Skip to content

Commit 768f27a

Browse files
oshaked1oshaked1
committed
Add security_task_prctl event
1 parent 1150c94 commit 768f27a

File tree

8 files changed

+328
-9
lines changed

8 files changed

+328
-9
lines changed

‎pkg/ebpf/c/tracee.bpf.c‎

Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5300,6 +5300,225 @@ int BPF_KPROBE(trace_chmod_common)
53005300
return events_perf_submit(&p, 0);
53015301
}
53025302

5303+
SEC("kprobe/security_task_prctl")
5304+
int BPF_KPROBE(trace_security_task_prctl)
5305+
{
5306+
program_data_t p = {};
5307+
if (!init_program_data(&p, ctx, SECURITY_TASK_PRCTL))
5308+
return 0;
5309+
5310+
if (!evaluate_scope_filters(&p))
5311+
return 0;
5312+
5313+
// Save raw args
5314+
int option = PT_REGS_PARM1(ctx);
5315+
unsigned long arg2 = PT_REGS_PARM2(ctx);
5316+
unsigned long arg3 = PT_REGS_PARM3(ctx);
5317+
unsigned long arg4 = PT_REGS_PARM4(ctx);
5318+
unsigned long arg5 = PT_REGS_PARM5(ctx);
5319+
save_to_submit_buf(&p.event->args_buf, &option, sizeof(option), 0);
5320+
save_to_submit_buf(&p.event->args_buf, &arg2, sizeof(arg2), 1);
5321+
save_to_submit_buf(&p.event->args_buf, &arg3, sizeof(arg3), 2);
5322+
save_to_submit_buf(&p.event->args_buf, &arg4, sizeof(arg4), 3);
5323+
save_to_submit_buf(&p.event->args_buf, &arg5, sizeof(arg5), 4);
5324+
5325+
// Save PR_SET_VMA arg
5326+
if (option == PR_SET_VMA)
5327+
save_str_to_buf(&p.event->args_buf, (char *) arg5, 5);
5328+
5329+
// Save PR_SET_MM args
5330+
if (option == PR_SET_MM) {
5331+
// Save all old mm info regardless of operation
5332+
struct mm_struct *mm = get_mm_from_task(p.event->task);
5333+
save_to_submit_buf(&p.event->args_buf,
5334+
__builtin_preserve_access_index(&mm->start_code),
5335+
sizeof(mm->start_code),
5336+
6);
5337+
save_to_submit_buf(&p.event->args_buf,
5338+
__builtin_preserve_access_index(&mm->end_code),
5339+
sizeof(mm->end_code),
5340+
7);
5341+
save_to_submit_buf(&p.event->args_buf,
5342+
__builtin_preserve_access_index(&mm->start_data),
5343+
sizeof(mm->start_data),
5344+
8);
5345+
save_to_submit_buf(&p.event->args_buf,
5346+
__builtin_preserve_access_index(&mm->end_data),
5347+
sizeof(mm->end_data),
5348+
9);
5349+
save_to_submit_buf(&p.event->args_buf,
5350+
__builtin_preserve_access_index(&mm->start_brk),
5351+
sizeof(mm->start_brk),
5352+
10);
5353+
save_to_submit_buf(
5354+
&p.event->args_buf, __builtin_preserve_access_index(&mm->brk), sizeof(mm->brk), 11);
5355+
save_to_submit_buf(&p.event->args_buf,
5356+
__builtin_preserve_access_index(&mm->start_stack),
5357+
sizeof(mm->start_stack),
5358+
12);
5359+
save_to_submit_buf(&p.event->args_buf,
5360+
__builtin_preserve_access_index(&mm->arg_start),
5361+
sizeof(mm->arg_start),
5362+
13);
5363+
save_to_submit_buf(&p.event->args_buf,
5364+
__builtin_preserve_access_index(&mm->arg_end),
5365+
sizeof(mm->arg_end),
5366+
14);
5367+
save_to_submit_buf(&p.event->args_buf,
5368+
__builtin_preserve_access_index(&mm->env_start),
5369+
sizeof(mm->env_start),
5370+
15);
5371+
save_to_submit_buf(&p.event->args_buf,
5372+
__builtin_preserve_access_index(&mm->env_end),
5373+
sizeof(mm->env_end),
5374+
16);
5375+
save_bytes_to_buf(&p.event->args_buf,
5376+
__builtin_preserve_access_index(&mm->saved_auxv),
5377+
bpf_core_field_size(mm->saved_auxv),
5378+
17);
5379+
5380+
struct file *exe = BPF_CORE_READ(mm, exe_file);
5381+
void *exe_path = get_path_str(__builtin_preserve_access_index(&exe->f_path));
5382+
dev_t exe_dev = get_dev_from_file(exe);
5383+
unsigned long exe_inode = get_inode_nr_from_file(exe);
5384+
u64 exe_ctime = get_ctime_nanosec_from_file(exe);
5385+
umode_t exe_inode_mode = get_inode_mode_from_file(exe);
5386+
5387+
save_str_to_buf(&p.event->args_buf, exe_path, 18);
5388+
save_to_submit_buf(&p.event->args_buf, &exe_dev, sizeof(exe_dev), 19);
5389+
save_to_submit_buf(&p.event->args_buf, &exe_inode, sizeof(exe_inode), 20);
5390+
save_to_submit_buf(&p.event->args_buf, &exe_ctime, sizeof(exe_ctime), 21);
5391+
save_to_submit_buf(&p.event->args_buf, &exe_inode_mode, sizeof(exe_inode_mode), 22);
5392+
5393+
struct prctl_mm_map *mm_map;
5394+
5395+
// Save new mm info according to operation
5396+
switch (arg2) {
5397+
case PR_SET_MM_START_CODE:
5398+
save_to_submit_buf(&p.event->args_buf, &arg3, sizeof(arg3), 23);
5399+
break;
5400+
case PR_SET_MM_END_CODE:
5401+
save_to_submit_buf(&p.event->args_buf, &arg3, sizeof(arg3), 24);
5402+
break;
5403+
case PR_SET_MM_START_DATA:
5404+
save_to_submit_buf(&p.event->args_buf, &arg3, sizeof(arg3), 25);
5405+
break;
5406+
case PR_SET_MM_END_DATA:
5407+
save_to_submit_buf(&p.event->args_buf, &arg3, sizeof(arg3), 26);
5408+
break;
5409+
case PR_SET_MM_START_BRK:
5410+
save_to_submit_buf(&p.event->args_buf, &arg3, sizeof(arg3), 27);
5411+
break;
5412+
case PR_SET_MM_BRK:
5413+
save_to_submit_buf(&p.event->args_buf, &arg3, sizeof(arg3), 28);
5414+
break;
5415+
case PR_SET_MM_START_STACK:
5416+
save_to_submit_buf(&p.event->args_buf, &arg3, sizeof(arg3), 29);
5417+
break;
5418+
case PR_SET_MM_ARG_START:
5419+
save_to_submit_buf(&p.event->args_buf, &arg3, sizeof(arg3), 30);
5420+
break;
5421+
case PR_SET_MM_ARG_END:
5422+
save_to_submit_buf(&p.event->args_buf, &arg3, sizeof(arg3), 31);
5423+
break;
5424+
case PR_SET_MM_ENV_START:
5425+
save_to_submit_buf(&p.event->args_buf, &arg3, sizeof(arg3), 32);
5426+
break;
5427+
case PR_SET_MM_ENV_END:
5428+
save_to_submit_buf(&p.event->args_buf, &arg3, sizeof(arg3), 33);
5429+
break;
5430+
case PR_SET_MM_AUXV:
5431+
save_bytes_to_buf(&p.event->args_buf, (void *) arg3, arg4, 34);
5432+
break;
5433+
case PR_SET_MM_EXE_FILE:
5434+
exe = get_struct_file_from_fd(arg3);
5435+
exe_path = get_path_str(__builtin_preserve_access_index(&exe->f_path));
5436+
exe_dev = get_dev_from_file(exe);
5437+
exe_inode = get_inode_nr_from_file(exe);
5438+
exe_ctime = get_ctime_nanosec_from_file(exe);
5439+
exe_inode_mode = get_inode_mode_from_file(exe);
5440+
5441+
save_str_to_buf(&p.event->args_buf, exe_path, 35);
5442+
save_to_submit_buf(&p.event->args_buf, &exe_dev, sizeof(exe_dev), 36);
5443+
save_to_submit_buf(&p.event->args_buf, &exe_inode, sizeof(exe_inode), 37);
5444+
save_to_submit_buf(&p.event->args_buf, &exe_ctime, sizeof(exe_ctime), 38);
5445+
save_to_submit_buf(&p.event->args_buf, &exe_inode_mode, sizeof(exe_inode_mode), 39);
5446+
5447+
break;
5448+
case PR_SET_MM_MAP:
5449+
mm_map = (struct prctl_mm_map *) arg3;
5450+
save_to_submit_buf(&p.event->args_buf,
5451+
__builtin_preserve_access_index(&mm_map->start_code),
5452+
sizeof(mm_map->start_code),
5453+
23);
5454+
save_to_submit_buf(&p.event->args_buf,
5455+
__builtin_preserve_access_index(&mm_map->end_code),
5456+
sizeof(mm_map->end_code),
5457+
24);
5458+
save_to_submit_buf(&p.event->args_buf,
5459+
__builtin_preserve_access_index(&mm_map->start_data),
5460+
sizeof(mm_map->start_data),
5461+
25);
5462+
save_to_submit_buf(&p.event->args_buf,
5463+
__builtin_preserve_access_index(&mm_map->end_data),
5464+
sizeof(mm_map->end_data),
5465+
26);
5466+
save_to_submit_buf(&p.event->args_buf,
5467+
__builtin_preserve_access_index(&mm_map->start_brk),
5468+
sizeof(mm_map->start_brk),
5469+
27);
5470+
save_to_submit_buf(&p.event->args_buf,
5471+
__builtin_preserve_access_index(&mm_map->brk),
5472+
sizeof(mm_map->brk),
5473+
28);
5474+
save_to_submit_buf(&p.event->args_buf,
5475+
__builtin_preserve_access_index(&mm_map->start_stack),
5476+
sizeof(mm_map->start_stack),
5477+
29);
5478+
save_to_submit_buf(&p.event->args_buf,
5479+
__builtin_preserve_access_index(&mm_map->arg_start),
5480+
sizeof(mm_map->arg_start),
5481+
30);
5482+
save_to_submit_buf(&p.event->args_buf,
5483+
__builtin_preserve_access_index(&mm_map->arg_end),
5484+
sizeof(mm_map->arg_end),
5485+
31);
5486+
save_to_submit_buf(&p.event->args_buf,
5487+
__builtin_preserve_access_index(&mm_map->env_start),
5488+
sizeof(mm_map->env_start),
5489+
32);
5490+
save_to_submit_buf(&p.event->args_buf,
5491+
__builtin_preserve_access_index(&mm_map->env_end),
5492+
sizeof(mm_map->env_end),
5493+
33);
5494+
save_bytes_to_buf(&p.event->args_buf,
5495+
BPF_CORE_READ_USER(mm_map, auxv),
5496+
BPF_CORE_READ_USER(mm_map, auxv_size),
5497+
34);
5498+
5499+
exe = get_struct_file_from_fd(BPF_CORE_READ_USER(mm_map, exe_fd));
5500+
exe_path = get_path_str(__builtin_preserve_access_index(&exe->f_path));
5501+
exe_dev = get_dev_from_file(exe);
5502+
exe_inode = get_inode_nr_from_file(exe);
5503+
exe_ctime = get_ctime_nanosec_from_file(exe);
5504+
exe_inode_mode = get_inode_mode_from_file(exe);
5505+
5506+
save_str_to_buf(&p.event->args_buf, exe_path, 35);
5507+
save_to_submit_buf(&p.event->args_buf, &exe_dev, sizeof(exe_dev), 36);
5508+
save_to_submit_buf(&p.event->args_buf, &exe_inode, sizeof(exe_inode), 37);
5509+
save_to_submit_buf(&p.event->args_buf, &exe_ctime, sizeof(exe_ctime), 38);
5510+
save_to_submit_buf(&p.event->args_buf, &exe_inode_mode, sizeof(exe_inode_mode), 39);
5511+
5512+
break;
5513+
default:
5514+
// unknown/invalid operation
5515+
return 0;
5516+
}
5517+
}
5518+
5519+
return events_perf_submit(&p, 0);
5520+
}
5521+
53035522
//
53045523
// Syscall checkers
53055524
//

‎pkg/ebpf/c/types.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -134,6 +134,7 @@ enum event_id_e
134134
SECURITY_TASK_SETRLIMIT,
135135
SECURITY_SETTIME64,
136136
CHMOD_COMMON,
137+
SECURITY_TASK_PRCTL,
137138
MAX_EVENT_ID,
138139
NO_EVENT_SUBMIT,
139140

‎pkg/ebpf/c/vmlinux.h‎

Lines changed: 31 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -699,17 +699,40 @@ struct rb_root {
699699
struct mm_struct {
700700
struct {
701701
struct rb_root mm_rb;
702-
long unsigned int stack_vm;
703-
long unsigned int start_brk;
704-
long unsigned int brk;
705-
long unsigned int start_stack;
706-
long unsigned int arg_start;
707-
long unsigned int arg_end;
708-
long unsigned int env_start;
709-
long unsigned int env_end;
702+
unsigned long stack_vm;
703+
unsigned long start_code;
704+
unsigned long end_code;
705+
unsigned long start_data;
706+
unsigned long end_data;
707+
unsigned long start_brk;
708+
unsigned long brk;
709+
unsigned long start_stack;
710+
unsigned long arg_start;
711+
unsigned long arg_end;
712+
unsigned long env_start;
713+
unsigned long env_end;
714+
unsigned long saved_auxv[0]; // length can be obtained at runtime using bpf_core_file_size()
715+
struct file *exe_file;
710716
};
711717
};
712718

719+
struct prctl_mm_map {
720+
__u64 start_code;
721+
__u64 end_code;
722+
__u64 start_data;
723+
__u64 end_data;
724+
__u64 start_brk;
725+
__u64 brk;
726+
__u64 start_stack;
727+
__u64 arg_start;
728+
__u64 arg_end;
729+
__u64 env_start;
730+
__u64 env_end;
731+
__u64 *auxv;
732+
__u32 auxv_size;
733+
__u32 exe_fd;
734+
};
735+
713736
struct vfsmount {
714737
struct dentry *mnt_root;
715738
};

‎pkg/ebpf/c/vmlinux_missing.h‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -266,4 +266,22 @@ static inline struct inet_sock *inet_sk(const struct sock *sk)
266266
#define IPPROTO_DSTOPTS 60 // IPv6 destination options
267267
#define IPPROTO_MH 135 // IPv6 mobility header
268268

269+
#define PR_SET_VMA 0x53564d41
270+
#define PR_SET_MM 35
271+
#define PR_SET_MM_START_CODE 1
272+
#define PR_SET_MM_END_CODE 2
273+
#define PR_SET_MM_START_DATA 3
274+
#define PR_SET_MM_END_DATA 4
275+
#define PR_SET_MM_START_STACK 5
276+
#define PR_SET_MM_START_BRK 6
277+
#define PR_SET_MM_BRK 7
278+
#define PR_SET_MM_ARG_START 8
279+
#define PR_SET_MM_ARG_END 9
280+
#define PR_SET_MM_ENV_START 10
281+
#define PR_SET_MM_ENV_END 11
282+
#define PR_SET_MM_AUXV 12
283+
#define PR_SET_MM_EXE_FILE 13
284+
#define PR_SET_MM_MAP 14
285+
#define PR_SET_MM_MAP_SIZE 15
286+
269287
#endif

‎pkg/ebpf/probes/probe_group.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,7 @@ func NewDefaultProbeGroup(module *bpf.Module, netEnabled bool) (*ProbeGroup, err
257257
Dup3: NewTraceProbe(SyscallEnter, "dup3", "trace_dup3"),
258258
Dup3Ret: NewTraceProbe(SyscallExit, "dup3", "trace_ret_dup3"),
259259
ChmodCommon: NewTraceProbe(KProbe, "chmod_common", "trace_chmod_common"),
260+
SecurityTaskPrctl: NewTraceProbe(KProbe, "security_task_prctl", "trace_security_task_prctl"),
260261

261262
TestUnavailableHook: NewTraceProbe(KProbe, "non_existing_func", "empty_kprobe"),
262263
ExecTest: NewTraceProbe(RawTracepoint, "raw_syscalls:sched_process_exec", "tracepoint__exec_test"),

‎pkg/ebpf/probes/probes.go‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,7 @@ const (
162162
Dup3
163163
Dup3Ret
164164
ChmodCommon
165+
SecurityTaskPrctl
165166
)
166167

167168
// Test probe handles

‎pkg/events/core.go‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,6 +116,7 @@ const (
116116
SecurityTaskSetrlimit
117117
SecuritySettime64
118118
ChmodCommon
119+
SecurityTaskPrctl
119120
MaxCommonID
120121
)
121122

@@ -13104,6 +13105,61 @@ var CoreEvents = map[ID]Definition{
1310413105
{Type: "unsigned long", Name: "vma_flags"},
1310513106
},
1310613107
},
13108+
SecurityTaskPrctl: {
13109+
id: SecurityTaskPrctl,
13110+
id32Bit: Sys32Undefined,
13111+
name: "security_task_prctl",
13112+
dependencies: Dependencies{
13113+
probes: []Probe{
13114+
{handle: probes.SecurityTaskPrctl, required: true},
13115+
},
13116+
},
13117+
sets: []string{"lsm", "proc"},
13118+
fields: []trace.ArgMeta{
13119+
{Type: "int", Name: "option"},
13120+
{Type: "unsigned long", Name: "arg2"},
13121+
{Type: "unsigned long", Name: "arg3"},
13122+
{Type: "unsigned long", Name: "arg4"},
13123+
{Type: "unsigned long", Name: "arg5"},
13124+
// for PR_SET_VMA
13125+
{Type: "char*", Name: "vma_name"},
13126+
// the following fields are for PR_SET_MM
13127+
{Type: "void*", Name: "old_start_code"},
13128+
{Type: "void*", Name: "old_end_code"},
13129+
{Type: "void*", Name: "old_start_data"},
13130+
{Type: "void*", Name: "old_end_data"},
13131+
{Type: "void*", Name: "old_start_brk"},
13132+
{Type: "void*", Name: "old_brk"},
13133+
{Type: "void*", Name: "old_start_stack"},
13134+
{Type: "void*", Name: "old_arg_start"},
13135+
{Type: "void*", Name: "old_arg_end"},
13136+
{Type: "void*", Name: "old_env_start"},
13137+
{Type: "void*", Name: "old_env_end"},
13138+
{Type: "bytes", Name: "old_auxv"},
13139+
{Type: "const char*", Name: "old_pathname"},
13140+
{Type: "dev_t", Name: "old_dev"},
13141+
{Type: "unsigned long", Name: "old_inode"},
13142+
{Type: "unsigned long", Name: "old_ctime"},
13143+
{Type: "umode_t", Name: "old_inode_mode"},
13144+
{Type: "void*", Name: "new_start_code"},
13145+
{Type: "void*", Name: "new_end_code"},
13146+
{Type: "void*", Name: "new_start_data"},
13147+
{Type: "void*", Name: "new_end_data"},
13148+
{Type: "void*", Name: "new_start_brk"},
13149+
{Type: "void*", Name: "new_brk"},
13150+
{Type: "void*", Name: "new_start_stack"},
13151+
{Type: "void*", Name: "new_arg_start"},
13152+
{Type: "void*", Name: "new_arg_end"},
13153+
{Type: "void*", Name: "new_env_start"},
13154+
{Type: "void*", Name: "new_env_end"},
13155+
{Type: "bytes", Name: "new_auxv"},
13156+
{Type: "const char*", Name: "new_pathname"},
13157+
{Type: "dev_t", Name: "new_dev"},
13158+
{Type: "unsigned long", Name: "new_inode"},
13159+
{Type: "unsigned long", Name: "new_ctime"},
13160+
{Type: "umode_t", Name: "new_inode_mode"},
13161+
},
13162+
},
1310713163
//
1310813164
// Begin of Signal Events (Control Plane)
1310913165
//

0 commit comments

Comments
 (0)