From ec260a31927ef77295eaa07ba370b58b416f47f5 Mon Sep 17 00:00:00 2001 From: We-unite <3205135446@qq.com> Date: Fri, 26 Jul 2024 17:23:53 +0800 Subject: Fix execve before fork & Fix regex to match "exit" There's 2 bugs from ancestor commits: - In the 'things_left' tag commit(the grandpa of this commit), we add a function that allows execve comes before fork, but when it happens, I forget to insert the basic info (pid, ppid, etc.), as a result of which it doesn't work in the designed way. Now it is well, insert execve with pid and ppid, so that the fork event can find it and finish other info. However, we shouldn't make start_stamp in this case, so that it's also a flag. I've not removed the unused execve info, waiting for the future. - In the parent commit, the syscallRegex is changed, because when we add more syscalls to be watched, we need more info about their params but not only the first one. Instead of keeping using single a0 to get the first param, i use argsRegex for all the params. But this change causes mismatch of syscallRegex. Now it's fixed. --- src/organize.go | 47 ++++++++++++++++++++++++++++++----------------- 1 file changed, 30 insertions(+), 17 deletions(-) (limited to 'src/organize.go') diff --git a/src/organize.go b/src/organize.go index 679f361..2489961 100644 --- a/src/organize.go +++ b/src/organize.go @@ -21,11 +21,11 @@ var ok bool var event Event var pEvent *Event var eventId, argc int -var err [6]error +var errs [6]error // 要用的正则匹配列表 var ( - syscallRegex = regexp.MustCompile(`audit\((\d+\.\d+):(\d+)\).*?syscall=(\d+).*?(exit=([-+]?\d+))?.*?ppid=(\d+) pid=(\d+).*?$`) + syscallRegex = regexp.MustCompile(`audit\((\d+\.\d+):(\d+)\).*?syscall=(\d+)(?:.*?exit=([-+]?\d+))?.*?ppid=(\d+) pid=(\d+).*?$`) execveRegex = regexp.MustCompile(`audit\(\d+\.\d+:(\d+)\): argc=(\d+)`) argsRegex = regexp.MustCompile(`a\d+=("(.*?)"|([0-9a-fA-F]+))`) pathRegex = regexp.MustCompile(`audit\(\d+\.\d+:(\d+)\):.*?name="(.*?)"`) @@ -76,17 +76,17 @@ func syscallRaw(rawEvent libaudit.RawAuditMessage) { var a [4]uint64 // 捕获基础信息 match := syscallRegex.FindSubmatch(rawEvent.Data) - event.timestamp, err[0] = getTimeFromStr(string(match[1])) - eventId, err[1] = strconv.Atoi(string(match[2])) - event.syscall, err[2] = strconv.Atoi(string(match[3])) - if string(match[5]) == "" { + event.timestamp, errs[0] = getTimeFromStr(string(match[1])) + eventId, errs[1] = strconv.Atoi(string(match[2])) + event.syscall, errs[2] = strconv.Atoi(string(match[3])) + if string(match[4]) == "" { // exit没捕获到 exit = 0 } else { - exit, err[3] = strconv.Atoi(string(match[5])) + exit, errs[3] = strconv.Atoi(string(match[4])) } - event.ppid, err[4] = strconv.Atoi(string(match[6])) - event.pid, err[5] = strconv.Atoi(string(match[7])) + event.ppid, errs[4] = strconv.Atoi(string(match[5])) + event.pid, errs[5] = strconv.Atoi(string(match[6])) // 捕获参数 if !argsRegex.Match(rawEvent.Data) { @@ -95,7 +95,7 @@ func syscallRaw(rawEvent libaudit.RawAuditMessage) { } argsMatch := argsRegex.FindAllSubmatch(rawEvent.Data, -1) for i := 0; i < 4; i++ { - a[i], err[0] = strconv.ParseUint(string(argsMatch[i][2]), 16, 64) + a[i], errs[0] = strconv.ParseUint(string(argsMatch[i][2]), 16, 64) } switch syscallTable[event.syscall] { @@ -136,6 +136,18 @@ func syscallRaw(rawEvent libaudit.RawAuditMessage) { syscallParam: a, pathName: "", }) + case "execve": + eventTable.Store(eventId, &Event{ + tag: EXECVE, + timestamp: event.timestamp, + syscall: event.syscall, + exit_code: a[0], + ppid: event.ppid, + pid: event.pid, + argc: 0, + argv: make([]string, 0), + cwd: "", + }) case "exit", "exit_group": eventTable.Store(eventId, &Event{ tag: PIDEXIT, @@ -157,14 +169,14 @@ func execve(rawEvent libaudit.RawAuditMessage) { } match := execveRegex.FindSubmatch(rawEvent.Data) - eventId, err[0] = strconv.Atoi(string(match[1])) - argc, err[1] = strconv.Atoi(string(match[2])) + eventId, errs[0] = strconv.Atoi(string(match[1])) + argc, errs[1] = strconv.Atoi(string(match[2])) tmp, ok = eventTable.Load(eventId) if !ok { return } pEvent = tmp.(*Event) - if err[0] == nil && err[1] == nil && argsRegex.Match(rawEvent.Data) { + if errs[0] == nil && errs[1] == nil && argsRegex.Match(rawEvent.Data) { match := argsRegex.FindAllSubmatch(rawEvent.Data, -1) for i := 0; i < argc; i++ { if len(match[i][2]) == 0 { @@ -185,7 +197,7 @@ func cwd(rawEvent libaudit.RawAuditMessage) { } match := cwdRegex.FindSubmatch(rawEvent.Data) - eventId, err[0] = strconv.Atoi(string(match[1])) + eventId, errs[0] = strconv.Atoi(string(match[1])) tmp, ok = eventTable.Load(eventId) if !ok { return @@ -200,7 +212,7 @@ func proctitle(rawEvent libaudit.RawAuditMessage) { var cmdline string match := proctitleRegex.FindSubmatch(rawEvent.Data) - eventId, err[0] = strconv.Atoi(string(match[1])) + eventId, errs[0] = strconv.Atoi(string(match[1])) tmp, ok = eventTable.Load(eventId) if !ok { return @@ -225,13 +237,14 @@ func eoe(rawEvent libaudit.RawAuditMessage) { } match := eoeRegex.FindSubmatch(rawEvent.Data) - eventId, err[0] = strconv.Atoi(string(match[1])) + eventId, errs[0] = strconv.Atoi(string(match[1])) tmp, ok = eventTable.Load(eventId) if !ok { return } cooked := *(tmp.(*Event)) cookedChan <- cooked + fmt.Printf("Send: %10d\t%v\t%7d\t%7d\n", eventId, cooked.tag, cooked.ppid, cooked.pid) eventTable.Delete(eventId) // 死人别占地 } @@ -240,7 +253,7 @@ func path(rawEvent libaudit.RawAuditMessage) { return } match := pathRegex.FindSubmatch(rawEvent.Data) - eventId, err[0] = strconv.Atoi(string(match[1])) + eventId, errs[0] = strconv.Atoi(string(match[1])) name := string(match[2]) tmp, ok = eventTable.Load(eventId) -- cgit v1.2.3-70-g09d2