Skip to content

Commit

Permalink
new(libsinsp): parse setre*id syscalls
Browse files Browse the repository at this point in the history 
Signed-off-by: Roberto Scolaro <[email protected]>
  • Loading branch information
@therealbobo
therealbobo committed Jun 19, 2024
1 parent f63b8ab commit ec22f2e
Show file tree
Hide file tree
Showing 2 changed files with 14 additions and 6 deletions.
16 changes: 12 additions & 4 deletions userspace/libsinsp/parsers.cpp
View file
Original file line number Diff line number Diff line change
Expand Up @@ -168,7 +168,9 @@ void sinsp_parser::process_event(sinsp_evt *evt)
case PPME_SOCKET_SENDMSG_E:
case PPME_SYSCALL_SENDFILE_E:
case PPME_SYSCALL_SETRESUID_E:
case PPME_SYSCALL_SETREUID_E:
case PPME_SYSCALL_SETRESGID_E:
case PPME_SYSCALL_SETREGID_E:
case PPME_SYSCALL_SETUID_E:
case PPME_SYSCALL_SETGID_E:
case PPME_SYSCALL_SETPGID_E:
Expand Down Expand Up @@ -382,10 +384,16 @@ void sinsp_parser::process_event(sinsp_evt *evt)
parse_brk_munmap_mmap_exit(evt);
break;
case PPME_SYSCALL_SETRESUID_X:
parse_setresuid_exit(evt);
parse_setresuid_setreuid_exit(evt);
break;
case PPME_SYSCALL_SETREUID_X:
parse_setresuid_setreuid_exit(evt);
break;
case PPME_SYSCALL_SETRESGID_X:
parse_setresgid_exit(evt);
parse_setresgid_setregid_exit(evt);
break;
case PPME_SYSCALL_SETREGID_X:
parse_setresgid_setregid_exit(evt);
break;
case PPME_SYSCALL_SETUID_X:
parse_setuid_exit(evt);
Expand Down Expand Up @@ -4887,7 +4895,7 @@ void sinsp_parser::parse_brk_munmap_mmap_exit(sinsp_evt* evt)
evt->get_tinfo()->m_vmswap_kb = evt->get_param(3)->as<uint32_t>();
}

void sinsp_parser::parse_setresuid_exit(sinsp_evt *evt)
void sinsp_parser::parse_setresuid_setreuid_exit(sinsp_evt *evt)
{
int64_t retval;
sinsp_evt *enter_evt = &m_tmp_evt;
Expand All @@ -4910,7 +4918,7 @@ void sinsp_parser::parse_setresuid_exit(sinsp_evt *evt)
}
}

void sinsp_parser::parse_setresgid_exit(sinsp_evt *evt)
void sinsp_parser::parse_setresgid_setregid_exit(sinsp_evt *evt)
{
int64_t retval;
sinsp_evt *enter_evt = &m_tmp_evt;
Expand Down
4 changes: 2 additions & 2 deletions userspace/libsinsp/parsers.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -105,8 +105,8 @@ class sinsp_parser
void parse_prctl_exit_event(sinsp_evt *evt);
void parse_context_switch(sinsp_evt* evt);
void parse_brk_munmap_mmap_exit(sinsp_evt* evt);
void parse_setresuid_exit(sinsp_evt* evt);
void parse_setresgid_exit(sinsp_evt* evt);
void parse_setresuid_setreuid_exit(sinsp_evt* evt);
void parse_setresgid_setregid_exit(sinsp_evt* evt);
void parse_setuid_exit(sinsp_evt* evt);
void parse_setgid_exit(sinsp_evt* evt);
void parse_container_evt(sinsp_evt* evt); // deprecated, only for backward-compatibility
Expand Down

0 comments on commit ec22f2e

Please sign in to comment.