diff --git a/runprogram/handle.go b/runprogram/handle.go index 4423e9a..510982b 100644 --- a/runprogram/handle.go +++ b/runprogram/handle.go @@ -95,6 +95,8 @@ func (h *tracerHandler) Handle(ctx *tracer.Context) tracer.TraceAction { case "execve": action = h.checkRead(ctx, ctx.Arg0()) + case "execveat": + action = h.checkRead(ctx, ctx.Arg1()) case "chmod": action = h.checkWrite(ctx, ctx.Arg0()) diff --git a/tracer/context_helper.go b/tracer/context_helper.go index 81db2e2..53b3d6f 100644 --- a/tracer/context_helper.go +++ b/tracer/context_helper.go @@ -14,7 +14,7 @@ func ptraceReadStr(pid int, addr uintptr, buff []byte) { func processVMReadv(pid int, localIov, remoteIov []unix.Iovec, flags uintptr) (r1, r2 uintptr, err syscall.Errno) { - return syscall.RawSyscall6(unix.SYS_PROCESS_VM_READV, uintptr(pid), + return syscall.Syscall6(unix.SYS_PROCESS_VM_READV, uintptr(pid), uintptr(unsafe.Pointer(&localIov[0])), uintptr(len(localIov)), uintptr(unsafe.Pointer(&remoteIov[0])), uintptr(len(remoteIov)), flags) diff --git a/tracer/tracer_track.go b/tracer/tracer_track.go index 849f3ff..d02d18a 100644 --- a/tracer/tracer_track.go +++ b/tracer/tracer_track.go @@ -238,7 +238,8 @@ func handleTrap(handler Handler, pid int) error { switch act { case TraceBan: - // Set the syscallno to -1 and return value into register. https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt + // Set the syscallno to -1 and return value into register to skip syscall. + // https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt return ctx.skipSyscall() case TraceKill: @@ -256,8 +257,9 @@ func handleTrap(handler Handler, pid int) error { // set Ptrace option that set up seccomp, exit kill and all mult-process actions func setPtraceOption(pid int) error { - return unix.PtraceSetOptions(pid, unix.PTRACE_O_TRACESECCOMP|unix.PTRACE_O_EXITKILL| - unix.PTRACE_O_TRACEFORK|unix.PTRACE_O_TRACECLONE|unix.PTRACE_O_TRACEEXEC|unix.PTRACE_O_TRACEVFORK) + const ptraceFlags = unix.PTRACE_O_TRACESECCOMP | unix.PTRACE_O_EXITKILL | unix.PTRACE_O_TRACEFORK | + unix.PTRACE_O_TRACECLONE | unix.PTRACE_O_TRACEEXEC | unix.PTRACE_O_TRACEVFORK + return unix.PtraceSetOptions(pid, ptraceFlags) } // kill all tracee according to pids @@ -267,10 +269,10 @@ func killAll(pgid int) { // collect died child processes func collectZombie(pgid int) { + var wstatus unix.WaitStatus // collect zombies for { - var wstatus unix.WaitStatus - if _, err := unix.Wait4(-pgid, &wstatus, unix.WALL|unix.WNOWAIT, nil); err != nil { + if _, err := unix.Wait4(-pgid, &wstatus, unix.WALL|unix.WNOHANG, nil); err != nil { break } }