8000 feat: add inotify_find_inode event by roikol · Pull Request #2794 · aquasecurity/tracee · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

feat: add inotify_find_inode event #2794

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
Mar 14, 2023
Merged

feat: add inotify_find_inode event #2794

merged 1 commit into from
Mar 14, 2023

Conversation

roikol
Copy link
Contributor
@roikol roikol commented Mar 2, 2023

issue: #2793

1. Explain what the PR does

Author: RoiKol <roi.kol@aquasec.com>
Date:   Thu Mar 2 11:58:33 2023 +0200

    feat: add inotify_find_inode event
    
    add the inotify_find_inode event to indicate an inotify watch being
    added to a file

2. Explain how to test it

command 1: ./dist/tracee-ebpf -f e=inotify_find_inode
command 2: inotifywatch /tmp/test.txt

3. Other comments

@roikol roikol self-assigned this Mar 2, 2023
@roikol roikol force-pushed the add_inotify_event branch from b653629 to 6151dfe Compare March 2, 2023 10:08
@yanivagman
Copy link
Collaborator
yanivagman commented Mar 5, 2023 •
edited
Loading

Looks like kernel 5.4 introduced the security_path_noitfy which would have been a better choice:
https://elixir.bootlin.com/linux/v5.4.234/source/security/security.c#L920
However, since we want to keep support for 4.18 kernels, we can't use it as is. So this is just a note for after we will implement a mechanism to selectively load probes according to the environment (#1653 ).
In the meanwhile, I think you should consider renaming this event to something more abstract (so we can change the probe without renaming the event in the future)

@roikol
Copy link
Contributor Author
roikol commented Mar 8, 2023

Looks like kernel 5.4 introduced the security_path_noitfy which would have been a better choice: https://elixir.bootlin.com/linux/v5.4.234/source/security/security.c#L920 However, since we want to keep support for 4.18 kernels, we can't use it as is. So this is just a note for after we will implement a mechanism to selectively load probes according to the environment (#1653 ). In the meanwhile, I think you should consider renaming this event to something more abstract (so we can change the probe without renaming the event in the future)

yeah i saw this lsm but decided to go with inotify_find_inode to be compatible with all supported kernel versions.
i'll rename to event to inotify_watch, sounds good?

@roikol roikol force-pushed the add_inotify_event branch from 6151dfe to 46d4b63 Compare March 8, 2023 13:38
@roikol
feat: add inotify_watch event
07c323f 
add the inotify_watch event to indicate an inotify watch being
added to a file
@roikol roikol force-pushed the add_inotify_event branch from 46d4b63 to 07c323f Compare March 8, 2023 13:43
@roikol roikol requested a review from yanivagman March 8, 2023 13:43
rafaeldtinoco
rafaeldtinoco approved these changes Mar 14, 2023
View reviewed changes
Copy link
Contributor
@rafaeldtinoco rafaeldtinoco left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM.

@rafaeldtinoco
Copy link
Contributor

Im merging now as this is a simple event and comment from Yaniv has already been noticed. Thanks!

@rafaeldtinoco rafaeldtinoco merged commit 9036cad into aquasecurity:main Mar 14, 2023
@yanivagman yanivagman mentioned this pull request Mar 15, 2023
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rafaeldtinoco rafaeldtinoco rafaeldtinoco approved these changes

@yanivagman yanivagman Awaiting requested review from yanivagman

Assignees

@roikol roikol

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@roikol @yanivagman @rafaeldtinoco
0