Skip to content

feat: make PPME_SYSCALL_EXECVE_19_X "scap converter"-managed #2544

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
poiana merged 1 commit into from
Jul 16, 2025
Merged

feat: make PPME_SYSCALL_EXECVE_19_X "scap converter"-managed #2544

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 24 additions & 59 deletions driver/bpf/fillers.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2599,7 +2599,6 @@ FILLER(proc_startupdate, true) {
unsigned long fdlimit;
struct mm_struct *mm;
long total_rss;
char empty = 0;
volatile long args_len;
long retval;
pid_t tgid;
Expand All @@ -2610,6 +2609,7 @@ FILLER(proc_startupdate, true) {
/*
* Make sure the operation was successful
*/
/* Parameter 1: res (type: PT_ERRNO) */
retval = bpf_syscall_get_retval(data->ctx);
res = bpf_push_s64_to_ring(data, retval);
CHECK_RES(res);
Expand Down Expand Up @@ -2690,9 +2690,7 @@ FILLER(proc_startupdate, true) {
return PPM_FAILURE_INVALID_USER_MEMORY;
}

/*
* exe
*/
/* Parameter 2: exe (type: PT_CHARBUF) */
if(exe_len == 0) {
res = bpf_push_empty_param(data);
} else {
Expand All @@ -2703,9 +2701,7 @@ FILLER(proc_startupdate, true) {

args_len -= exe_len;

/*
* Args
*/
/* Parameter 3: args (type: PT_CHARBUFARRAY) */
if(args_len <= 0) {
res = bpf_push_empty_param(data);
CHECK_RES(res);
Expand All @@ -2715,56 +2711,43 @@ FILLER(proc_startupdate, true) {
CHECK_RES(res);
}

/*
* tid
*/
/* Parameter 4: tid (type: PT_PID) */
/* this is called `tid` but it is the `pid`. */
pid = _READ(task->pid);
res = bpf_push_s64_to_ring(data, pid);
CHECK_RES(res);

/*
* pid
*/
/* Parameter 5: pid (type: PT_PID) */
/* this is called `pid` but it is the `tgid`. */
tgid = _READ(task->tgid);
res = bpf_push_s64_to_ring(data, tgid);
CHECK_RES(res);

/*
* ptid
*/
/* Parameter 6: ptid (type: PT_PID) */
/* this is called `ptid` but it is the `pgid`. */
real_parent = _READ(task->real_parent);
pid_t ptid = _READ(real_parent->pid);

res = bpf_push_s64_to_ring(data, ptid);
CHECK_RES(res);

/*
* cwd, pushed empty to avoid breaking compatibility
* with the older event format
*/
/* Parameter 7: cwd (type: PT_CHARBUF) */
/* Push empty to avoid breaking compatibility with the older event format. */
res = bpf_push_empty_param(data);
CHECK_RES(res);

/*
* fdlimit
*/
/* Parameter 8: fdlimit (type: PT_UINT64) */
signal = _READ(task->signal);
fdlimit = _READ(signal->rlim[RLIMIT_NOFILE].rlim_cur);

res = bpf_push_u64_to_ring(data, fdlimit);
CHECK_RES(res);

/*
* pgft_maj
*/
/* Parameter 9: pgft_maj (type: PT_UINT64) */
maj_flt = _READ(task->maj_flt);

res = bpf_push_u64_to_ring(data, maj_flt);
CHECK_RES(res);

/*
* pgft_min
*/
/* Parameter 10: pgft_min (type: PT_UINT64) */
min_flt = _READ(task->min_flt);

res = bpf_push_u64_to_ring(data, min_flt);
Expand All @@ -2781,27 +2764,19 @@ FILLER(proc_startupdate, true) {
swap = bpf_get_mm_swap(mm) << (PAGE_SHIFT - 10);
}

/*
* vm_size
*/
/* Parameter 11: vm_size (type: PT_UINT32) */
res = bpf_push_u32_to_ring(data, total_vm);
CHECK_RES(res);

/*
* vm_rss
*/
/* Parameter 12: vm_rss (type: PT_UINT32) */
res = bpf_push_u32_to_ring(data, total_rss);
CHECK_RES(res);

/*
* vm_swap
*/
/* Parameter 13: vm_swap (type: PT_UINT32) */
res = bpf_push_u32_to_ring(data, swap);
CHECK_RES(res);

/*
* comm
*/
/* Parameter 14: comm (type: PT_CHARBUF) */
res = bpf_val_to_ring_type_mem(data, (unsigned long)task->comm, PT_CHARBUF, KERNEL);
CHECK_RES(res);

Expand All @@ -2817,9 +2792,7 @@ FILLER(proc_startupdate_2, true) {

task = (struct task_struct *)bpf_get_current_task();

/*
* cgroups
*/
/* Parameter 15: cgroups (type: PT_CHARBUFARRAY) */
res = bpf_append_cgroup(task, data->tmp_scratch, &cgroups_len);
CHECK_RES(res);

Expand Down Expand Up @@ -2976,9 +2949,7 @@ FILLER(proc_startupdate_3, true) {
uint32_t tty;
struct file *exe_file;

/*
* environ
*/
/* Parameter 16: env (type: PT_CHARBUFARRAY) */
if(retval >= 0) {
/*
* Already checked for mm validity
Expand Down Expand Up @@ -3034,23 +3005,17 @@ FILLER(proc_startupdate_3, true) {
res = __bpf_val_to_ring(data, 0, env_len, PT_BYTEBUF, -1, false, KERNEL);
CHECK_RES(res);

/*
* tty
*/
/* Parameter 17: tty (type: PT_INT32) */
tty = bpf_ppm_get_tty(task);

res = bpf_push_u32_to_ring(data, tty);
CHECK_RES(res);

/*
* pgid
*/
/* Parameter 18: vpgid (type: PT_PID) */
res = bpf_push_s64_to_ring(data, bpf_task_pgrp_vnr(task));
CHECK_RES(res);

/*
* loginuid
*/
/* Parameter 19: loginuid (type: PT_UID) */
/* TODO: implement user namespace support */
#if(LINUX_VERSION_CODE >= KERNEL_VERSION(5, 1, 0) && CONFIG_AUDIT) || \
(LINUX_VERSION_CODE < KERNEL_VERSION(5, 1, 0) && CONFIG_AUDITSYSCALL)
Expand Down Expand Up @@ -7941,7 +7906,7 @@ FILLER(sched_prog_exec_3, false) {
res = bpf_push_u32_to_ring(data, tty);
CHECK_RES(res);

/* Parameter 18: pgid (type: PT_PID) */
/* Parameter 18: vpgid (type: PT_PID) */
res = bpf_push_s64_to_ring(data, bpf_task_pgrp_vnr(task));
CHECK_RES(res);

Expand Down
2 changes: 1 addition & 1 deletion driver/event_table.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1912,7 +1912,7 @@ const struct ppm_event_info g_event_info[] = {
{{"filename", PT_FSPATH, PF_NA}}},
[PPME_SYSCALL_EXECVE_19_X] = {"execve",
EC_PROCESS | EC_SYSCALL,
EF_MODIFIES_STATE,
EF_MODIFIES_STATE | EF_TMP_CONVERTER_MANAGED,
30,
{{"res", PT_ERRNO, PF_DEC},
{"exe", PT_CHARBUF, PF_NA},
Expand Down
6 changes: 3 additions & 3 deletions driver/modern_bpf/programs/attached/events/sched_process_exec.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,9 +179,9 @@ int BPF_PROG(t1_sched_p_exec, struct task_struct *p, pid_t old_pid, struct linux
uint32_t tty = exctract__tty(task);
auxmap__store_u32_param(auxmap, (uint32_t)tty);

/* Parameter 18: pgid (type: PT_PID) */
pid_t pgid = extract__task_xid_vnr(task, PIDTYPE_PGID);
auxmap__store_s64_param(auxmap, (int64_t)pgid);
/* Parameter 18: vpgid (type: PT_PID) */
pid_t vpgid = extract__task_xid_vnr(task, PIDTYPE_PGID);
auxmap__store_s64_param(auxmap, (int64_t)vpgid);

/* Parameter 19: loginuid (type: PT_UID) */
uint32_t loginuid;
Expand Down
6 changes: 3 additions & 3 deletions driver/modern_bpf/programs/tail_called/events/syscall_dispatched_events/execve.bpf.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -198,9 +198,9 @@ int BPF_PROG(t1_execve_x, struct pt_regs *regs, long ret) {
uint32_t tty = exctract__tty(task);
auxmap__store_u32_param(auxmap, (uint32_t)tty);

/* Parameter 18: pgid (type: PT_PID) */
pid_t pgid = extract__task_xid_vnr(task, PIDTYPE_PGID);
auxmap__store_s64_param(auxmap, (int64_t)pgid);
/* Parameter 18: vpgid (type: PT_PID) */
pid_t vpgid = extract__task_xid_vnr(task, PIDTYPE_PGID);
auxmap__store_s64_param(auxmap, (int64_t)vpgid);

/* Parameter 19: loginuid (type: PT_UID) */
uint32_t loginuid;
Expand Down
Loading
Loading