tetragon: store caps during fork #2275
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This moves the definition of MsgGenericCred from tracinapi to processapi. No logic change here. This is preparation for next patches where we will use the MsgGenericCred to send execve and clone event from bpf. Then at the end we will remove the MsgGenericCredMinimal that was used a temporary solution to improve things, and make Tetragon send full creds during execve and clone. Signed-off-by: Djalal Harouni <[email protected]>
tixxdz
added
the
release-note/minor
This change moves the bpf execve event from using msg_cred_minimal to use the msg_cred to send the credentials which includes sending capabilities part of msg_cred. As credentials are represented by both caps, uids, and the user namespace owner. This does not change the proto API event exported to users through gRPC, but just the internal representation between bpf<->userspace. Also remove the msg_cred_minimal now that was used as a temporary solution. Signed-off-by: Djalal Harouni <[email protected]>
Signed-off-by: Djalal Harouni <[email protected]>
Store the thread leader caps during fork so we can check later if capabilities changed during the execve, just before the execve hook point where we collect new capabilities and a new exec_id. Right now during fork they are zeroed in the execve_map which make it unreliable to detect if they changed between the fork and the final execve. Any hook just before the execve could report that they changed even if they did not, this is the case of a privileged that is as an example executing sudo or su. An event will be generated that capabilities did change (raised) but in reality they did not. As they were zero'ed the caps change comparison will be performed against zero which will always succeed. Fix this by storing caps during fork, and ensure that we only report positive cases. Signed-off-by: Djalal Harouni <[email protected]>
Signed-off-by: Djalal Harouni <[email protected]>
kkourt
approved these changes
Apr 3, 2024
On the exec path on current, just after commit_cred() and before our exec hook, this is our window. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.