Skip to content

Include application's command-line in logs#270

Merged
ueno merged 4 commits into
latchset:mainfrom
ueno:wip/current-comm
Jun 23, 2026
Merged

Include application's command-line in logs#270
ueno merged 4 commits into
latchset:mainfrom
ueno:wip/current-comm

Conversation

@ueno

@ueno ueno commented May 12, 2026

Copy link
Copy Markdown
Contributor

This embeds command line of the running application in the primary log as well as the crau-query output. To preserve backward compatibility, if the "command" field is missing in the primary log, an empty string will be assumed.

@ueno ueno marked this pull request as draft May 12, 2026 07:53
@ueno ueno force-pushed the wip/current-comm branch from c64059c to afbda99 Compare May 12, 2026 07:55
Comment thread crypto-auditing/src/bpf/audit.h Outdated
Comment thread agent/src/bpf/audit.bpf.c Outdated
context);
event->parent = parent;

err = bpf_get_current_comm (event->command, sizeof(event->command));

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe bpf_get_cgroup_classid would also be useful to have in the logs.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do you mean bpf_get_current_cgroup_id? net_cls seems to be a cgroup v1 only feature.

ueno added 2 commits June 18, 2026 16:06
Signed-off-by: Daiki Ueno <dueno@redhat.com>
Signed-off-by: Daiki Ueno <dueno@redhat.com>
@ueno ueno force-pushed the wip/current-comm branch 2 times, most recently from f65cda6 to cd0cc2f Compare June 18, 2026 07:26
Signed-off-by: Daiki Ueno <dueno@redhat.com>
@ueno ueno force-pushed the wip/current-comm branch 5 times, most recently from 334774d to 6b18097 Compare June 22, 2026 11:04
@ueno ueno marked this pull request as ready for review June 22, 2026 11:16
@ueno ueno force-pushed the wip/current-comm branch from 6b18097 to 855fcb2 Compare June 22, 2026 11:20
@ueno ueno requested a review from The-Mule June 22, 2026 11:37

@The-Mule The-Mule left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I am wondering if command is the right name, wouldn't it be more precise to refer to it as executable instead? I have no strong preference about this but command sort of imply full command (line).

Comment thread agent/src/bpf/audit.bpf.c Outdated
Comment thread agent/src/bpf/audit.bpf.c
@ueno ueno force-pushed the wip/current-comm branch from 855fcb2 to c7b8c67 Compare June 23, 2026 11:20
@ueno

ueno commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

I am wondering if command is the right name, wouldn't it be more precise to refer to it as executable instead? I have no strong preference about this but command sort of imply full command (line).

Makes sense. Let me rename it to executable.

@ueno ueno force-pushed the wip/current-comm branch from c7b8c67 to 3182178 Compare June 23, 2026 11:29
This embeds the running application's executable filename in the
primary log as well as the crau-query output. To preserve backward
compatibility, if the "executable" field is missing in the primary
log, an empty string will be assumed.

Signed-off-by: Daiki Ueno <dueno@redhat.com>
@ueno ueno force-pushed the wip/current-comm branch from 3182178 to 8b6bdc3 Compare June 23, 2026 11:31

@The-Mule The-Mule left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks, looks perfect now.

@ueno

ueno commented Jun 23, 2026

Copy link
Copy Markdown
Contributor Author

Thanks for the review!

@ueno ueno merged commit f7aedb5 into latchset:main Jun 23, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants