Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

x-pack/auditbeat/module/socket/guess: fix creds trigger for newer kernels #37136

Merged
merged 1 commit into from
Nov 28, 2023
Merged

x-pack/auditbeat/module/socket/guess: fix creds trigger for newer kernels #37136

merged 1 commit into from
Nov 28, 2023

Conversation

efd6
Copy link
Contributor

@efd6 efd6 commented Nov 15, 2023 •
edited
Loading

Proposed commit message

In kernel commit 981ee95c (into v6.3) calls to access_override_creds
were gated behind a test for the requirement for the call. This change
results in non-execution of prepare_creds and so failure of the guess.

An alternative has been identified that does not exhibit this behaviour,
mq_open which calls dentry_open with creds in the third parameter. So
replace the sys_access trigger with sys_mq_open and add the probe to
dentry_open with P3 for the address.

Checklist

  • My code follows the style guidelines of this project
  • I have commented my code, particularly in hard-to-understand areas
  • I have made corresponding changes to the documentation
  • I have made corresponding change to the default configuration files
  • I have added tests that prove my fix is effective or that my feature works
  • I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

  • [ ]

How to test this PR locally

Related issues

Use cases

Screenshots

Logs

@efd6 efd6 self-assigned this Nov 15, 2023
@botelastic botelastic bot added needs_team Indicates that the issue/PR needs a Team:* label and removed needs_team Indicates that the issue/PR needs a Team:* label labels Nov 15, 2023
@efd6 efd6 added backport-skip Skip notification from the automated backport with mergify bug backport-v8.11.0 Automated backport with mergify and removed enhancement labels Nov 15, 2023
@elasticmachine

This comment was marked as outdated.

Sign in to view
@elasticmachine

This comment was marked as outdated.

Sign in to view
@efd6 efd6 force-pushed the 36905-auditbeat branch 4 times, most recently from 06da86f to 070a3ec Compare November 15, 2023 23:08
@elasticmachine

This comment was marked as outdated.

Sign in to view
@elasticmachine

This comment was marked as outdated.

Sign in to view
@elasticmachine

This comment was marked as outdated.

Sign in to view
@elasticmachine

This comment was marked as outdated.

Sign in to view
@elasticmachine

This comment was marked as outdated.

Sign in to view
@elasticmachine

This comment was marked as outdated.

Sign in to view
@elasticmachine

This comment was marked as outdated.

Sign in to view
@efd6 efd6 force-pushed the 36905-auditbeat branch 3 times, most recently from 5aa90ab to a5d8049 Compare November 16, 2023 06:08
@elasticmachine

This comment was marked as outdated.

Sign in to view
@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-11-16T06:09:10.000+0000

  • Duration: 43 min 59 sec

Test stats 🧪

Test Results
Failed 0
Passed 395
Skipped 63
Total 458

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@efd6 efd6 marked this pull request as ready for review November 16, 2023 06:58
@efd6 efd6 requested a review from a team as a code owner November 16, 2023 06:58
@elasticmachine
Copy link
Collaborator

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

@efd6 efd6 requested a review from haesbaert November 16, 2023 06:58
haesbaert
haesbaert reviewed Nov 16, 2023
View reviewed changes
x-pack/auditbeat/module/system/socket/guess/creds.go Outdated
func (g *guessStructCreds) Trigger() error {
syscall.Syscall(unix.SYS_ACCESS, 0, 0, 0)
return nil
name, err := unix.BytePtrFromString("omg")
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'd use a more unique string here __guess_creds or something.

haesbaert
haesbaert reviewed Nov 16, 2023
View reviewed changes
x-pack/auditbeat/seccomp_linux.go
Comment on lines +19 to +22
if err := seccomp.ModifyDefaultPolicy(seccomp.AddSyscall,
"mremap",
"umask",
); err != nil {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

solely whitespace changes would be nicer in a second commit.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Agreed, but unfortunately this will all get squashed.

haesbaert
haesbaert approved these changes Nov 16, 2023
View reviewed changes
Copy link
Contributor

@haesbaert haesbaert left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm!

@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-11-16T08:27:24.589+0000

  • Duration: 42 min 50 sec

Test stats 🧪

Test Results
Failed 0
Passed 395
Skipped 63
Total 458

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@efd6 efd6 removed the backport-skip Skip notification from the automated backport with mergify label Nov 16, 2023
@mergify Mergify
Copy link
Contributor

mergify bot commented Nov 22, 2023

This pull request is now in conflicts. Could you fix it? 🙏
To fixup this pull request, you can check out it locally. See documentation: https://help.github.com/articles/checking-out-pull-requests-locally/

git fetch upstream
git checkout -b 36905-auditbeat upstream/36905-auditbeat
git merge upstream/main
git push upstream 36905-auditbeat

@efd6
x-pack/auditbeat/module/socket/guess: fix creds trigger for newer ker…
29ce401 
…nels

In kernel commit 981ee95c (into v6.3) calls to access_override_creds
were gated behind a test for the requirement for the call. This change
results in non-execution of prepare_creds and so failure of the guess.

An alternative has been identified that does not exhibit this behaviour,
mq_open which calls dentry_open with creds in the third parameter. So
replace the sys_access trigger with sys_mq_open and add the probe to
dentry_open with P3 for the address.

Approach developed by Christiano Haesbaert.
@elasticmachine
Copy link
Collaborator

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS
Pipeline View Test View Changes Artifacts preview preview

Expand to view the summary

Build stats

  • Start Time: 2023-11-22T21:03:03.725+0000

  • Duration: 43 min 52 sec

Test stats 🧪

Test Results
Failed 0
Passed 395
Skipped 63
Total 458

💚 Flaky test report

Tests succeeded.

🤖 GitHub comments

Expand to view the GitHub comments

To re-run your PR in the CI, just comment with:

  • /test : Re-trigger the build.

  • /package : Generate the packages and run the E2E tests.

  • /beats-tester : Run the installation tests with beats-tester.

  • run elasticsearch-ci/docs : Re-trigger the docs validation. (use unformatted text in the comment!)

@efd6 efd6 merged commit 284683d into elastic:main Nov 28, 2023
20 checks passed
mergify bot pushed a commit that referenced this pull request Nov 28, 2023
@efd6 @mergify
x-pack/auditbeat/module/socket/guess: fix creds trigger for newer ker…
b2db758 
…nels (#37136)

In kernel commit 981ee95c (into v6.3) calls to access_override_creds
were gated behind a test for the requirement for the call. This change
results in non-execution of prepare_creds and so failure of the guess.

An alternative has been identified that does not exhibit this behaviour,
mq_open which calls dentry_open with creds in the third parameter. So
replace the sys_access trigger with sys_mq_open and add the probe to
dentry_open with P3 for the address.

Approach developed by Christiano Haesbaert.

(cherry picked from commit 284683d)
@mergify mergify bot mentioned this pull request Nov 28, 2023
Merged
zmoog pushed a commit that referenced this pull request Nov 28, 2023
@mergify @efd6
x-pack/auditbeat/module/socket/guess: fix creds trigger for newer ker…
07f52c4 
…nels (#37136) (#37214)

In kernel commit 981ee95c (into v6.3) calls to access_override_creds
were gated behind a test for the requirement for the call. This change
results in non-execution of prepare_creds and so failure of the guess.

An alternative has been identified that does not exhibit this behaviour,
mq_open which calls dentry_open with creds in the third parameter. So
replace the sys_access trigger with sys_mq_open and add the probe to
dentry_open with P3 for the address.

Approach developed by Christiano Haesbaert.

(cherry picked from commit 284683d)

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>
Scholar-Li pushed a commit to Scholar-Li/beats that referenced this pull request Feb 5, 2024
@efd6 @Scholar-Li
x-pack/auditbeat/module/socket/guess: fix creds trigger for newer ker…
3ed590f 
…nels (elastic#37136)

In kernel commit 981ee95c (into v6.3) calls to access_override_creds
were gated behind a test for the requirement for the call. This change
results in non-execution of prepare_creds and so failure of the guess.

An alternative has been identified that does not exhibit this behaviour,
mq_open which calls dentry_open with creds in the third parameter. So
replace the sys_access trigger with sys_mq_open and add the probe to
dentry_open with P3 for the address.

Approach developed by Christiano Haesbaert.
@andrewkroh
Copy link
Member

@Mergifyio backport 7.17

@mergify Mergify
Copy link
Contributor

mergify bot commented Feb 14, 2024 •
edited
Loading

backport 7.17

✅ Backports have been created

mergify bot pushed a commit that referenced this pull request Feb 14, 2024
@efd6 @mergify
x-pack/auditbeat/module/socket/guess: fix creds trigger for newer ker…
c61e4f0 
…nels (#37136)

In kernel commit 981ee95c (into v6.3) calls to access_override_creds
were gated behind a test for the requirement for the call. This change
results in non-execution of prepare_creds and so failure of the guess.

An alternative has been identified that does not exhibit this behaviour,
mq_open which calls dentry_open with creds in the third parameter. So
replace the sys_access trigger with sys_mq_open and add the probe to
dentry_open with P3 for the address.

Approach developed by Christiano Haesbaert.

(cherry picked from commit 284683d)
@mergify mergify bot mentioned this pull request Feb 14, 2024
Merged
andrewkroh pushed a commit that referenced this pull request Feb 16, 2024
@mergify @efd6
x-pack/auditbeat/module/socket/guess: fix creds trigger for newer ker…
a0acfd6 
…nels (backport #37136) (#38027)

In kernel commit 981ee95c (into v6.3) calls to access_override_creds
were gated behind a test for the requirement for the call. This change
results in non-execution of prepare_creds and so failure of the guess.

An alternative has been identified that does not exhibit this behaviour,
mq_open which calls dentry_open with creds in the third parameter. So
replace the sys_access trigger with sys_mq_open and add the probe to
dentry_open with P3 for the address.

Approach developed by Christiano Haesbaert.

(cherry picked from commit 284683d)

---------

Co-authored-by: Dan Kortschak <90160302+efd6@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@haesbaert haesbaert haesbaert approved these changes

@kgeller kgeller kgeller approved these changes

Assignees

@efd6 efd6

Labels
8.12-candidate Auditbeat backport-v8.11.0 Automated backport with mergify bug
Projects
None yet
Milestone
No milestone
5 participants
@efd6 @elasticmachine @andrewkroh @haesbaert @kgeller