert_numeric_param(26, (uint64_t)1000000000000000000, GREATER_EQUAL); - /* Parameter 27: uid (type: PT_UINT32) */ + /* Parameter 27: euid (type: PT_UID) */ evt_test->assert_numeric_param(27, (uint32_t)geteuid(), EQUAL); /*=============================== ASSERT PARAMETERS ===========================*/ @@ -273,7 +273,7 @@ TEST(SyscallExit, execveatX_correct_exit) /* Parameter 26: exe_file mtime (last modification time, epoch value in nanoseconds) (type: PT_ABSTIME) */ evt_test->assert_numeric_param(26, (uint64_t)1000000000000000000, GREATER_EQUAL); - /* Parameter 27: uid (type: PT_UINT32) */ + /* Parameter 27: euid (type: PT_UID) */ evt_test->assert_numeric_param(27, (uint32_t)geteuid(), EQUAL); /*=============================== ASSERT PARAMETERS ===========================*/ @@ -398,7 +398,7 @@ TEST(SyscallExit, execveatX_execve_exit) /* Parameter 26: exe_file mtime (last modification time, epoch value in nanoseconds) (type: PT_ABSTIME) */ evt_test->assert_numeric_param(26, (uint64_t)1000000000000000000, GREATER_EQUAL); - /* Parameter 27: uid (type: PT_UINT32) */ + /* Parameter 27: euid (type: PT_UID) */ evt_test->assert_numeric_param(27, (uint32_t)geteuid(), EQUAL); /*=============================== ASSERT PARAMETERS ===========================*/ diff --git a/test/e2e/README.md b/test/e2e/README.md index 771ecdcf0f..f198caaa65 100644 --- a/test/e2e/README.md +++ b/test/e2e/README.md @@ -143,7 +143,7 @@ docker run --rm debian:buster sleep 1 `sinsp-example` will output a bunch of events, one of which looks something like this: ```json -{"container.id":"e397c8dcbb3f","evt.args":"res=0 exe=sleep args=1. tid=472318(sleep) pid=472318(sleep) ptid=472295(containerd-shim) cwd= fdlimit=1073741816 pgft_maj=1 pgft_min=1026 vm_size=364 vm_rss=4 vm_swap=0 comm=sleep cgroups=cpuset=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.cpu=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.cpuacct=/.io=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.memory=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.devices=/.freezer=/.net_cls=/.perf_event=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.net_prio=/.hugetlb=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.pids=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.misc=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope. env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin.HOSTNAME=e397c8dcbb3f.HOME=/root. tty=0 pgid=1(systemd) loginuid=-1 flags=1(EXE_WRITABLE) cap_inheritable=0 cap_permitted=A80425FB cap_effective=A80425FB exe_ino=1213089 exe_ino_ctime=2023-02-10 09:33:30.56273065 exe_ino_mtime=2019-02-28 15:30:31.00000000 uid=0 ","evt.category":"process","evt.num":1483230,"evt.time":1678289852166558200,"evt.type":"execve","proc.cmdline":"sleep 1","proc.exe":"sleep","proc.pid":472318,"proc.ppid":472308} +{"container.id":"e397c8dcbb3f","evt.args":"res=0 exe=sleep args=1. tid=472318(sleep) pid=472318(sleep) ptid=472295(containerd-shim) cwd= fdlimit=1073741816 pgft_maj=1 pgft_min=1026 vm_size=364 vm_rss=4 vm_swap=0 comm=sleep cgroups=cpuset=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.cpu=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.cpuacct=/.io=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.memory=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.devices=/.freezer=/.net_cls=/.perf_event=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.net_prio=/.hugetlb=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.pids=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope.misc=/system.slice/docker-e397c8dcbb3fbf1dfdf05eb4bd5c45bb78066506ac662b481fb475b05cca28da.scope. env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin.HOSTNAME=e397c8dcbb3f.HOME=/root. tty=0 pgid=1(systemd) loginuid=-1\(\\) flags=1(EXE_WRITABLE) cap_inheritable=0 cap_permitted=A80425FB cap_effective=A80425FB exe_ino=1213089 exe_ino_ctime=2023-02-10 09:33:30.56273065 exe_ino_mtime=2019-02-28 15:30:31.00000000 uid=0 ","evt.category":"process","evt.num":1483230,"evt.time":1678289852166558200,"evt.type":"execve","proc.cmdline":"sleep 1","proc.exe":"sleep","proc.pid":472318,"proc.ppid":472308} ``` Because JSON is valid Python, you can copy and paste it directly, we'll drop diff --git a/test/e2e/tests/test_event_generator/test_db_program_spawned_process.py b/test/e2e/tests/test_event_generator/test_db_program_spawned_process.py index 9d9f0aa8a7..64d0af8bf9 100644 --- a/test/e2e/tests/test_event_generator/test_db_program_spawned_process.py +++ b/test/e2e/tests/test_event_generator/test_db_program_spawned_process.py @@ -53,7 +53,7 @@ def test_db_program_spawned_process(sinsp, run_containers: dict): }, { "container.id": generator_id, - "evt.args": SinspField.regex_field(r'^res=0 exe=/bin/ls args=NULL tid=\d+\(ls\) pid=\d+\(ls\) ptid=\d+\(mysqld\) .* tty=0 pgid=1\(systemd\) loginuid=-1 flags=1\(EXE_WRITABLE\) cap_inheritable=0'), + "evt.args": SinspField.regex_field(r'^res=0 exe=/bin/ls args=NULL tid=\d+\(ls\) pid=\d+\(ls\) ptid=\d+\(mysqld\) .* tty=0 pgid=1\(systemd\) loginuid=-1\(\\) flags=1\(EXE_WRITABLE\) cap_inheritable=0'), "evt.category": "process", "evt.num": SinspField.numeric_field(), "evt.time": SinspField.numeric_field(), diff --git a/test/e2e/tests/test_event_generator/test_run_shell_untrusted.py b/test/e2e/tests/test_event_generator/test_run_shell_untrusted.py index f431585d32..ab0a8ae8d8 100644 --- a/test/e2e/tests/test_event_generator/test_run_shell_untrusted.py +++ b/test/e2e/tests/test_event_generator/test_run_shell_untrusted.py @@ -26,7 +26,7 @@ def test_run_shell_untrusted(sinsp, run_containers: dict): expected_events = [ { "container.id": generator_id, - "evt.args": SinspField.regex_field(r'^res=0 exe=\/tmp\/falco-event-generator\d+\/httpd args=--loglevel.info.run.\^helper.RunShell\$. tid=\d+\(httpd\) pid=\d+\(httpd\) ptid=\d+\(event-generator\) .* tty=0 pgid=\d+\(systemd\) loginuid=-1 flags=1\(EXE_WRITABLE\) cap_inheritable=0'), + "evt.args": SinspField.regex_field(r'^res=0 exe=\/tmp\/falco-event-generator\d+\/httpd args=--loglevel.info.run.\^helper.RunShell\$. tid=\d+\(httpd\) pid=\d+\(httpd\) ptid=\d+\(event-generator\) .* tty=0 pgid=\d+\(systemd\) loginuid=-1\(\\) flags=1\(EXE_WRITABLE\) cap_inheritable=0'), "evt.category": "process", "evt.num": SinspField.numeric_field(), "evt.time": SinspField.numeric_field(), @@ -38,7 +38,7 @@ def test_run_shell_untrusted(sinsp, run_containers: dict): }, { "container.id": generator_id, - "evt.args": SinspField.regex_field(r'^res=0 exe=bash args=-c.ls > \/dev\/null. tid=\d+\(bash\) pid=\d+\(bash\) ptid=\d+\(httpd\) .* tty=0 pgid=\d+\(systemd\) loginuid=-1 flags=1\(EXE_WRITABLE\) cap_inheritable=0'), + "evt.args": SinspField.regex_field(r'^res=0 exe=bash args=-c.ls > \/dev\/null. tid=\d+\(bash\) pid=\d+\(bash\) ptid=\d+\(httpd\) .* tty=0 pgid=\d+\(systemd\) loginuid=-1\(\\) flags=1\(EXE_WRITABLE\) cap_inheritable=0'), "evt.category": "process", "evt.num": SinspField.numeric_field(), "evt.time": SinspField.numeric_field(), diff --git a/test/e2e/tests/test_event_generator/test_system_user_interactive.py b/test/e2e/tests/test_event_generator/test_system_user_interactive.py index 4e12b37fb2..723ba672f6 100644 --- a/test/e2e/tests/test_event_generator/test_system_user_interactive.py +++ b/test/e2e/tests/test_event_generator/test_system_user_interactive.py @@ -27,7 +27,7 @@ def test_system_user_interactive(sinsp, run_containers: dict): expected_events = [ { "container.id": generator_id, - "evt.args": SinspField.regex_field(r'^res=0 exe=\/bin\/login args=NULL tid=\d+\(login\) pid=\d+\(login\) ptid=\d+\(event-generator\) .* pgid=\d+\(systemd\) loginuid=-1 flags=0 cap_inheritable=0 cap_permitted=0 cap_effective=0'), + "evt.args": SinspField.regex_field(r'^res=0 exe=\/bin\/login args=NULL tid=\d+\(login\) pid=\d+\(login\) ptid=\d+\(event-generator\) .* pgid=\d+\(systemd\) loginuid=-1\(\\) flags=0 cap_inheritable=0 cap_permitted=0 cap_effective=0'), "evt.category": "process", "evt.num": SinspField.numeric_field(), "evt.time": SinspField.numeric_field(), diff --git a/userspace/libscap/engine/gvisor/parsers.cpp b/userspace/libscap/engine/gvisor/parsers.cpp index 2f0f2bd96c..276a289e64 100644 --- a/userspace/libscap/engine/gvisor/parsers.cpp +++ b/userspace/libscap/engine/gvisor/parsers.cpp @@ -227,9 +227,9 @@ static parse_result parse_container_start(const char *proto, size_t proto_size, gvisor_evt.args(0).c_str(), // args.c_str() // comm scap_const_sized_buffer{cgroups.c_str(), cgroups.length() + 1}, // cgroups scap_const_sized_buffer{env.data(), env.size()}, // env - 0, // tty + UINT32_MAX, // tty (int64_t) 0, // pgid - 0, // loginuid + UINT32_MAX, // loginuid (auid) 0); // flags (not necessary) if (ret.status == SCAP_FAILURE) { @@ -312,9 +312,9 @@ static parse_result parse_execve(const char *proto, size_t proto_size, scap_size comm.c_str(), // comm scap_const_sized_buffer{cgroups.c_str(), cgroups.length() + 1}, // cgroups scap_const_sized_buffer{env.data(), env.size()}, // env - 0, // tty + UINT32_MAX, // tty (int64_t) 0, // pgid - 0, // loginuid + UINT32_MAX, // loginuid (auid) 0); // flags (not necessary) } else diff --git a/userspace/libscap/engine/savefile/scap_savefile.c b/userspace/libscap/engine/savefile/scap_savefile.c index fd652375a6..ee4f7ccd6f 100644 --- a/userspace/libscap/engine/savefile/scap_savefile.c +++ b/userspace/libscap/engine/savefile/scap_savefile.c @@ -112,7 +112,7 @@ static int32_t scap_read_proclist(scap_reader_t* r, uint32_t block_length, uint3 tinfo.pidns_init_start_ts = 0; tinfo.tty = 0; tinfo.exepath[0] = 0; - tinfo.loginuid = -1; + tinfo.loginuid = UINT32_MAX; tinfo.exe_writable = false; tinfo.cap_inheritable = 0; tinfo.cap_permitted = 0; @@ -614,20 +614,20 @@ static int32_t scap_read_proclist(scap_reader_t* r, uint32_t block_length, uint3 // // tty // - if(sub_len && (subreadsize + sizeof(int32_t)) <= sub_len) + if(sub_len && (subreadsize + sizeof(uint32_t)) <= sub_len) { - readsize = r->read(r, &(tinfo.tty), sizeof(int32_t)); - CHECK_READ_SIZE_ERR(readsize, sizeof(int32_t), error); + readsize = r->read(r, &(tinfo.tty), sizeof(uint32_t)); + CHECK_READ_SIZE_ERR(readsize, sizeof(uint32_t), error); subreadsize += readsize; } } // - // loginuid + // loginuid (auid) // - if(sub_len && (subreadsize + sizeof(int32_t)) <= sub_len) + if(sub_len && (subreadsize + sizeof(uint32_t)) <= sub_len) { - readsize = r->read(r, &(tinfo.loginuid), sizeof(int32_t)); + readsize = r->read(r, &(tinfo.loginuid), sizeof(uint32_t)); CHECK_READ_SIZE_ERR(readsize, sizeof(uint32_t), error); subreadsize += readsize; } diff --git a/userspace/libscap/linux/scap_procs.c b/userspace/libscap/linux/scap_procs.c index d83b407e55..9abe8028e4 100644 --- a/userspace/libscap/linux/scap_procs.c +++ b/userspace/libscap/linux/scap_procs.c @@ -79,7 +79,7 @@ int32_t scap_proc_fill_info_from_stats(char* error, char* procdirname, struct sc uint32_t vmswap_kb; uint64_t pfmajor; uint64_t pfminor; - int32_t tty; + uint32_t tty; char line[512]; char tmpc; char* s; @@ -316,7 +316,7 @@ int32_t scap_proc_fill_info_from_stats(char* error, char* procdirname, struct sc // // Extract the line content // - if(sscanf(s + 2, "%c %" PRId64 " %" PRId64 " %" PRId64 " %" PRId32 " %" PRId64 " %" PRId64 " %" PRId64 " %" PRId64 " %" PRId64, + if(sscanf(s + 2, "%c %" PRId64 " %" PRId64 " %" PRId64 " %" PRIu32 " %" PRId64 " %" PRId64 " %" PRId64 " %" PRId64 " %" PRId64, &tmpc, &tmp, &pgid, @@ -447,8 +447,8 @@ int32_t scap_proc_fill_loginuid(char* error, struct scap_threadinfo* tinfo, cons { // If Linux kernel is built with CONFIG_AUDIT=n, loginuid management // (and associated /proc file) is not implemented. - // Record default loginuid value of -1 in this case. - tinfo->loginuid = (uint32_t)-1; + // Record default loginuid value of invalid uid in this case. + tinfo->loginuid = (uint32_t)UINT32_MAX; return SCAP_SUCCESS; } if (fgets(line, sizeof(line), f) == NULL) @@ -460,7 +460,7 @@ int32_t scap_proc_fill_loginuid(char* error, struct scap_threadinfo* tinfo, cons fclose(f); - if(sscanf(line, "%" PRId32, &loginuid) == 1) + if(sscanf(line, "%" PRIu32, &loginuid) == 1) { tinfo->loginuid = loginuid; return SCAP_SUCCESS; diff --git a/userspace/libscap/scap.h b/userspace/libscap/scap.h index 3fd0fdd360..ec9f0f6919 100644 --- a/userspace/libscap/scap.h +++ b/userspace/libscap/scap.h @@ -292,8 +292,8 @@ typedef struct scap_threadinfo int filtered_out; ///< nonzero if this entry should not be saved to file scap_fdinfo* fdlist; ///< The fd table for this process uint64_t clone_ts; ///< When the clone that started this process happened. - int32_t tty; ///< Number of controlling terminal - int32_t loginuid; ///< loginuid (auid) + uint32_t tty; ///< Number of controlling terminal + uint32_t loginuid; ///< loginuid (auid) UT_hash_handle hh; ///< makes this structure hashable }scap_threadinfo; diff --git a/userspace/libscap/scap_savefile.c b/userspace/libscap/scap_savefile.c index f10b46bcea..39be01ae12 100755 --- a/userspace/libscap/scap_savefile.c +++ b/userspace/libscap/scap_savefile.c @@ -639,8 +639,8 @@ int32_t scap_write_proclist_entry_bufs(scap_dumper_t *d, struct scap_threadinfo 2 + cgroupslen + 2 + rootlen + sizeof(uint64_t) + // pidns_init_start_ts - sizeof(int32_t) + // tty - sizeof(int32_t) + // loginuid + sizeof(uint32_t) + // tty + sizeof(uint32_t) + // loginuid (auid) sizeof(uint8_t) + // exe_writable sizeof(uint64_t) + // cap_inheritable sizeof(uint64_t) + // cap_permitted diff --git a/userspace/libsinsp/filterchecks.cpp b/userspace/libsinsp/filterchecks.cpp index 3a979931ea..14c2cf357d 100644 --- a/userspace/libsinsp/filterchecks.cpp +++ b/userspace/libsinsp/filterchecks.cpp @@ -2361,7 +2361,7 @@ const filtercheck_field_info sinsp_filter_check_thread_fields[] = {PT_CHARBUF, EPF_NONE, PF_NA, "proc.env", "Environment", "The environment variables of the process generating the event."}, {PT_CHARBUF, EPF_NONE, PF_NA, "proc.cwd", "Current Working Directory", "The current working directory of the event."}, {PT_INT64, EPF_NONE, PF_ID, "proc.loginshellid", "Login Shell ID", "The pid of the oldest shell among the ancestors of the current process, if there is one. This field can be used to separate different user sessions, and is useful in conjunction with chisels like spy_user."}, - {PT_INT32, EPF_NONE, PF_ID, "proc.tty", "Process TTY", "The controlling terminal of the process. 0 for processes without a terminal."}, + {PT_UINT32, EPF_NONE, PF_ID, "proc.tty", "Process TTY", "The controlling terminal of the process. 0 for processes without a terminal."}, {PT_INT64, EPF_NONE, PF_ID, "proc.pid", "Process ID", "The id of the process generating the event."}, {PT_INT64, EPF_NONE, PF_ID, "proc.ppid", "Parent Process ID", "The pid of the parent of the process generating the event."}, {PT_INT64, EPF_NONE, PF_ID, "proc.apid", "Ancestor Process ID", "The pid for a specific process ancestor. You can access different levels of ancestors by using indices. For example, proc.apid[1] retrieves the pid of the parent process, proc.apid[2] retrieves the pid of the grandparent process, and so on. The current process's pid can be obtained using proc.apid[0]. When used without any arguments, proc.acmdline is applicable only in filters and matches any of the process ancestors. For instance, you can use `proc.apid=1337` to match any process ancestor whose pid is equal to 1337."}, @@ -6087,7 +6087,7 @@ const filtercheck_field_info sinsp_filter_check_user_fields[] = {PT_CHARBUF, EPF_NONE, PF_NA, "user.name", "User Name", "user name."}, {PT_CHARBUF, EPF_NONE, PF_NA, "user.homedir", "Home Directory", "home directory of the user."}, {PT_CHARBUF, EPF_NONE, PF_NA, "user.shell", "Shell", "user's shell."}, - {PT_INT32, EPF_NONE, PF_ID, "user.loginuid", "Login User ID", "audit user id (auid)."}, + {PT_INT64, EPF_NONE, PF_ID, "user.loginuid", "Login User ID", "audit user id (auid), internally the loginuid is of type `uint32_t`. However, if an invalid uid corresponding to UINT32_MAX is encountered, it is returned as -1 to support familiar filtering conditions."}, {PT_CHARBUF, EPF_NONE, PF_NA, "user.loginname", "Login User Name", "audit user name (auid)."}, }; @@ -6141,7 +6141,12 @@ uint8_t* sinsp_filter_check_user::extract(sinsp_evt *evt, OUT uint32_t* len, boo case TYPE_SHELL: RETURN_EXTRACT_CSTR(tinfo->m_user.shell); case TYPE_LOGINUID: - RETURN_EXTRACT_VAR(tinfo->m_loginuser.uid); + m_s64val = (int64_t)-1; + if(tinfo->m_loginuser.uid < UINT32_MAX) + { + m_s64val = (int64_t)tinfo->m_loginuser.uid; + } + RETURN_EXTRACT_VAR(m_s64val); case TYPE_LOGINNAME: RETURN_EXTRACT_CSTR(tinfo->m_loginuser.name); default: diff --git a/userspace/libsinsp/filterchecks.h b/userspace/libsinsp/filterchecks.h index 3f0736c51b..d1f7417042 100644 --- a/userspace/libsinsp/filterchecks.h +++ b/userspace/libsinsp/filterchecks.h @@ -666,6 +666,7 @@ class sinsp_filter_check_user : public sinsp_filter_check uint32_t m_uid; std::string m_strval; + int64_t m_s64val; }; // diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp index 2cfa6868ea..019278a642 100644 --- a/userspace/libsinsp/parsers.cpp +++ b/userspace/libsinsp/parsers.cpp @@ -2438,8 +2438,8 @@ void sinsp_parser::parse_execve_exit(sinsp_evt *evt) case PPME_SYSCALL_EXECVEAT_X: // Get the tty parinfo = evt->get_param(16); - ASSERT(parinfo->m_len == sizeof(int32_t)); - evt->m_tinfo->m_tty = *(int32_t *) parinfo->m_val; + ASSERT(parinfo->m_len == sizeof(uint32_t)); + evt->m_tinfo->m_tty = *(uint32_t *) parinfo->m_val; break; default: ASSERT(false); diff --git a/userspace/libsinsp/test/events_proc.ut.cpp b/userspace/libsinsp/test/events_proc.ut.cpp index 38c3075e6d..7907d6c8c2 100644 --- a/userspace/libsinsp/test/events_proc.ut.cpp +++ b/userspace/libsinsp/test/events_proc.ut.cpp @@ -321,6 +321,7 @@ TEST_F(sinsp_with_test_input, spawn_process) uint64_t parent_pid = 1, parent_tid = 1, child_pid = 20, child_tid = 20, null_pid = 0; uint64_t fdlimit = 1024, pgft_maj = 0, pgft_min = 1; uint64_t exe_ino = 242048, ctime = 1676262698000004588, mtime = 1676262698000004577; + uint32_t loginuid = UINT32_MAX - 1, euid = 2000U; scap_const_sized_buffer empty_bytebuf = {.buf = nullptr, .size = 0}; @@ -342,7 +343,7 @@ TEST_F(sinsp_with_test_input, spawn_process) add_event_advance_ts(increasing_ts(), child_tid, PPME_SYSCALL_EXECVE_19_E, 1, "/bin/test-exe"); /* Execve exit event */ - evt = add_event_advance_ts(increasing_ts(), child_tid, PPME_SYSCALL_EXECVE_19_X, 27, 0, "/bin/test-exe", scap_const_sized_buffer{argsv.data(), argsv.size()}, child_tid, child_pid, parent_tid, "", fdlimit, pgft_maj, pgft_min, 29612, 4, 0, "test-exe", scap_const_sized_buffer{cgroupsv.data(), cgroupsv.size()}, scap_const_sized_buffer{envv.data(), envv.size()}, 34818, parent_pid, 1000, PPM_EXE_WRITABLE, parent_pid, parent_pid, parent_pid, exe_ino, ctime, mtime, 2000); + evt = add_event_advance_ts(increasing_ts(), child_tid, PPME_SYSCALL_EXECVE_19_X, 27, 0, "/bin/test-exe", scap_const_sized_buffer{argsv.data(), argsv.size()}, child_tid, child_pid, parent_tid, "", fdlimit, pgft_maj, pgft_min, 29612, 4, 0, "test-exe", scap_const_sized_buffer{cgroupsv.data(), cgroupsv.size()}, scap_const_sized_buffer{envv.data(), envv.size()}, 34818, parent_pid, loginuid, PPM_EXE_WRITABLE, parent_pid, parent_pid, parent_pid, exe_ino, ctime, mtime, euid); // check that the cwd is inherited from the parent (default process has /root/) ASSERT_EQ(get_field_as_string(evt, "proc.cwd"), "/root/"); @@ -404,7 +405,7 @@ TEST_F(sinsp_with_test_input, spawn_process) ASSERT_EQ(get_field_as_string(evt, "proc.exeline"), "/bin/test-exe -c 'echo aGVsbG8K | base64 -d'"); ASSERT_EQ(get_field_as_string(evt, "proc.tty"), "34818"); ASSERT_EQ(get_field_as_string(evt, "proc.vpgid"), "1"); - ASSERT_EQ(get_field_as_string(evt, "user.loginuid"), "1000"); + ASSERT_EQ(get_field_as_string(evt, "user.loginuid"), "4294967294"); ASSERT_EQ(get_field_as_string(evt, "user.uid"), "2000"); ASSERT_EQ(get_field_as_string(evt, "proc.cwd"), "/root/"); ASSERT_EQ(get_field_as_string(evt, "proc.vmsize"), "29612"); diff --git a/userspace/libsinsp/test/sinsp_with_test_input.h b/userspace/libsinsp/test/sinsp_with_test_input.h index 1aa463538e..77fc7c12ee 100644 --- a/userspace/libsinsp/test/sinsp_with_test_input.h +++ b/userspace/libsinsp/test/sinsp_with_test_input.h @@ -265,7 +265,7 @@ class sinsp_with_test_input : public ::testing::Test { int64_t fdlimit=0x100000, uint32_t flags=0, bool exe_writable=true, uint64_t cap_permitted=0x1ffffffffff, uint64_t cap_inheritable=0, uint64_t cap_effective=0x1ffffffffff, uint32_t vmsize_kb=10000, uint32_t vmrss_kb=100, uint32_t vmswap_kb=0, uint64_t pfmajor=222, uint64_t pfminor=22, - std::vector cgroups={}, std::string root="/", int filtered_out=0, int32_t tty=0, int32_t loginuid=-1) + std::vector cgroups={}, std::string root="/", int filtered_out=0, uint32_t tty=0, uint32_t loginuid=UINT32_MAX) { scap_threadinfo tinfo = {}; tinfo.tid = tid; diff --git a/userspace/libsinsp/threadinfo.h b/userspace/libsinsp/threadinfo.h index f0793eb4a4..2f992cb883 100644 --- a/userspace/libsinsp/threadinfo.h +++ b/userspace/libsinsp/threadinfo.h @@ -442,12 +442,11 @@ class SINSP_PUBLIC sinsp_threadinfo: public libsinsp::state::table_entry std::string m_root; size_t m_program_hash; ///< Unique hash of the current program size_t m_program_hash_scripts; ///< Unique hash of the current program, including arguments for scripting programs (like python or ruby) - int32_t m_tty; ///< Number of controlling terminal + uint32_t m_tty; ///< Number of controlling terminal std::shared_ptr m_tginfo; std::list> m_children; uint64_t m_not_expired_children; - // In some cases, a threadinfo has a category that identifies // why it was run. Descriptions: // CAT_NONE: no specific category From 472884a7bfbaa0ae0a15e11d726fbc6aae04c332 Mon Sep 17 00:00:00 2001 From: Melissa Kilby Date: Tue, 1 Aug 2023 04:46:17 +0000 Subject: [PATCH 2/5] fix(driver): fix INVALID_UID for loginuid in bpf driver Co-authored-by: Andrea Terzolo Signed-off-by: Melissa Kilby --- driver/bpf/fillers.h | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h index 74d44cc995..7d89619b35 100644 --- a/driver/bpf/fillers.h +++ b/driver/bpf/fillers.h @@ -2726,14 +2726,14 @@ FILLER(proc_startupdate_3, true) if (audit) { loginuid = _READ(audit->loginuid); } else { - loginuid = UINT32_MAX; + loginuid = INVALID_UID; } } #else loginuid = _READ(task->loginuid); #endif /* COS_73_WORKAROUND */ #else - loginuid.val = UINT32_MAX; + loginuid.val = INVALID_UID; #endif /* CONFIG_AUDIT... */ res = bpf_push_u32_to_ring(data, loginuid.val); @@ -6525,14 +6525,14 @@ FILLER(sched_prog_exec_3, false) } else { - loginuid = UINT32_MAX; + loginuid = INVALID_UID; } } #else loginuid = _READ(task->loginuid); #endif /* COS_73_WORKAROUND */ #else - loginuid.val = UINT32_MAX; + loginuid.val = INVALID_UID; #endif /* CONFIG_AUDIT... */ /* Parameter 19: loginuid (type: PT_UID) */ From c4b89824cdc3b0330d1559a185dafb2b8361f5b2 Mon Sep 17 00:00:00 2001 From: Melissa Kilby Date: Tue, 1 Aug 2023 04:46:40 +0000 Subject: [PATCH 3/5] cleanup(test): more libsinsp unit test coverage for loginuid Co-authored-by: Andrea Terzolo Signed-off-by: Melissa Kilby --- userspace/libsinsp/test/events_proc.ut.cpp | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/userspace/libsinsp/test/events_proc.ut.cpp b/userspace/libsinsp/test/events_proc.ut.cpp index 7907d6c8c2..e0a372d9dd 100644 --- a/userspace/libsinsp/test/events_proc.ut.cpp +++ b/userspace/libsinsp/test/events_proc.ut.cpp @@ -435,6 +435,7 @@ TEST_F(sinsp_with_test_input, spawn_process_container) uint64_t parent_pid = 1, parent_tid = 1, child_pid = 20, child_tid = 20; uint64_t fdlimit = 1024, pgft_maj = 0, pgft_min = 1; uint64_t exe_ino = 242048, ctime = 1676262698000004577, mtime = 1676262698000004588; + uint32_t loginuid = UINT32_MAX, euid = UINT32_MAX; scap_const_sized_buffer empty_bytebuf = {.buf = nullptr, .size = 0}; @@ -458,7 +459,7 @@ TEST_F(sinsp_with_test_input, spawn_process_container) add_event_advance_ts(increasing_ts(), -1, PPME_CONTAINER_JSON_2_E, 1, container.c_str()); add_event_advance_ts(increasing_ts(), child_tid, PPME_SYSCALL_EXECVE_19_E, 1, "/bin/test-exe"); - evt = add_event_advance_ts(increasing_ts(), child_tid, PPME_SYSCALL_EXECVE_19_X, 27, 0, "/bin/test-exe", scap_const_sized_buffer{argsv.data(), argsv.size()}, child_tid, child_pid, parent_tid, "", fdlimit, pgft_maj, pgft_min, 29612, 4, 0, "test-exe", scap_const_sized_buffer{cgroupsv.data(), cgroupsv.size()}, scap_const_sized_buffer{envv.data(), envv.size()}, 34818, parent_pid, 1000, PPM_EXE_UPPER_LAYER, parent_pid, parent_pid, parent_pid, exe_ino, ctime, mtime, 2000); + evt = add_event_advance_ts(increasing_ts(), child_tid, PPME_SYSCALL_EXECVE_19_X, 27, 0, "/bin/test-exe", scap_const_sized_buffer{argsv.data(), argsv.size()}, child_tid, child_pid, parent_tid, "", fdlimit, pgft_maj, pgft_min, 29612, 4, 0, "test-exe", scap_const_sized_buffer{cgroupsv.data(), cgroupsv.size()}, scap_const_sized_buffer{envv.data(), envv.size()}, 34818, parent_pid, loginuid, PPM_EXE_UPPER_LAYER, parent_pid, parent_pid, parent_pid, exe_ino, ctime, mtime, euid); // check that the container has been correctly detected and the short ID is correct ASSERT_EQ(get_field_as_string(evt, "container.id"), "f9c7a020960a"); @@ -468,8 +469,9 @@ TEST_F(sinsp_with_test_input, spawn_process_container) ASSERT_EQ(get_field_as_string(evt, "proc.vpid"), "1"); ASSERT_EQ(get_field_as_string(evt, "thread.vtid"), "1"); // check more fields + ASSERT_EQ(get_field_as_string(evt, "user.loginuid"), "-1"); ASSERT_EQ(get_field_as_string(evt, "proc.is_exe_upper_layer"), "true"); - ASSERT_EQ(get_field_as_string(evt, "user.uid"), "2000"); + ASSERT_EQ(get_field_as_string(evt, "user.uid"), "4294967295"); } #endif // MINIMAL_BUILD From c88685fa7473d20fa52416afaf73c3d98358434d Mon Sep 17 00:00:00 2001 From: Melissa Kilby Date: Tue, 1 Aug 2023 16:10:16 +0000 Subject: [PATCH 4/5] fix(driver): revert/use UINT32_MAX for loginuid.val in bpf driver Co-authored-by: Andrea Terzolo Signed-off-by: Melissa Kilby --- driver/bpf/fillers.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/driver/bpf/fillers.h b/driver/bpf/fillers.h index 7d89619b35..d02cdbc8d1 100644 --- a/driver/bpf/fillers.h +++ b/driver/bpf/fillers.h @@ -2733,7 +2733,7 @@ FILLER(proc_startupdate_3, true) loginuid = _READ(task->loginuid); #endif /* COS_73_WORKAROUND */ #else - loginuid.val = INVALID_UID; + loginuid.val = UINT32_MAX; #endif /* CONFIG_AUDIT... */ res = bpf_push_u32_to_ring(data, loginuid.val); @@ -6532,7 +6532,7 @@ FILLER(sched_prog_exec_3, false) loginuid = _READ(task->loginuid); #endif /* COS_73_WORKAROUND */ #else - loginuid.val = INVALID_UID; + loginuid.val = UINT32_MAX; #endif /* CONFIG_AUDIT... */ /* Parameter 19: loginuid (type: PT_UID) */ From edb2cd6867e6690a7aba1aadd8e013c58c10576a Mon Sep 17 00:00:00 2001 From: Melissa Kilby Date: Wed, 2 Aug 2023 15:09:30 +0000 Subject: [PATCH 5/5] cleanup: fix remaining tty uint32_t change inconsistencies Co-authored-by: Federico Di Pierro Signed-off-by: Melissa Kilby --- userspace/libscap/engine/gvisor/parsers.cpp | 4 ++-- userspace/libscap/scap_savefile.c | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/userspace/libscap/engine/gvisor/parsers.cpp b/userspace/libscap/engine/gvisor/parsers.cpp index 276a289e64..3198418a82 100644 --- a/userspace/libscap/engine/gvisor/parsers.cpp +++ b/userspace/libscap/engine/gvisor/parsers.cpp @@ -227,7 +227,7 @@ static parse_result parse_container_start(const char *proto, size_t proto_size, gvisor_evt.args(0).c_str(), // args.c_str() // comm scap_const_sized_buffer{cgroups.c_str(), cgroups.length() + 1}, // cgroups scap_const_sized_buffer{env.data(), env.size()}, // env - UINT32_MAX, // tty + 0, // tty (int64_t) 0, // pgid UINT32_MAX, // loginuid (auid) 0); // flags (not necessary) @@ -312,7 +312,7 @@ static parse_result parse_execve(const char *proto, size_t proto_size, scap_size comm.c_str(), // comm scap_const_sized_buffer{cgroups.c_str(), cgroups.length() + 1}, // cgroups scap_const_sized_buffer{env.data(), env.size()}, // env - UINT32_MAX, // tty + 0, // tty (int64_t) 0, // pgid UINT32_MAX, // loginuid (auid) 0); // flags (not necessary) diff --git a/userspace/libscap/scap_savefile.c b/userspace/libscap/scap_savefile.c index 39be01ae12..44c368456c 100755 --- a/userspace/libscap/scap_savefile.c +++ b/userspace/libscap/scap_savefile.c @@ -685,7 +685,7 @@ int32_t scap_write_proclist_entry_bufs(scap_dumper_t *d, struct scap_threadinfo scap_dump_write(d, &rootlen, sizeof(uint16_t)) != sizeof(uint16_t) || scap_dump_write(d, (char *) root, rootlen) != rootlen || scap_dump_write(d, &(tinfo->pidns_init_start_ts), sizeof(uint64_t)) != sizeof(uint64_t) || - scap_dump_write(d, &(tinfo->tty), sizeof(int32_t)) != sizeof(int32_t) || + scap_dump_write(d, &(tinfo->tty), sizeof(uint32_t)) != sizeof(uint32_t) || scap_dump_write(d, &(tinfo->loginuid), sizeof(uint32_t)) != sizeof(uint32_t) || scap_dump_write(d, &(tinfo->exe_writable), sizeof(uint8_t)) != sizeof(uint8_t) || scap_dump_write(d, &(tinfo->cap_inheritable), sizeof(uint64_t)) != sizeof(uint64_t) ||