Unix Stream Connect and Socket Connect Should Have Distinct Relationship Names

CamFlow / camflow-dev

Generates kernel patch for CamFlow Linux Provenance Capture.

http://camflow.org/

GNU General Public License v2.0

26 stars 15 forks source link

Unix Stream Connect and Socket Connect Should Have Distinct Relationship Names #94

Closed michael-hahn closed 5 years ago

michael-hahn commented 5 years ago

Currently, provenance_unix_stream_connect and provenance_socket_connect have identical connect relationship subtype between tasks and inodes, which makes it impossible to differentiate these two hooks in a provenance graph. A different subtype name should be preferred.

tfjmp commented 5 years ago

https://github.com/CamFlow/camflow-dev/commit/24181a46ad19a8bd8e6b989e2af79c7e3e6c2b37 should fix the issue.

@michael-hahn please double check and close the issue if it is ok!

michael-hahn commented 5 years ago

TinkerBell shows that provenance_unix_stream_connect now has connect_unix_stream subtype while provenance_socket_connect has connect subtype. Close this issue.