Skip to content

fix(driver, userspace): fix loginuid, euid and tty types to uint32_t #1192

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
poiana merged 5 commits into from
Aug 2, 2023
Merged

fix(driver, userspace): fix loginuid, euid and tty types to uint32_t #1192

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
d597d48
fix(driver, userspace): fix loginuid, euid and tty types
incertum Jul 28, 2023
472884a
fix(driver): fix INVALID_UID for loginuid in bpf driver
incertum Aug 1, 2023
c4b8982
cleanup(test): more libsinsp unit test coverage for loginuid
incertum Aug 1, 2023
c88685f
fix(driver): revert/use UINT32_MAX for loginuid.val in bpf driver
incertum Aug 1, 2023
edb2cd6
cleanup: fix remaining tty uint32_t change inconsistencies
incertum Aug 2, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
26 changes: 13 additions & 13 deletions driver/bpf/fillers.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1627,7 +1627,7 @@ FILLER(sys_execveat_e, true)
return bpf_push_u32_to_ring(data, flags);
}

static __always_inline int bpf_ppm_get_tty(struct task_struct *task)
static __always_inline uint32_t bpf_ppm_get_tty(struct task_struct *task)
{
struct signal_struct *sig;
struct tty_struct *tty;
Expand Down Expand Up @@ -2639,7 +2639,7 @@ FILLER(proc_startupdate_3, true)
*/
long env_len = 0;
kuid_t loginuid;
int tty;
uint32_t tty;
struct file *exe_file;

/*
Expand Down Expand Up @@ -2706,7 +2706,7 @@ FILLER(proc_startupdate_3, true)
*/
tty = bpf_ppm_get_tty(task);
Comment thread
incertum marked this conversation as resolved.

res = bpf_push_s32_to_ring(data, tty);
res = bpf_push_u32_to_ring(data, tty);
CHECK_RES(res);

/*
Expand All @@ -2733,10 +2733,10 @@ FILLER(proc_startupdate_3, true)
loginuid = _READ(task->loginuid);
#endif /* COS_73_WORKAROUND */
#else
loginuid.val = -1;
loginuid.val = UINT32_MAX;
#endif /* CONFIG_AUDIT... */

res = bpf_push_s32_to_ring(data, loginuid.val);
res = bpf_push_u32_to_ring(data, loginuid.val);
CHECK_RES(res);

bpf_tail_call(data->ctx, &tail_map, PPM_FILLER_execve_family_flags);
Expand Down Expand Up @@ -2846,7 +2846,7 @@ FILLER(execve_family_flags, true)
res = bpf_push_u64_to_ring(data, bpf_epoch_ns_from_time(time));
CHECK_RES(res);

/* Parameter 27: uid */
/* Parameter 27: euid (type: PT_UID) */
euid = _READ(cred->euid);
return bpf_push_u32_to_ring(data, euid.val);
}
Expand Down Expand Up @@ -6504,9 +6504,9 @@ FILLER(sched_prog_exec_3, false)
res = __bpf_val_to_ring(data, 0, env_len, PT_BYTEBUF, -1, false, KERNEL);
CHECK_RES(res);

/* Parameter 17: tty (type: PT_INT32) */
int tty = bpf_ppm_get_tty(task);
res = bpf_push_s32_to_ring(data, tty);
/* Parameter 17: tty (type: PT_UINT32) */
uint32_t tty = bpf_ppm_get_tty(task);
res = bpf_push_u32_to_ring(data, tty);
CHECK_RES(res);

/* Parameter 18: pgid (type: PT_PID) */
Expand All @@ -6532,11 +6532,11 @@ FILLER(sched_prog_exec_3, false)
loginuid = _READ(task->loginuid);
#endif /* COS_73_WORKAROUND */
#else
loginuid.val = -1;
loginuid.val = UINT32_MAX;
#endif /* CONFIG_AUDIT... */

/* Parameter 19: loginuid (type: PT_INT32) */
res = bpf_push_s32_to_ring(data, loginuid.val);
/* Parameter 19: loginuid (type: PT_UID) */
res = bpf_push_u32_to_ring(data, loginuid.val);
CHECK_RES(res);

bpf_tail_call(data->ctx, &tail_map, PPM_FILLER_sched_prog_exec_4);
Expand Down Expand Up @@ -6641,7 +6641,7 @@ FILLER(sched_prog_exec_4, false)
res = bpf_push_u64_to_ring(data, bpf_epoch_ns_from_time(time));
CHECK_RES(res);

/* Parameter 27: uid */
/* Parameter 27: euid (type: PT_UID) */
euid = _READ(cred->euid);
return bpf_push_u32_to_ring(data, euid.val);
}
Expand Down
4 changes: 2 additions & 2 deletions driver/event_table.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -342,7 +342,7 @@ const struct ppm_event_info g_event_info[] = {
[PPME_PAGE_FAULT_E] = {"page_fault", EC_OTHER | EC_TRACEPOINT, EF_SKIPPARSERESET, 3, {{"addr", PT_UINT64, PF_HEX}, {"ip", PT_UINT64, PF_HEX}, {"error", PT_FLAGS32, PF_HEX, pf_flags} } },
[PPME_PAGE_FAULT_X] = {"NA", EC_UNKNOWN, EF_UNUSED, 0},
[PPME_SYSCALL_EXECVE_19_E] = {"execve", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 1, {{"filename", PT_FSPATH, PF_NA} } },
[PPME_SYSCALL_EXECVE_19_X] = {"execve", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 27, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC}, {"pgid", PT_PID, PF_DEC}, {"loginuid", PT_INT32, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, execve_flags}, {"cap_inheritable", PT_UINT64, PF_HEX}, {"cap_permitted", PT_UINT64, PF_HEX}, {"cap_effective", PT_UINT64, PF_HEX}, {"exe_ino", PT_UINT64, PF_DEC}, {"exe_ino_ctime", PT_ABSTIME, PF_DEC}, {"exe_ino_mtime", PT_ABSTIME, PF_DEC}, {"uid", PT_INT32, PF_DEC} } },
[PPME_SYSCALL_EXECVE_19_X] = {"execve", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 27, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_UINT32, PF_DEC}, {"pgid", PT_PID, PF_DEC}, {"loginuid", PT_UID, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, execve_flags}, {"cap_inheritable", PT_UINT64, PF_HEX}, {"cap_permitted", PT_UINT64, PF_HEX}, {"cap_effective", PT_UINT64, PF_HEX}, {"exe_ino", PT_UINT64, PF_DEC}, {"exe_ino_ctime", PT_ABSTIME, PF_DEC}, {"exe_ino_mtime", PT_ABSTIME, PF_DEC}, {"uid", PT_UID, PF_DEC} } },
[PPME_SYSCALL_SETPGID_E] = {"setpgid", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 2, {{"pid", PT_PID, PF_DEC}, {"pgid", PT_PID, PF_DEC} } },
[PPME_SYSCALL_SETPGID_X] = {"setpgid", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 1, {{"res", PT_PID, PF_DEC} } },
[PPME_SYSCALL_BPF_E] = {"bpf", EC_OTHER | EC_SYSCALL, EF_CREATES_FD | EF_OLD_VERSION, 1, {{"cmd", PT_INT64, PF_DEC} } },
Expand Down Expand Up @@ -380,7 +380,7 @@ const struct ppm_event_info g_event_info[] = {
[PPME_SYSCALL_MPROTECT_E] = {"mprotect", EC_MEMORY | EC_SYSCALL, EF_NONE, 3, {{"addr", PT_UINT64, PF_HEX}, {"length", PT_UINT64, PF_DEC}, {"prot", PT_FLAGS32, PF_HEX, prot_flags} } },
[PPME_SYSCALL_MPROTECT_X] = {"mprotect", EC_MEMORY | EC_SYSCALL, EF_NONE, 1, {{"res", PT_ERRNO, PF_DEC} } },
[PPME_SYSCALL_EXECVEAT_E] = {"execveat", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 3, {{"dirfd", PT_FD, PF_DEC}, {"pathname", PT_FSRELPATH, PF_NA, DIRFD_PARAM(0)}, {"flags", PT_FLAGS32, PF_HEX, execveat_flags} } },
[PPME_SYSCALL_EXECVEAT_X] = {"execveat", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 27, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_INT32, PF_DEC}, {"pgid", PT_PID, PF_DEC}, {"loginuid", PT_INT32, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, execve_flags}, {"cap_inheritable", PT_UINT64, PF_HEX}, {"cap_permitted", PT_UINT64, PF_HEX}, {"cap_effective", PT_UINT64, PF_HEX}, {"exe_ino", PT_UINT64, PF_DEC}, {"exe_ino_ctime", PT_ABSTIME, PF_DEC}, {"exe_ino_mtime", PT_ABSTIME, PF_DEC}, {"uid", PT_INT32, PF_DEC} } },
[PPME_SYSCALL_EXECVEAT_X] = {"execveat", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 27, {{"res", PT_ERRNO, PF_DEC}, {"exe", PT_CHARBUF, PF_NA}, {"args", PT_BYTEBUF, PF_NA}, {"tid", PT_PID, PF_DEC}, {"pid", PT_PID, PF_DEC}, {"ptid", PT_PID, PF_DEC}, {"cwd", PT_CHARBUF, PF_NA}, {"fdlimit", PT_UINT64, PF_DEC}, {"pgft_maj", PT_UINT64, PF_DEC}, {"pgft_min", PT_UINT64, PF_DEC}, {"vm_size", PT_UINT32, PF_DEC}, {"vm_rss", PT_UINT32, PF_DEC}, {"vm_swap", PT_UINT32, PF_DEC}, {"comm", PT_CHARBUF, PF_NA}, {"cgroups", PT_BYTEBUF, PF_NA}, {"env", PT_BYTEBUF, PF_NA}, {"tty", PT_UINT32, PF_DEC}, {"pgid", PT_PID, PF_DEC}, {"loginuid", PT_UID, PF_DEC}, {"flags", PT_FLAGS32, PF_HEX, execve_flags}, {"cap_inheritable", PT_UINT64, PF_HEX}, {"cap_permitted", PT_UINT64, PF_HEX}, {"cap_effective", PT_UINT64, PF_HEX}, {"exe_ino", PT_UINT64, PF_DEC}, {"exe_ino_ctime", PT_ABSTIME, PF_DEC}, {"exe_ino_mtime", PT_ABSTIME, PF_DEC}, {"uid", PT_UID, PF_DEC} } },
[PPME_SYSCALL_COPY_FILE_RANGE_E] = {"copy_file_range", EC_FILE | EC_SYSCALL, EF_USES_FD | EF_READS_FROM_FD | EF_WRITES_TO_FD, 3, {{"fdin", PT_FD, PF_DEC}, {"offin", PT_UINT64, PF_DEC}, {"len", PT_UINT64, PF_DEC} } },
[PPME_SYSCALL_COPY_FILE_RANGE_X] = {"copy_file_range", EC_FILE | EC_SYSCALL, EF_USES_FD | EF_READS_FROM_FD | EF_WRITES_TO_FD, 3, {{"res", PT_ERRNO, PF_DEC}, {"fdout", PT_FD, PF_DEC}, {"offout", PT_UINT64, PF_DEC} } },
[PPME_SYSCALL_CLONE3_E] = {"clone3", EC_PROCESS | EC_SYSCALL, EF_MODIFIES_STATE, 0},
Expand Down
3 changes: 2 additions & 1 deletion driver/modern_bpf/helpers/extract/extract_from_kernel.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -618,7 +618,7 @@ static __always_inline u32 exctract__tty(struct task_struct *task)
*/
static __always_inline void extract__loginuid(struct task_struct *task, u32 *loginuid)
{
*loginuid = -1;
*loginuid = UINT32_MAX;

if(bpf_core_field_exists(task->loginuid))
{
Expand Down Expand Up @@ -686,6 +686,7 @@ static __always_inline unsigned long extract__clone_flags(struct task_struct *ta
*/
static __always_inline void extract__euid(struct task_struct *task, u32 *euid)
{
*euid = UINT32_MAX;
READ_TASK_FIELD_INTO(euid, task, cred, euid.val);
}

Expand Down
16 changes: 8 additions & 8 deletions driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,18 +161,18 @@ int BPF_PROG(t1_sched_p_exec,
*/
auxmap__store_bytebuf_param(auxmap, env_start_pointer, total_env_len & (MAX_PROC_ARG_ENV - 1), USER);

/* Parameter 17: tty (type: PT_INT32) */
/* Parameter 17: tty (type: PT_UINT32) */
u32 tty = exctract__tty(task);
auxmap__store_s32_param(auxmap, (s32)tty);
auxmap__store_u32_param(auxmap, (u32)tty);

/* Parameter 18: pgid (type: PT_PID) */
pid_t pgid = extract__task_xid_vnr(task, PIDTYPE_PGID);
auxmap__store_s64_param(auxmap, (s64)pgid);

/* Parameter 19: loginuid (type: PT_INT32) */
/* Parameter 19: loginuid (type: PT_UID) */
u32 loginuid;
extract__loginuid(task, &loginuid);
auxmap__store_s32_param(auxmap, (s32)loginuid);
auxmap__store_u32_param(auxmap, (u32)loginuid);

/* Parameter 20: flags (type: PT_FLAGS32) */
u32 flags = 0;
Expand Down Expand Up @@ -220,10 +220,10 @@ int BPF_PROG(t1_sched_p_exec,
BPF_CORE_READ_INTO(&time, exe_inode, i_mtime);
auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time));

/* Parameter 27: uid (type: PT_UINT32) */
u32 uid = 0;
extract__euid(task, &uid);
auxmap__store_u32_param(auxmap, uid);
/* Parameter 27: euid (type: PT_UID) */
u32 euid;
extract__euid(task, &euid);
auxmap__store_u32_param(auxmap, euid);

/*=============================== COLLECT PARAMETERS ===========================*/

Expand Down
14 changes: 7 additions & 7 deletions driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -227,16 +227,16 @@ int BPF_PROG(t1_execve_x,

/* Parameter 17: tty (type: PT_INT32) */
u32 tty = exctract__tty(task);
auxmap__store_s32_param(auxmap, (s32)tty);
auxmap__store_u32_param(auxmap, (u32)tty);

/* Parameter 18: pgid (type: PT_PID) */
pid_t pgid = extract__task_xid_vnr(task, PIDTYPE_PGID);
auxmap__store_s64_param(auxmap, (s64)pgid);

/* Parameter 19: loginuid (type: PT_INT32) */
/* Parameter 19: loginuid (type: PT_UID) */
u32 loginuid;
extract__loginuid(task, &loginuid);
auxmap__store_s32_param(auxmap, (s32)loginuid);
auxmap__store_u32_param(auxmap, (u32)loginuid);

/* Parameter 20: flags (type: PT_FLAGS32) */
u32 flags = 0;
Expand Down Expand Up @@ -284,10 +284,10 @@ int BPF_PROG(t1_execve_x,
BPF_CORE_READ_INTO(&time, exe_inode, i_mtime);
auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time));

/* Parameter 27: uid (type: PT_UINT32) */
u32 uid = 0;
extract__euid(task, &uid);
auxmap__store_u32_param(auxmap, uid);
/* Parameter 27: euid (type: PT_UID) */
u32 euid;
extract__euid(task, &euid);
auxmap__store_u32_param(auxmap, euid);

/*=============================== COLLECT PARAMETERS ===========================*/

Expand Down
16 changes: 8 additions & 8 deletions driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execveat.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -242,18 +242,18 @@ int BPF_PROG(t1_execveat_x,
auxmap__store_execve_args(auxmap, (char **)envp, 0);
}

/* Parameter 17: tty (type: PT_INT32) */
/* Parameter 17: tty (type: PT_UID) */
u32 tty = exctract__tty(task);
auxmap__store_s32_param(auxmap, (s32)tty);
auxmap__store_u32_param(auxmap, (u32)tty);

/* Parameter 18: pgid (type: PT_PID) */
pid_t pgid = extract__task_xid_vnr(task, PIDTYPE_PGID);
auxmap__store_s64_param(auxmap, (s64)pgid);

/* Parameter 19: loginuid (type: PT_INT32) */
/* Parameter 19: loginuid (type: PT_UID) */
u32 loginuid;
extract__loginuid(task, &loginuid);
auxmap__store_s32_param(auxmap, (s32)loginuid);
auxmap__store_u32_param(auxmap, (u32)loginuid);

/* Parameter 20: flags (type: PT_FLAGS32) */
u32 flags = 0;
Expand Down Expand Up @@ -300,10 +300,10 @@ int BPF_PROG(t1_execveat_x,
BPF_CORE_READ_INTO(&time, exe_inode, i_mtime);
auxmap__store_u64_param(auxmap, extract__epoch_ns_from_time(time));

/* Parameter 27: uid (type: PT_UINT32) */
u32 uid = 0;
extract__euid(task, &uid);
auxmap__store_u32_param(auxmap, uid);
/* Parameter 27: euid (type: PT_UID) */
u32 euid;
extract__euid(task, &euid);
auxmap__store_u32_param(auxmap, euid);

/*=============================== COLLECT PARAMETERS ===========================*/

Expand Down
4 changes: 4 additions & 0 deletions driver/ppm_events_public.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,10 @@ or GPL2.txt for full copies of the license.

#include "./feature_gates.h"

#ifndef UINT32_MAX
#define UINT32_MAX (4294967295U)
#endif

/*
* Macros for packing in different build environments
*/
Expand Down
Loading