netdev - Re: [PATCH] bpf:add function bpf_get_task_exe

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Tue, 7 Jun 2022 11:37:24 -0700
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     mangosteen728 <mangosteen728@....com>
Cc:     Alexei Starovoitov <ast@...nel.org>,
        Daniel Borkmann <daniel@...earbox.net>,
        Andrii Nakryiko <andrii@...nel.org>, bpf <bpf@...r.kernel.org>,
        Networking <netdev@...r.kernel.org>
Subject: Re: [PATCH] bpf:add function bpf_get_task_exe_path

On Mon, Jun 6, 2022 at 11:54 AM mangosteen728 <mangosteen728@....com> wrote:
>
> Add the absolute path to get the executable corresponding tothe task
>
> Signed-off-by: mangosteen728 <mangosteen728@....com>
> ---
> Hi
> This is my first attempt to submit patch, there are shortcomings please more but wait.
>
> In security audit often need to get the absolute path to the executable of the process so I tried to add bpf_get_task_exe_path in the helpers function to get.
>
> The code currently only submits the implementation of the function and how is this patch merge possible if I then add the relevant places。
>

See bpf_d_path() BPF helper, you should be able to do what you want
without adding new BPF helper.

> thanks
> mangosteen728
> kernel/bpf/helpers.c | 37 +++++++++++++++++++++++++++++++++++++
> 1 file changed, 37 insertions(+)
> diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
> index 225806a..797f850 100644
> --- a/kernel/bpf/helpers.c
> +++ b/kernel/bpf/helpers.c
> @@ -257,6 +257,43 @@
>         .arg2_type      = ARG_CONST_SIZE,
>  };
>
> +BPF_CALL_3(bpf_get_task_exe_path, struct task_struct *, task, char *, buf, u32, sz)
> +{
> +       struct file *exe_file = NULL;
> +       char *p = NULL;
> +       long len = 0;
> +
> +       if (!sz)
> +               return 0;
> +       exe_file = get_task_exe_file(tsk);
> +       if (IS_ERR_OR_NULL(exe_file))
> +               return 0;
> +       p = d_path(&exe_file->f_path, buf, sz);
> +       if (IS_ERR_OR_NULL(path)) {
> +               len = PTR_ERR(p);
> +       } else {
> +               len = buf + sz - p;
> +               memmove(buf, p, len);
> +       }
> +       fput(exe_file);
> +       return len;
> +}
> +
> +static const struct bpf_func_proto bpf_get_task_exe_path_proto = {
> +       .func       = bpf_get_task_exe_path,
> +       .gpl_only   = false,
> +       .ret_type   = RET_INTEGER,
> +       .arg1_type  = ARG_PTR_TO_BTF_ID,
> +       .arg2_type  = ARG_PTR_TO_MEM,
> +       .arg3_type  = ARG_CONST_SIZE_OR_ZERO,
> +};
> +
> --
>