Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

execsnoop missing data for popen #117

Open
MICHALRAT opened this issue Nov 9, 2023 · 0 comments
Open

execsnoop missing data for popen #117

MICHALRAT opened this issue Nov 9, 2023 · 0 comments

Comments

@MICHALRAT
Copy link

MICHALRAT commented Nov 9, 2023

I conducted the following test:

int main() {
    const char* command = "ls -l";    
    FILE* pipe = popen(command, "r");
    if (pipe == NULL) {
        
        return 1;
    }
    pclose(pipe);
    return 0;
}

popen internally calls execl("/bin/sh", "sh", "-c", command, (char *)0);
which calls __execve (path, (char *const *) argv, __environ);, for some reason the internal 'sh -c' process is missing its data as can be seen from the trace_pipe log below, it appears empty:

<...>-77063 [004] .... 693824.892595: sched_process_fork: comm=bash pid=77063 child_comm=bash child_pid=94755
<...>-94755 [005] d... 693824.892959: execsnoop_sys_execve: (SyS_execve+0x0/0x40) arg1="./popen_test" arg2=(fault) arg3=(fault) arg4=(fault) arg5="" arg6=(fault) arg7=(fault) arg8=(fault) arg9=(fault)
<...>-94755 [006] .... 693824.893857: sched_process_fork: comm=popen_test pid=94755 child_comm=popen_test child_pid=94756
 <...>-94756 [007] d... 693824.893981: execsnoop_sys_execve: (SyS_execve+0x0/0x40) arg1=(fault) arg2=(fault) arg3=(fault) arg4=(fault) arg5=(fault) arg6=(fault) arg7=(fault) arg8=(fault) arg9=(fault)
<...>-94756 [000] d... 693824.896085: execsnoop_sys_execve: (SyS_execve+0x0/0x40) arg1="ls" arg2="-l" arg3=(fault) arg4=(fault) arg5=(fault) arg6=(fault) arg7=(fault) arg8=(fault) arg9=(fault)

This happens only form within popen, when I tested execl("/bin/sh", "sh", "-c", command, (char *)0); explicitly the data was traced correctly.
What could be the cause for this issue?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant