8000 feat(events): create access_remote_vm event by AlonZivony · Pull Request #3551 · aquasecurity/tracee · GitHub
[go: up one dir, main page]
More Web Proxy on the site http://driver.im/
Skip to content

feat(events): create access_remote_vm event #3551

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
wants to merge 10 commits into from
Closed

feat(events): create access_remote_vm event #3551

wants to merge 10 commits into from

Conversation

AlonZivony
Copy link
Contributor
@AlonZivony AlonZivony commented Oct 4, 2023 •
edited
Loading

1. Explain what the PR does

An event for accessing the memory of a process externally (can be the same process) by the mem file of the process in procfs.

789bd69 test(events): add e2e test to access_remote_vm
fd6e01a feat(events): create access_remote_vm event
0854a88 feat(ebpf): support 7 arguments saving for kretprobe
491ba04 feat(events): add probe relevance attribute

Fix #3518

2. Explain how to test it

3. Other comments

@AlonZivony AlonZivony force-pushed the feature/proc-mem-operations branch 2 times, most recently from abeb60f to deb4ef0 Compare October 4, 2023 13:12
@AlonZivony AlonZivony force-pushed the feature/proc-mem-operations branch from deb4ef0 to 93d376b Compare October 5, 2023 10:13
@AlonZivony AlonZivony force-pushed the feature/proc-mem-operations branch from 93d376b to 59f34a5 Compare October 5, 2023 10:20
@rafaeldtinoco
Copy link
Contributor

I loved the event! It LGTM, definitely.

There are just minor spell nits, some comments to be added to make it easier to understand your intents (if my interpretation is correct).

A small "point to clear" would be the VMA naming strategy/logic. I left a question for you there.

Also, If you could add a simple e2e-inst trigger for this type of event I would also appreciate (like we already spoke).

Nice work!

@AlonZivony AlonZivony force-pushed the feature/proc-mem-operations branch from 59f34a5 to 275d6db Compare October 24, 2023 15:13
@AlonZivony AlonZivony force-pushed the feature/proc-mem-operations branch from 275d6db to 06d025f Compare October 24, 2023 15:56
@AlonZivony AlonZivony force-pushed the feature/proc-mem-operations branch 2 times, most recently from 0ff94d2 to 3a5c024 Compare 8000 October 25, 2023 13:37
@AlonZivony AlonZivony force-pushed the feature/proc-mem-operations branch 2 times, most recently from ee989e1 to 97963ff Compare November 28, 2023 10:01
@rafaeldtinoco
Copy link
Contributor

Looks like the tests failed but when looking at the output the event (at least on 4.18) worked. Needs some fine tuning I believe.

@AlonZivony
Copy link
Contributor Author

You can see that the problem is the version check, because the remote_pid value is 0.
I will try to find another type.

@AlonZivony AlonZivony marked this pull request as draft November 29, 2023 10:16
@rafaeldtinoco rafaeldtinoco added security issues that could taint tracee and removed security issues that could taint tracee labels Nov 30, 2023
@AlonZivony AlonZivony force-pushed the feature/proc-mem-operations branch 3 times, most recently from bc33179 to 24d5e97 Compare January 2, 2024 21:20
AlonZivony and others added 4 commits January 3, 20 8000 24 02:13
@AlonZivony
feat(events): add probe relevance attribute
491ba04 
Add to each probe the option to determine its relevance according to
the OS version.
If a probe is irrelevant, an attempt to load it won't be initiated.
This allows to have different probes for events according to OS
version.
@AlonZivony
feat(ebpf): support 7 arguments saving for kretprobe
0854a88 
The first 6 arguments are passed to functions using registers.
From the 7th forward, the arguments pass through the stack.
For this reason, only saving the first 6 arguments was supported
until now.
This commit add the 7th argument also to the saved args between
kprobe and kretprobe.
@AlonZivony @OriGlassman
feat(events): create access_remote_vm event
fd6e01a 
An event for accessing the memroy of a process externally (can be the
same process) by the mem file of the process in procfs.

Co-authored-by: OriGlassman <39296766+origlassman@users.noreply.github.com>
@AlonZivony
test(events): add e2e test to access_remote_vm
789bd69 
Add e2e test to check that the access_remote_vm works well.
@AlonZivony AlonZivony force-pushed the feature/proc-mem-operations branch from 24d5e97 to 789bd69 Compare January 3, 2024 00:16
@geyslan
Copy link
Member
geyslan commented Feb 21, 2024

We have this update #3875

Please rebase your PR against main to make use of the new workflow setup.

@AlonZivony AlonZivony mentioned this pull request Feb 21, 2024
Closed
@yanivagman
Copy link
Collaborator

Not going to be implemented

@yanivagman yanivagman closed this Dec 10, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@rafaeldtinoco rafaeldtinoco rafaeldtinoco requested changes

Copilot code review Copilot Awaiting requested review from Copilot Copilot will automatically review once the pull request is marked ready for review

Assignees

@AlonZivony AlonZivony

Labels
area/build area/ebpf area/events area/testing area/UX kind/documentation kind/feature
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Writing to a process memory event
4 participants
@AlonZivony @rafaeldtinoco @geyslan @yanivagman
0