Skip to content

Add executable ctime to ExecveBinaryInfo. #13691

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
copybara-service wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add executable ctime to ExecveBinaryInfo. #13691

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 7 additions & 1 deletion pkg/sentry/kernel/task_exec.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -473,7 +473,7 @@ func getExecveSeccheckInfo(t *Task, argv, env []string, executable *vfs.FileDesc
if fields.Local.Contains(seccheck.FieldSentryExecveBinaryInfo) {
info.BinaryOverlayfsUpper = overlay.IsCopiedUp(executable.Dentry())
statOpts := vfs.StatOptions{
Mask: linux.STATX_TYPE | linux.STATX_MODE | linux.STATX_UID | linux.STATX_GID | linux.STATX_INO,
Mask: linux.STATX_TYPE | linux.STATX_MODE | linux.STATX_UID | linux.STATX_GID | linux.STATX_INO | linux.STATX_CTIME,
}
if stat, err := executable.Stat(t, statOpts); err == nil {
if stat.Mask&(linux.STATX_TYPE|linux.STATX_MODE) == (linux.STATX_TYPE | linux.STATX_MODE) {
Expand All @@ -488,6 +488,12 @@ func getExecveSeccheckInfo(t *Task, argv, env []string, executable *vfs.FileDesc
if stat.Mask&linux.STATX_INO != 0 {
info.BinaryIno = stat.Ino
}
if stat.Mask&linux.STATX_CTIME != 0 {
info.BinaryCtime = &pb.Timespec{
Sec: stat.Ctime.Sec,
Nsec: int64(stat.Ctime.Nsec),
}
}
}
}

Expand Down
5 changes: 5 additions & 0 deletions pkg/sentry/seccheck/points/common.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,11 @@ message Handshake {
uint32 version = 1;
}

message Timespec {
int64 sec = 1;
int64 nsec = 2;
}

message Credentials {
uint32 real_uid = 1;
uint32 effective_uid = 2;
Expand Down
6 changes: 6 additions & 0 deletions pkg/sentry/seccheck/points/sentry.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -66,6 +66,9 @@ message ExecveInfo {

// BinaryIno is the virtualized inode number of the executable binary file.
uint64 binary_ino = 10;

// BinaryCtime is the ctime of the executable binary file.
gvisor.common.Timespec binary_ctime = 11;
}

message ExitNotifyParentInfo {
Expand Down Expand Up @@ -105,4 +108,7 @@ message MmapInfo {
// IsInitialMmap indicates whether this mapping corresponds to the task's
// initial executable file.
bool is_initial_mmap = 7;

// MappedCtime is the ctime of the backing file.
gvisor.common.Timespec mapped_ctime = 8;
}
9 changes: 2 additions & 7 deletions pkg/sentry/seccheck/points/syscall.proto
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,14 +239,9 @@ message TimerfdCreate {
int32 flags = 5;
}

message Timespec {
int64 sec = 1;
int64 nsec = 2;
}

message ItimerSpec {
Timespec interval = 1;
Timespec value = 2;
gvisor.common.Timespec interval = 1;
gvisor.common.Timespec value = 2;
}

message TimerfdSetTime {
Expand Down
8 changes: 7 additions & 1 deletion pkg/sentry/syscalls/linux/sys_mmap.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -369,7 +369,7 @@ func traceMmap(t *kernel.Task, file *vfs.FileDescription) error {
if file != nil {
info.MappedPath = file.MappedName(t)
statOpts := vfs.StatOptions{
Mask: linux.STATX_TYPE | linux.STATX_MODE | linux.STATX_UID | linux.STATX_GID | linux.STATX_INO,
Mask: linux.STATX_TYPE | linux.STATX_MODE | linux.STATX_UID | linux.STATX_GID | linux.STATX_INO | linux.STATX_CTIME,
}
if stat, err := file.Stat(t, statOpts); err == nil {
if stat.Mask&(linux.STATX_TYPE|linux.STATX_MODE) == (linux.STATX_TYPE | linux.STATX_MODE) {
Expand All @@ -384,6 +384,12 @@ func traceMmap(t *kernel.Task, file *vfs.FileDescription) error {
if stat.Mask&linux.STATX_INO != 0 {
info.MappedIno = stat.Ino
}
if stat.Mask&linux.STATX_CTIME != 0 {
info.MappedCtime = &ppb.Timespec{
Sec: stat.Ctime.Sec,
Nsec: int64(stat.Ctime.Nsec),
}
}
}
}
if exe := t.MemoryManager().Executable(); exe != nil {
Expand Down
6 changes: 6 additions & 0 deletions test/trace/trace_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -273,6 +273,9 @@ func checkSentryMmap(msg test.Message) error {
if p.IsInitialMmap || p.MappedPath != "" {
fmt.Printf("Mmap event: path=%q, ino=%d, mode=%o, uid=%d, gid=%d, initial=%v\n", p.MappedPath, p.MappedIno, p.MappedMode, p.MappedUid, p.MappedGid, p.IsInitialMmap)
}
if p.MappedPath != "" && (p.MappedCtime == nil || p.MappedCtime.Sec == 0) {
return fmt.Errorf("MappedCtime should not be empty for mapped file: %q", p.MappedPath)
}
if err := checkContextData(p.ContextData); err != nil {
return err
}
Expand Down Expand Up @@ -431,6 +434,9 @@ func checkSentryExec(msg test.Message) error {
if p.BinaryIno == 0 {
return fmt.Errorf("BinaryIno should not be 0")
}
if p.BinaryCtime == nil || p.BinaryCtime.Sec == 0 {
return fmt.Errorf("BinaryCtime should not be empty")
}

// Get SHA256 from the binary and compare it with the one from the event.
out, err := exec.Command("sha256sum", p.BinaryPath).CombinedOutput()
Expand Down
Loading