sysflow-telemetry / sysflow

SysFlow documentation and issues tracker
Other
44 stars 10 forks source link

Exe name missing in Exe field #106

Open dcarolloz opened 1 year ago

dcarolloz commented 1 year ago

Indicate project libsysflow

Describe the bug The exe name is sometimes not reported

To reproduce Steps to reproduce the behavior:

  1. Build and run sf-collector example
  2. Compile and run code example reported below

Expected behavior The exe name should be reported. In the example, Exe is expected to show /usr/bin/sh.

Environment:

Code example

#define _GNU_SOURCE
#include <sys/syscall.h>
#include <linux/fs.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <stdio.h>
#include <errno.h>

int main(){
    const char* pathname = "/usr/bin/sh";
    const char* argv[] = { NULL };
    const char* envp[] = { NULL };
    int rc = syscall( SYS_execve, pathname, argv, envp);
    printf("errno: %d\n", errno);
}

sf-collector example log

****************************************************************
Header: Exporter , IP , File name 
Process: PID 15200 Creation Time, 1688463614759252239, Exe /usr/bin/bash, Exe Args , User Name vagrant, Group Name vagrant, TTY 1
Proc Evt: TID 15200, OpFlags 1, Ret 0
****************************************************************
****************************************************************
Header: Exporter , IP , File name 
Process: PID 15200 Creation Time, 1688463614759252239, Exe /home/vagrant/syscall-testers-master/execve_no_args, Exe Args , User Name vagrant, Group Name vagrant, TTY 1
Proc Evt: TID 15200, OpFlags 2, Ret 0
****************************************************************
****************************************************************
Header: Exporter , IP , File name 
Process: PID 15200 Creation Time, 1688463614759252239, Exe /home/vagrant/syscall-testers-master/execve_no_args, Exe Args , User Name vagrant, Group Name vagrant, TTY 1
File: Type 102, Path /etc/ld.so.cache
File Flow: TID 15200, OpFlags: 9344, OpenFlags 4097, FD 3
****************************************************************
****************************************************************
Header: Exporter , IP , File name 
Process: PID 15200 Creation Time, 1688463614759252239, Exe /home/vagrant/syscall-testers-master/execve_no_args, Exe Args , User Name vagrant, Group Name vagrant, TTY 1
File: Type 102, Path /lib/x86_64-linux-gnu/libc.so.6
File Flow: TID 15200, OpFlags: 9600, OpenFlags 4097, FD 3
****************************************************************
 ****************************************************************
Header: Exporter , IP , File name 
Process: PID 15200 Creation Time, 1688463614759252239, Exe , Exe Args , User Name vagrant, Group Name vagrant, TTY 1
Proc Evt: TID 15200, OpFlags 2, Ret 0
****************************************************************
****************************************************************
Header: Exporter , IP , File name 
Process: PID 15200 Creation Time, 1688463614759252239, Exe , Exe Args , User Name vagrant, Group Name vagrant, TTY 1
File: Type 102, Path /etc/ld.so.cache
File Flow: TID 15200, OpFlags: 9344, OpenFlags 4097, FD 3
****************************************************************
****************************************************************
Header: Exporter , IP , File name 
Process: PID 15200 Creation Time, 1688463614759252239, Exe , Exe Args , User Name vagrant, Group Name vagrant, TTY 1
File: Type 102, Path /lib/x86_64-linux-gnu/libc.so.6
File Flow: TID 15200, OpFlags: 9600, OpenFlags 4097, FD 3
****************************************************************
****************************************************************
Header: Exporter , IP , File name 
Process: PID 15200 Creation Time, 1688463614759252239, Exe , Exe Args , User Name vagrant, Group Name vagrant, TTY 1
File: Type 102, Path /dev/tty
File Flow: TID 15200, OpFlags: 1152, OpenFlags 3, FD 3
****************************************************************