add execveat to ptrace

This commit is contained in:
criyle 2019-08-16 00:11:33 -07:00
parent 988d521f25
commit c7679b02fb
3 changed files with 10 additions and 6 deletions

View File

@ -95,6 +95,8 @@ func (h *tracerHandler) Handle(ctx *tracer.Context) tracer.TraceAction {
case "execve":
action = h.checkRead(ctx, ctx.Arg0())
case "execveat":
action = h.checkRead(ctx, ctx.Arg1())
case "chmod":
action = h.checkWrite(ctx, ctx.Arg0())

View File

@ -14,7 +14,7 @@ func ptraceReadStr(pid int, addr uintptr, buff []byte) {
func processVMReadv(pid int, localIov, remoteIov []unix.Iovec,
flags uintptr) (r1, r2 uintptr, err syscall.Errno) {
return syscall.RawSyscall6(unix.SYS_PROCESS_VM_READV, uintptr(pid),
return syscall.Syscall6(unix.SYS_PROCESS_VM_READV, uintptr(pid),
uintptr(unsafe.Pointer(&localIov[0])), uintptr(len(localIov)),
uintptr(unsafe.Pointer(&remoteIov[0])), uintptr(len(remoteIov)),
flags)

View File

@ -238,7 +238,8 @@ func handleTrap(handler Handler, pid int) error {
switch act {
case TraceBan:
// Set the syscallno to -1 and return value into register. https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt
// Set the syscallno to -1 and return value into register to skip syscall.
// https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt
return ctx.skipSyscall()
case TraceKill:
@ -256,8 +257,9 @@ func handleTrap(handler Handler, pid int) error {
// set Ptrace option that set up seccomp, exit kill and all mult-process actions
func setPtraceOption(pid int) error {
return unix.PtraceSetOptions(pid, unix.PTRACE_O_TRACESECCOMP|unix.PTRACE_O_EXITKILL|
unix.PTRACE_O_TRACEFORK|unix.PTRACE_O_TRACECLONE|unix.PTRACE_O_TRACEEXEC|unix.PTRACE_O_TRACEVFORK)
const ptraceFlags = unix.PTRACE_O_TRACESECCOMP | unix.PTRACE_O_EXITKILL | unix.PTRACE_O_TRACEFORK |
unix.PTRACE_O_TRACECLONE | unix.PTRACE_O_TRACEEXEC | unix.PTRACE_O_TRACEVFORK
return unix.PtraceSetOptions(pid, ptraceFlags)
}
// kill all tracee according to pids
@ -267,10 +269,10 @@ func killAll(pgid int) {
// collect died child processes
func collectZombie(pgid int) {
var wstatus unix.WaitStatus
// collect zombies
for {
var wstatus unix.WaitStatus
if _, err := unix.Wait4(-pgid, &wstatus, unix.WALL|unix.WNOWAIT, nil); err != nil {
if _, err := unix.Wait4(-pgid, &wstatus, unix.WALL|unix.WNOHANG, nil); err != nil {
break
}
}