Skip to content

Commit f7aedb5

Browse files
uenoueno
committed
Include application's executable filename in logs
This embeds the running application's executable filename in the primary log as well as the crau-query output. To preserve backward compatibility, if the "executable" field is missing in the primary log, an empty string will be assumed. Signed-off-by: Daiki Ueno <dueno@redhat.com>
1 parent 26ce283 commit f7aedb5

11 files changed

Lines changed: 124 additions & 4 deletions

File tree

‎agent/src/agent.rs‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -317,7 +317,15 @@ mod tests {
317317
let input_file_path = fixtures_path.join("input.cborseq");
318318
let input_file = std::fs::File::open(&input_file_path).expect("unable to open input file");
319319

320+
// Copy metadata from the fixture and prepend it to the output
321+
let output_file_path = fixtures_path.join("output.cborseq");
322+
let expected = std::fs::read(&output_file_path).expect("unable to read output file");
323+
let mut iter = Deserializer::from_reader(expected.as_slice()).into_iter::<EventGroup>();
324+
let metadata: EventGroup = iter.next().unwrap().expect("unable to read metadata");
320325
let mut output = Vec::new();
326+
let mut v = serde_cbor::ser::to_vec(&metadata).expect("unable to serialize to CBOR");
327+
output.append(&mut v);
328+
321329
for res in
322330
Deserializer::from_reader(&input_file).into_iter::<(Duration, Vec<u8>, Vec<u8>)>()
323331
{
@@ -334,8 +342,6 @@ mod tests {
334342
output.append(&mut v);
335343
}
336344

337-
let output_file_path = fixtures_path.join("output.cborseq");
338-
let expected = std::fs::read(&output_file_path).expect("unable to read output file");
339345
assert_eq!(expected, output);
340346
}
341347
}

‎agent/src/bpf/audit.bpf.c‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,21 @@ populate_event_header (struct audit_event_header_st *header,
4848
header->ktime = bpf_ktime_get_boot_ns ();
4949
}
5050

51+
static __always_inline long
52+
get_current_executable (char *buf, size_t size_of_buf)
53+
{
54+
struct task_struct *task = (struct task_struct *)bpf_get_current_task ();
55+
struct file *file = BPF_CORE_READ(task, mm, exe_file);
56+
struct path *path = __builtin_preserve_access_index (&file->f_path);
57+
struct dentry *dentry = BPF_CORE_READ(path, dentry);
58+
unsigned char *name = BPF_CORE_READ(dentry, d_name.name);
59+
u32 len = BPF_CORE_READ(dentry, d_name.len);
60+
len += 1; /* for the terminating NUL byte */
61+
if (len > MAX_EXECUTABLE_SIZE)
62+
len = MAX_EXECUTABLE_SIZE;
63+
return bpf_probe_read_kernel_str (buf, len, name);
64+
}
65+
5166
static __always_inline int
5267
record_new_context (struct pt_regs *ctx, long context, long parent)
5368
{
@@ -81,6 +96,10 @@ record_new_context (struct pt_regs *ctx, long context, long parent)
8196
context);
8297
event->parent = parent;
8398

99+
err = get_current_executable (event->executable, sizeof(event->executable));
100+
if (err < 0)
101+
DEBUG ("unable to get current executable: %ld\n", err);
102+
84103
if (BPF_CORE_READ_BITFIELD(build_id, status) & BPF_STACK_BUILD_ID_VALID)
85104
{
86105
event->origin_size = bpf_core_field_size (build_id->build_id);

‎crypto-auditing/src/bpf/audit.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,13 +32,15 @@ struct audit_event_header_st
3232
};
3333

3434
#define MAX_BUILD_ID_SIZE 64
35+
#define MAX_EXECUTABLE_SIZE 256
3536

3637
struct audit_new_context_event_st
3738
{
3839
struct audit_event_header_st header;
3940
long parent;
4041
unsigned char origin[MAX_BUILD_ID_SIZE];
4142
unsigned long int origin_size;
43+
char executable[MAX_EXECUTABLE_SIZE];
4244
};
4345

4446
struct audit_data_event_st

‎crypto-auditing/src/types.rs‎

Lines changed: 22 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ use serde::{
88
use serde_with::{hex::Hex, serde_as};
99
use std::cell::RefCell;
1010
use std::collections::BTreeMap;
11-
use std::ffi::CStr;
11+
use std::ffi::{CStr, CString};
1212
use std::rc::Rc;
1313
use std::time::{Duration, SystemTime, UNIX_EPOCH};
1414
use sysinfo::System;
@@ -32,6 +32,13 @@ where
3232
seq.end()
3333
}
3434

35+
fn to_string_lossy<S>(source: &CString, serializer: S) -> Result<S::Ok, S::Error>
36+
where
37+
S: Serializer,
38+
{
39+
serializer.serialize_str(&source.to_string_lossy())
40+
}
41+
3542
#[serde_as]
3643
#[derive(Debug, Serialize)]
3744
pub struct Context {
@@ -40,6 +47,8 @@ pub struct Context {
4047
pub id: ContextId,
4148
#[serde_as(as = "Hex")]
4249
pub origin: Vec<u8>,
50+
#[serde(serialize_with = "to_string_lossy")]
51+
pub executable: CString,
4352
#[serde_as(as = "serde_with::TimestampSecondsWithFrac<f64>")]
4453
pub start: SystemTime,
4554
#[serde_as(as = "serde_with::TimestampSecondsWithFrac<f64>")]
@@ -103,10 +112,12 @@ impl ContextTracker {
103112
Event::NewContext {
104113
parent: parent_context,
105114
origin,
115+
executable,
106116
} => {
107117
let context = Rc::new(RefCell::new(Context {
108118
id: *group.context(),
109119
origin: origin.to_owned(),
120+
executable: executable.to_owned(),
110121
start,
111122
end,
112123
events: Default::default(),
@@ -132,6 +143,7 @@ impl ContextTracker {
132143
let context_obj = Rc::new(RefCell::new(Context {
133144
id: *group.context(),
134145
origin: Default::default(),
146+
executable: Default::default(),
135147
start,
136148
end,
137149
events: Default::default(),
@@ -173,6 +185,8 @@ pub enum Event {
173185
parent: ContextId,
174186
#[serde_as(as = "serde_with::Bytes")]
175187
origin: Vec<u8>,
188+
#[serde(default)]
189+
executable: CString,
176190
},
177191
Data {
178192
key: String,
@@ -305,11 +319,17 @@ impl EventGroup {
305319
let origin = unsafe {
306320
(&(*raw_new_context).origin)[..(*raw_new_context).origin_size as usize].to_vec()
307321
};
322+
let executable =
323+
unsafe { CStr::from_ptr((&(*raw_new_context).executable).as_ptr()).to_owned() };
308324
EventGroup {
309325
context,
310326
start: ktime,
311327
end: ktime,
312-
events: vec![Event::NewContext { parent, origin }],
328+
events: vec![Event::NewContext {
329+
parent,
330+
origin,
331+
executable,
332+
}],
313333
}
314334
}
315335
audit_event_type_t::AUDIT_EVENT_DATA => unsafe {

‎docs/query.schema.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
"properties": {
1212
"context": { "type": "string" },
1313
"origin": { "type": "string" },
14+
"command": { "type": "string" },
1415
"start": { "type": "number" },
1516
"end": { "type": "number" },
1617
"events": {

‎fixtures/logs/since-until/none.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@
22
{
33
"context": "77c5eac18916f65560e4a72c378fa571",
44
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
5+
"executable": "",
56
"start": 1771974803.010886,
67
"end": 1771974803.010886,
78
"events": {
@@ -12,6 +13,7 @@
1213
{
1314
"context": "3cb4522554c9b0dc609cb15a60e8066d",
1415
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
16+
"executable": "",
1517
"start": 1771974803.0110753,
1618
"end": 1771974803.0110753,
1719
"events": {
@@ -22,6 +24,7 @@
2224
{
2325
"context": "a585d1425ae9a1bb716ef919a7077b79",
2426
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
27+
"executable": "",
2528
"start": 1771974803.0110772,
2629
"end": 1771974803.0110772,
2730
"events": {
@@ -35,6 +38,7 @@
3538
{
3639
"context": "8bea2cd10c263427b8ea8f7a75ab63dc",
3740
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
41+
"executable": "",
3842
"start": 1771974803.0253136,
3943
"end": 1771974803.0253136,
4044
"events": {
@@ -45,6 +49,7 @@
4549
{
4650
"context": "56cef1e26f5035c51e0df469ac338f5d",
4751
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
52+
"executable": "",
4853
"start": 1771974803.025316,
4954
"end": 1771974803.025316,
5055
"events": {
@@ -55,6 +60,7 @@
5560
{
5661
"context": "bd1bf0fb3d99d6695865fa2bbef92b34",
5762
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
63+
"executable": "",
5864
"start": 1771974803.0255075,
5965
"end": 1771974803.0255075,
6066
"events": {
@@ -67,6 +73,7 @@
6773
{
6874
"context": "ba2f7865e4de038b3da670176ac134aa",
6975
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
76+
"executable": "",
7077
"start": 1771974803.0425448,
7178
"end": 1771974803.0425448,
7279
"events": {
@@ -78,6 +85,7 @@
7885
{
7986
"context": "dcb5668c7981c908da00c4f485aa28fe",
8087
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
88+
"executable": "",
8189
"start": 1771974803.0257778,
8290
"end": 1771974803.0257778,
8391
"events": {
@@ -88,6 +96,7 @@
8896
{
8997
"context": "0c7af68a3db1a3f26781b44c3b74f372",
9098
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
99+
"executable": "",
91100
"start": 1771974803.025795,
92101
"end": 1771974803.025795,
93102
"events": {
@@ -104,6 +113,7 @@
104113
{
105114
"context": "ccb9432c9c2c8c203230e6b7d31c0b16",
106115
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
116+
"executable": "",
107117
"start": 1771974863.214706,
108118
"end": 1771974863.214706,
109119
"events": {
@@ -114,6 +124,7 @@
114124
{
115125
"context": "4496299804038c7e426b63ba21e82767",
116126
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
127+
"executable": "",
117128
"start": 1771974863.2148774,
118129
"end": 1771974863.2148774,
119130
"events": {
@@ -124,6 +135,7 @@
124135
{
125136
"context": "f4a8575856bd5e71c9cfeb08004b18a8",
126137
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
138+
"executable": "",
127139
"start": 1771974863.2148807,
128140
"end": 1771974863.2148807,
129141
"events": {
@@ -137,6 +149,7 @@
137149
{
138150
"context": "5d965925626f231276ab4658c070f0bb",
139151
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
152+
"executable": "",
140153
"start": 1771974863.2293024,
141154
"end": 1771974863.2293024,
142155
"events": {
@@ -147,6 +160,7 @@
147160
{
148161
"context": "5ffa226b4b1b2e03ac33f016c368daf5",
149162
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
163+
"executable": "",
150164
"start": 1771974863.22932,
151165
"end": 1771974863.22932,
152166
"events": {
@@ -161,6 +175,7 @@
161175
{
162176
"context": "9c3eb879769d1ca094404184669f6d60",
163177
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
178+
"executable": "",
164179
"start": 1771974863.2288046,
165180
"end": 1771974863.2288046,
166181
"events": {
@@ -171,6 +186,7 @@
171186
{
172187
"context": "464cbb78dccd784c9b70a5592a97c067",
173188
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
189+
"executable": "",
174190
"start": 1771974863.229047,
175191
"end": 1771974863.229047,
176192
"events": {
@@ -181,6 +197,7 @@
181197
{
182198
"context": "6b12b88a73508c86569afb171fc86fa2",
183199
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
200+
"executable": "",
184201
"start": 1771974863.2288072,
185202
"end": 1771974863.2288072,
186203
"events": {
@@ -193,6 +210,7 @@
193210
{
194211
"context": "f574d1bf35c80d999cd45243992cbcf3",
195212
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
213+
"executable": "",
196214
"start": 1771974863.2472508,
197215
"end": 1771974863.2472508,
198216
"events": {
@@ -206,6 +224,7 @@
206224
{
207225
"context": "ba622d5b9877a430162242de965c3a3e",
208226
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
227+
"executable": "",
209228
"start": 1771974923.4500113,
210229
"end": 1771974923.4500113,
211230
"events": {
@@ -216,6 +235,7 @@
216235
{
217236
"context": "086f6407cbc7d1ab26012b7e939373c4",
218237
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
238+
"executable": "",
219239
"start": 1771974923.4649017,
220240
"end": 1771974923.4649017,
221241
"events": {
@@ -226,6 +246,7 @@
226246
{
227247
"context": "849055c3278578d687c4b54c828ec440",
228248
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
249+
"executable": "",
229250
"start": 1771974923.4649038,
230251
"end": 1771974923.4649038,
231252
"events": {
@@ -236,6 +257,7 @@
236257
{
237258
"context": "dbdb8d7e3703cb023b12c41af91cad51",
238259
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
260+
"executable": "",
239261
"start": 1771974923.465125,
240262
"end": 1771974923.465125,
241263
"events": {
@@ -248,6 +270,7 @@
248270
{
249271
"context": "174de05063ba9b25008b373abab6edc2",
250272
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
273+
"executable": "",
251274
"start": 1771974923.4501987,
252275
"end": 1771974923.4501987,
253276
"events": {
@@ -258,6 +281,7 @@
258281
{
259282
"context": "ac972e44ea6bcef3b4a63cbe53a80cc9",
260283
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
284+
"executable": "",
261285
"start": 1771974923.4502006,
262286
"end": 1771974923.4502006,
263287
"events": {
@@ -271,6 +295,7 @@
271295
{
272296
"context": "520f84448e7d46817efd218659951f35",
273297
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
298+
"executable": "",
274299
"start": 1771974923.4855325,
275300
"end": 1771974923.4855325,
276301
"events": {
@@ -282,6 +307,7 @@
282307
{
283308
"context": "7efbca0e91133d460bbabf918ea3d2d5",
284309
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
310+
"executable": "",
285311
"start": 1771974923.4654472,
286312
"end": 1771974923.4654472,
287313
"events": {
@@ -292,6 +318,7 @@
292318
{
293319
"context": "631afe9e5424d5b5b2a69e94388704d7",
294320
"origin": "25afdfb85a5c7626b28a77ac4dce92637f7c842a",
321+
"executable": "",
295322
"start": 1771974923.465482,
296323
"end": 1771974923.465482,
297324
"events": {

0 commit comments

Comments
 (0)