-
Notifications
You must be signed in to change notification settings - Fork 5
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Added ptrace eBPF * WIP: Modified struct * WIP: Added events * added tracer * WIP: Added ptrace to container watcher * WIP: Rules * WIP: Added to rule manager * WIP: Added ptrace rule * Added rule & tests * Added pool * Removed prints * Added ptrace to new infrastructure * WIP: Fixed CR * WIP: added component test * WIP: Remove component test * WIP: Updated struct
- Loading branch information
Showing
17 changed files
with
825 additions
and
24 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| package containerwatcher | ||
|
|
||
| import ( | ||
| "fmt" | ||
|
|
||
| "github.com/inspektor-gadget/inspektor-gadget/pkg/types" | ||
| tracerptrace "github.com/kubescape/node-agent/pkg/ebpf/gadgets/ptrace/tracer" | ||
| tracerptracetype "github.com/kubescape/node-agent/pkg/ebpf/gadgets/ptrace/tracer/types" | ||
| ) | ||
|
|
||
| func (ch *IGContainerWatcher) ptraceEventCallback(event *tracerptracetype.Event) { | ||
| if event.Type != types.NORMAL { | ||
| return | ||
| } | ||
|
|
||
| ch.ptraceWorkerChan <- event | ||
|
|
||
| } | ||
|
|
||
| func (ch *IGContainerWatcher) startPtraceTracing() error { | ||
| if err := ch.tracerCollection.AddTracer(ptraceTraceName, ch.containerSelector); err != nil { | ||
| return fmt.Errorf("adding tracer: %w", err) | ||
| } | ||
|
|
||
| // Get mount namespace map to filter by containers | ||
| ptraceMountnsmap, err := ch.tracerCollection.TracerMountNsMap(ptraceTraceName) | ||
| if err != nil { | ||
| return fmt.Errorf("getting ptraceMountnsmap: %w", err) | ||
| } | ||
|
|
||
| tracerPtrace, err := tracerptrace.NewTracer(&tracerptrace.Config{MountnsMap: ptraceMountnsmap}, ch.containerCollection, ch.ptraceEventCallback) | ||
| if err != nil { | ||
| return fmt.Errorf("creating tracer: %w", err) | ||
| } | ||
| go func() { | ||
| for event := range ch.ptraceWorkerChan { | ||
| _ = ch.ptraceWorkerPool.Invoke(*event) | ||
| } | ||
| }() | ||
|
|
||
| ch.ptraceTracer = tracerPtrace | ||
|
|
||
| return nil | ||
| } | ||
|
|
||
| func (ch *IGContainerWatcher) stopPtraceTracing() error { | ||
| if err := ch.tracerCollection.RemoveTracer(ptraceTraceName); err != nil { | ||
| return fmt.Errorf("removing tracer: %w", err) | ||
| } | ||
| ch.ptraceTracer.Close() | ||
| return nil | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| #include "ptrace_detector.h" | ||
|
|
||
| struct { | ||
| __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); | ||
| __uint(key_size, sizeof(u32)); | ||
| __uint(value_size, sizeof(u32)); | ||
| } events SEC(".maps"); | ||
|
|
||
| struct { | ||
| __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); | ||
| __uint(max_entries, 1); | ||
| __type(key, u32); | ||
| __type(value, struct event); | ||
| } empty_event SEC(".maps"); | ||
|
|
||
|
|
||
| static __always_inline int should_discard() | ||
| { | ||
| u64 mntns_id; | ||
| mntns_id = gadget_get_mntns_id(); | ||
|
|
||
| if (gadget_should_discard_mntns_id(mntns_id)) | ||
| { | ||
| return 1; | ||
| } | ||
|
|
||
| return 0; | ||
| } | ||
|
|
||
| static __always_inline char * get_exe_path(struct task_struct* current_task ) { | ||
| struct file *exe_file = BPF_CORE_READ(current_task, mm, exe_file); | ||
| char *exepath; | ||
| exepath = get_path_str(&exe_file->f_path); | ||
| return exepath; | ||
| } | ||
|
|
||
|
|
||
| static __always_inline void populate_event(struct event* event) { | ||
| u64 mntns_id = gadget_get_mntns_id(); | ||
| u64 pid_tgid = bpf_get_current_pid_tgid(); | ||
| event->pid = pid_tgid >> 32; | ||
|
|
||
| u64 uid_gid = bpf_get_current_uid_gid(); | ||
| event->uid = uid_gid & 0xFFFFFFFF; | ||
| event->gid = uid_gid >> 32; | ||
| event->timestamp = bpf_ktime_get_boot_ns(); | ||
| event->mntns_id = mntns_id; | ||
| bpf_get_current_comm(&event->comm, sizeof(event->comm)); | ||
| } | ||
|
|
||
| SEC("tracepoint/syscalls/sys_enter_ptrace") | ||
| int trace_enter_ptrace(struct trace_event_raw_sys_enter *ctx) | ||
| { | ||
| long request = (long)ctx->args[0]; | ||
| long pid = (long)ctx->args[1]; | ||
|
|
||
| if (should_discard()) { | ||
| return 0; | ||
| } | ||
|
|
||
| struct event *event; | ||
| u32 zero = 0; | ||
| event = bpf_map_lookup_elem(&empty_event, &zero); | ||
| if (!event) { | ||
| return 0; | ||
| } | ||
|
|
||
| struct task_struct *current_task = (struct task_struct*)bpf_get_current_task(); | ||
| if (!current_task) { | ||
| return 0; | ||
| } | ||
|
|
||
| if (request == PTRACE_SETREGS || request == PTRACE_POKETEXT || request == PTRACE_POKEDATA) { | ||
| char* exepath = get_exe_path(current_task); | ||
| bpf_probe_read_kernel_str(event->exepath, MAX_STRING_SIZE, exepath); | ||
| event->ppid = BPF_CORE_READ(current_task, real_parent, pid); | ||
| event->request = request; | ||
| populate_event(event); | ||
| bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, event, sizeof(struct event)); | ||
| } | ||
| return 0; | ||
| } | ||
|
|
||
| char _license[] SEC("license") = "GPL"; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,37 @@ | ||
| #include "../../../../include/amd64/vmlinux.h" | ||
| #include "../../../../include/types.h" | ||
| #include <bpf/bpf_helpers.h> | ||
| #include <bpf/bpf_core_read.h> | ||
|
|
||
| #include "../../../../include/mntns_filter.h" | ||
| #include "../../../../include/filesystem.h" | ||
| #include "../../../../include/macros.h" | ||
| #include "../../../../include/buffer.h" | ||
|
|
||
| #define TASK_COMM_LEN 16 | ||
| #define MAX_STRING_SIZE 4096 | ||
|
|
||
| #ifndef PTRACE_SETREGS | ||
| #define PTRACE_SETREGS 13 | ||
| #endif | ||
|
|
||
| #ifndef PTRACE_POKETEXT | ||
| #define PTRACE_POKETEXT 4 | ||
| #endif | ||
|
|
||
| #ifndef PTRACE_POKEDATA | ||
| #define PTRACE_POKEDATA 5 | ||
| #endif | ||
|
|
||
|
|
||
| struct event { | ||
| gadget_timestamp timestamp; | ||
| gadget_mntns_id mntns_id; | ||
| __u32 pid; | ||
| __u32 ppid; | ||
| __u32 uid; | ||
| __u32 gid; | ||
| __u32 request; | ||
| __u8 comm[TASK_COMM_LEN]; | ||
| __u8 exepath[MAX_STRING_SIZE]; | ||
| }; |
Oops, something went wrong.