Skip to content

Commit e2f7022

Browse files
terror96terror96
committed
new(driver): update exit events PPME_SYSCALL_SETRESGID_X with enter params
This update is part of the implementation for disabling support for syscall enter events. It implements the following steps: 1. Adds enter parameters to the exit event 2. Adapt sinsp state to work just with exit events. 3. Create a scap-file conversion (in a dedicated scap-file converter) to convert ENTER events into merged EXIT ones. 4. Add some tests replaying scap-files. for the setresgid syscall. Signed-off-by: Tero Kauppinen <tero.kauppinen@est.tech>
1 parent 8ef1d02 commit e2f7022

File tree

18 files changed

+265
-21
lines changed

18 files changed

+265
-21
lines changed

‎driver/bpf/fillers.h‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3170,6 +3170,27 @@ FILLER(sys_setpgid_x, true) {
31703170
return bpf_push_s64_to_ring(data, (int64_t)pgid);
31713171
}
31723172

3173+
FILLER(sys_setresgid_x, true) {
3174+
/* Parameter 1: res (type: PT_ERRNO) */
3175+
long retval = bpf_syscall_get_retval(data->ctx);
3176+
int res = bpf_push_s64_to_ring(data, retval);
3177+
CHECK_RES(res);
3178+
3179+
/* Parameter 2: rgid (type: PT_GID) */
3180+
uint32_t rgid = (uint32_t)bpf_syscall_get_argument(data, 0);
3181+
res = bpf_push_u32_to_ring(data, rgid);
3182+
CHECK_RES(res);
3183+
3184+
/* Parameter 3: egid (type: PT_GID) */
3185+
uint32_t egid = (uint32_t)bpf_syscall_get_argument(data, 1);
3186+
res = bpf_push_u32_to_ring(data, egid);
3187+
CHECK_RES(res);
3188+
3189+
/* Parameter 4: sgid (type: PT_GID) */
3190+
uint32_t sgid = (uint32_t)bpf_syscall_get_argument(data, 2);
3191+
return bpf_push_u32_to_ring(data, sgid);
3192+
}
3193+
31733194
FILLER(sys_unshare_e, true) {
31743195
unsigned long val;
31753196
uint32_t flags;

‎driver/event_table.c‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1193,16 +1193,19 @@ const struct ppm_event_info g_event_info[] = {
11931193
{{"res", PT_ERRNO, PF_DEC}}},
11941194
[PPME_SYSCALL_SETRESGID_E] = {"setresgid",
11951195
EC_USER | EC_SYSCALL,
1196-
EF_MODIFIES_STATE,
1196+
EF_MODIFIES_STATE | EF_TMP_CONVERTER_MANAGED,
11971197
3,
11981198
{{"rgid", PT_GID, PF_DEC},
11991199
{"egid", PT_GID, PF_DEC},
12001200
{"sgid", PT_GID, PF_DEC}}},
12011201
[PPME_SYSCALL_SETRESGID_X] = {"setresgid",
12021202
EC_USER | EC_SYSCALL,
1203-
EF_MODIFIES_STATE,
1204-
1,
1205-
{{"res", PT_ERRNO, PF_DEC}}},
1203+
EF_MODIFIES_STATE | EF_TMP_CONVERTER_MANAGED,
1204+
4,
1205+
{{"res", PT_ERRNO, PF_DEC},
1206+
{"rgid", PT_GID, PF_DEC},
1207+
{"egid", PT_GID, PF_DEC},
1208+
{"sgid", PT_GID, PF_DEC}}},
12061209
[PPME_SCAPEVENT_E] = {"scapevent",
12071210
EC_INTERNAL | EC_METAEVENT,
12081211
EF_SKIPPARSERESET,

‎driver/fillers_table.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -195,7 +195,7 @@ const struct ppm_event_entry g_ppm_events[PPM_EVENT_MAX] = {
195195
[PPME_SYSCALL_SETRESUID_E] = {FILLER_REF(sys_autofill), 3, APT_REG, {{0}, {1}, {2}}},
196196
[PPME_SYSCALL_SETRESUID_X] = {FILLER_REF(sys_autofill), 1, APT_REG, {{AF_ID_RETVAL}}},
197197
[PPME_SYSCALL_SETRESGID_E] = {FILLER_REF(sys_autofill), 3, APT_REG, {{0}, {1}, {2}}},
198-
[PPME_SYSCALL_SETRESGID_X] = {FILLER_REF(sys_autofill), 1, APT_REG, {{AF_ID_RETVAL}}},
198+
[PPME_SYSCALL_SETRESGID_X] = {FILLER_REF(sys_setresgid_x)},
199199
[PPME_SCAPEVENT_E] = {FILLER_REF(sys_scapevent_e)},
200200
[PPME_SYSCALL_SETUID_E] = {FILLER_REF(sys_autofill), 1, APT_REG, {{0}}},
201201
[PPME_SYSCALL_SETUID_X] = {FILLER_REF(sys_setuid_x)},

‎driver/modern_bpf/definitions/events_dimensions.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,7 +129,7 @@
129129
#define SETRESUID_E_SIZE HEADER_LEN + sizeof(uint32_t) * 3 + PARAM_LEN * 3
130130
#define SETRESUID_X_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN
131131
#define SETRESGID_E_SIZE HEADER_LEN + sizeof(uint32_t) * 3 + PARAM_LEN * 3
132-
#define SETRESGID_X_SIZE HEADER_LEN + sizeof(int64_t) + PARAM_LEN
132+
#define SETRESGID_X_SIZE HEADER_LEN + sizeof(int64_t) + sizeof(uint32_t) * 3 + PARAM_LEN * 4
133133
#define SCAPEVENT_E_SIZE HEADER_LEN + sizeof(uint32_t) + sizeof(uint64_t) + PARAM_LEN * 2
134134
#define SCAPEVENT_X_SIZE HEADER_LEN
135135
#define SETUID_E_SIZE HEADER_LEN + sizeof(uint32_t) + PARAM_LEN

‎driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/setresgid.bpf.c‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,15 +22,15 @@ int BPF_PROG(setresgid_e, struct pt_regs *regs, long id) {
2222
/*=============================== COLLECT PARAMETERS ===========================*/
2323

2424
/* Parameter 1: rgid (type: PT_GID) */
25-
gid_t rgid = (uint32_t)extract__syscall_argument(regs, 0);
25+
uint32_t rgid = (uint32_t)extract__syscall_argument(regs, 0);
2626
ringbuf__store_u32(&ringbuf, rgid);
2727

2828
/* Parameter 2: egid (type: PT_GID) */
29-
gid_t egid = (uint32_t)extract__syscall_argument(regs, 1);
29+
uint32_t egid = (uint32_t)extract__syscall_argument(regs, 1);
3030
ringbuf__store_u32(&ringbuf, egid);
3131

3232
/* Parameter 3: sgid (type: PT_GID) */
33-
gid_t sgid = (uint32_t)extract__syscall_argument(regs, 2);
33+
uint32_tq sgid = (uint32_t)extract__syscall_argument(regs, 2);
3434
ringbuf__store_u32(&ringbuf, sgid);
3535

3636
/*=============================== COLLECT PARAMETERS ===========================*/
@@ -58,6 +58,18 @@ int BPF_PROG(setresgid_x, struct pt_regs *regs, long ret) {
5858
/* Parameter 1: res (type: PT_ERRNO)*/
5959
ringbuf__store_s64(&ringbuf, ret);
6060

61+
/* Parameter 2: rgid (type: PT_GID) */
62+
gid_t rgid = (uint32_t)extract__syscall_argument(regs, 0);
63+
ringbuf__store_u32(&ringbuf, rgid);
64+
65+
/* Parameter 3: egid (type: PT_GID) */
66+
gid_t egid = (uint32_t)extract__syscall_argument(regs, 1);
67+
ringbuf__store_u32(&ringbuf, egid);
68+
69+
/* Parameter 4: sgid (type: PT_GID) */
70+
gid_t sgid = (uint32_t)extract__syscall_argument(regs, 2);
71+
ringbuf__store_u32(&ringbuf, sgid);
72+
6173
/*=============================== COLLECT PARAMETERS ===========================*/
6274

6375
ringbuf__submit_event(&ringbuf);

‎driver/ppm_fillers.c‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7449,6 +7449,36 @@ int f_sys_setpgid_x(struct event_filler_arguments *args) {
74497449
return add_sentinel(args);
74507450
}
74517451

7452+
int f_sys_setresgid_x(struct event_filler_arguments *args) {
7453+
unsigned long val = 0;
7454+
int res = 0;
7455+
uint32_t gid = 0;
7456+
7457+
/* Parameter 1: res (type: PT_ERRNO) */
7458+
int64_t retval = (int64_t)syscall_get_return_value(current, args->regs);
7459+
res = val_to_ring(args, retval, 0, false, 0);
7460+
CHECK_RES(res);
7461+
7462+
/* Parameter 2: rgid (type: PT_GID) */
7463+
syscall_get_arguments_deprecated(args, 0, 1, &val);
7464+
gid = (uint32_t)val;
7465+
res = val_to_ring(args, gid, 0, true, 0);
7466+
CHECK_RES(res);
7467+
7468+
/* Parameter 3: egid (type: PT_GID) */
7469+
syscall_get_arguments_deprecated(args, 1, 1, &val);
7470+
gid = (uint32_t)val;
7471+
res = val_to_ring(args, gid, 0, true, 0);
7472+
CHECK_RES(res);
7473+
7474+
/* Parameter 4: sgid (type: PT_GID) */
7475+
syscall_get_arguments_deprecated(args, 2, 1, &val);
7476+
gid = (uint32_t)val;
7477+
res = val_to_ring(args, gid, 0, true, 0);
7478+
7479+
return add_sentinel(args);
7480+
}
7481+
74527482
int f_sys_unshare_e(struct event_filler_arguments *args) {
74537483
unsigned long val;
74547484
int res;

‎driver/ppm_fillers.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -183,6 +183,7 @@ or GPL2.txt for full copies of the license.
183183
FN(sys_setgid_x) \
184184
FN(sys_setpgid_e) \
185185
FN(sys_setpgid_x) \
186+
FN(sys_setresgid_x) \
186187
FN(sys_recvfrom_e) \
187188
FN(sys_recvmsg_e) \
188189
FN(sys_listen_e) \

‎test/drivers/test_suites/syscall_exit_suite/setresgid_x.cpp‎

Lines changed: 10 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,17 @@ TEST(SyscallExit, setresgidX) {
3737
/* Parameter 1: res (type: PT_ERRNO) */
3838
evt_test->assert_numeric_param(1, (int64_t)0);
3939

40+
/* Parameter 2: rgid (type: PT_GID) */
41+
evt_test->assert_numeric_param(2, (uint32_t)rgid);
42+
43+
/* Parameter 3: egid (type: PT_GID) */
44+
evt_test->assert_numeric_param(3, (uint32_t)egid);
45+
46+
/* Parameter 4: sgid (type: PT_GID) */
47+
evt_test->assert_numeric_param(4, (uint32_t)sgid);
48+
4049
/*=============================== ASSERT PARAMETERS ===========================*/
4150

42-
evt_test->assert_num_params_pushed(1);
51+
evt_test->assert_num_params_pushed(4);
4352
}
4453
#endif

‎test/libscap/test_suites/engines/savefile/converter.cpp‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2150,3 +2150,57 @@ TEST_F(convert_event_test, PPME_SYSCALL_SETGID_X_to_3_params_with_enter) {
21502150
create_safe_scap_event(ts, tid, PPME_SYSCALL_SETGID_X, 1, res),
21512151
create_safe_scap_event(ts, tid, PPME_SYSCALL_SETGID_X, 2, res, gid));
21522152
}
2153+
2154+
////////////////////////////
2155+
// SETRESGID
2156+
////////////////////////////
2157+
2158+
TEST_F(convert_event_test, PPME_SYSCALL_SETRESGID_E_store) {
2159+
uint64_t ts = 12;
2160+
int64_t tid = 25;
2161+
2162+
uint32_t rgid = 66;
2163+
uint32_t egid = 77;
2164+
uint32_t sgid = 88;
2165+
2166+
auto evt = create_safe_scap_event(ts, tid, PPME_SYSCALL_SETRESGID_E, 3, rgid, egid, sgid);
2167+
assert_single_conversion_skip(evt);
2168+
assert_event_storage_presence(evt);
2169+
}
2170+
2171+
TEST_F(convert_event_test, PPME_SYSCALL_SETRESGID_X_to_4_params_no_enter) {
2172+
uint64_t ts = 12;
2173+
int64_t tid = 25;
2174+
2175+
int64_t res = 89;
2176+
2177+
// Defaulted to 0
2178+
uint32_t rgid = 0;
2179+
uint32_t egid = 0;
2180+
uint32_t sgid = 0;
2181+
2182+
assert_single_conversion_success(
2183+
conversion_result::CONVERSION_COMPLETED,
2184+
create_safe_scap_event(ts, tid, PPME_SYSCALL_SETRESGID_X, 1, res),
2185+
create_safe_scap_event(ts, tid, PPME_SYSCALL_SETRESGID_X, 4, res, rgid, egid, sgid));
2186+
}
2187+
2188+
TEST_F(convert_event_test, PPME_SYSCALL_SETRESGID_X_to_4_params_with_enter) {
2189+
uint64_t ts = 12;
2190+
int64_t tid = 25;
2191+
2192+
int64_t res = 89;
2193+
uint32_t rgid = 66;
2194+
uint32_t egid = 77;
2195+
uint32_t sgid = 88;
2196+
2197+
// After the first conversion we should have the storage
2198+
auto evt = create_safe_scap_event(ts, tid, PPME_SYSCALL_SETRESGID_E, 3, rgid, egid, sgid);
2199+
assert_single_conversion_skip(evt);
2200+
assert_event_storage_presence(evt);
2201+
2202+
assert_single_conversion_success(
2203+
conversion_result::CONVERSION_COMPLETED,
2204+
create_safe_scap_event(ts, tid, PPME_SYSCALL_SETRESGID_X, 1, res),
2205+
create_safe_scap_event(ts, tid, PPME_SYSCALL_SETRESGID_X, 4, res, rgid, egid, sgid));
2206+
}

‎test/libsinsp_e2e/sys_call_test.cpp‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1438,6 +1438,12 @@ TEST_F(sys_call_test, getsetresuid_and_gid) {
14381438
} else if(type == PPME_SYSCALL_SETRESGID_X && !setresgid_ok) {
14391439
++callnum;
14401440
EXPECT_EQ("0", e->get_param_value_str("res", false));
1441+
EXPECT_EQ("6565", e->get_param_value_str("rgid", false));
1442+
EXPECT_EQ("testsetresgid", e->get_param_value_str("rgid"));
1443+
EXPECT_EQ("-1", e->get_param_value_str("egid", false));
1444+
EXPECT_EQ("<NONE>", e->get_param_value_str("egid"));
1445+
EXPECT_EQ("-1", e->get_param_value_str("sgid", false));
1446+
EXPECT_EQ("<NONE>", e->get_param_value_str("sgid"));
14411447
setresgid_ok = true;
14421448
} else if(type == PPME_SYSCALL_GETRESUID_E && !getresuid_e_ok) {
14431449
++callnum;

0 commit comments

Comments
 (0)