netdev - [PATCH] bpf:add function bpf_get_task_exe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon,  6 Jun 2022 18:54:01 +0000
From:   mangosteen728 <mangosteen728@....com>
To:     ast@...nel.org, daniel@...earbox.net, andrii@...nel.org
Cc:     bpf@...r.kernel.org, netdev@...r.kernel.org,
        mangosteen728 <mangosteen728@....com>
Subject: [PATCH] bpf:add function bpf_get_task_exe_path

Add the absolute path to get the executable corresponding tothe task

Signed-off-by: mangosteen728 <mangosteen728@....com>
---
Hi
This is my first attempt to submit patch, there are shortcomings please more but wait.

In security audit often need to get the absolute path to the executable of the process so I tried to add bpf_get_task_exe_path in the helpers function to get.

The code currently only submits the implementation of the function and how is this patch merge possible if I then add the relevant places。

thanks
mangosteen728
kernel/bpf/helpers.c | 37 +++++++++++++++++++++++++++++++++++++
1 file changed, 37 insertions(+)
diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
index 225806a..797f850 100644
--- a/kernel/bpf/helpers.c
+++ b/kernel/bpf/helpers.c
@@ -257,6 +257,43 @@
 	.arg2_type	= ARG_CONST_SIZE,
 };
 
+BPF_CALL_3(bpf_get_task_exe_path, struct task_struct *, task, char *, buf, u32, sz)
+{
+	struct file *exe_file = NULL;
+	char *p = NULL;
+	long len = 0;
+
+	if (!sz)
+		return 0;
+	exe_file = get_task_exe_file(tsk);
+	if (IS_ERR_OR_NULL(exe_file))
+		return 0;
+	p = d_path(&exe_file->f_path, buf, sz);
+	if (IS_ERR_OR_NULL(path)) {
+		len = PTR_ERR(p);
+	} else {
+		len = buf + sz - p;
+		memmove(buf, p, len);
+	}
+	fput(exe_file);
+	return len;
+}
+
+static const struct bpf_func_proto bpf_get_task_exe_path_proto = {
+	.func       = bpf_get_task_exe_path,
+	.gpl_only   = false,
+	.ret_type   = RET_INTEGER,
+	.arg1_type  = ARG_PTR_TO_BTF_ID,
+	.arg2_type  = ARG_PTR_TO_MEM,
+	.arg3_type  = ARG_CONST_SIZE_OR_ZERO,
+};
+
--