Add ctty to fork (#195)

Add ctty to fork Since we don't track actual TTY changes, at least make sure a new process gets the correct TTY, previously we were tracking it only on exec which is fine for probably most cases.
elastic · Jun 4, 2024 · 817e105 · 817e105
1 parent 61bdb7f
commit 817e105
Show file tree

Hide file tree

Showing 4 changed files with 7 additions and 0 deletions.
diff --git a/GPL/Events/EbpfEventProto.h b/GPL/Events/EbpfEventProto.h
@@ -213,6 +213,7 @@ struct ebpf_process_fork_event {
     struct ebpf_pid_info parent_pids;
     struct ebpf_pid_info child_pids;
     struct ebpf_cred_info creds;
+    struct ebpf_tty_dev ctty;
     char comm[TASK_COMM_LEN];
 
     // Variable length fields: pids_ss_cgroup_path

diff --git a/GPL/Events/Process/Probe.bpf.c b/GPL/Events/Process/Probe.bpf.c
@@ -15,6 +15,7 @@
 
 #include "Helpers.h"
 #include "PathResolver.h"
+#include "State.h"
 #include "Varlen.h"
 
 /* tty_write */
@@ -56,6 +57,7 @@ int BPF_PROG(sched_process_fork, const struct task_struct *parent, const struct
     ebpf_pid_info__fill(&event->parent_pids, parent);
     ebpf_pid_info__fill(&event->child_pids, child);
     ebpf_cred_info__fill(&event->creds, parent);
+    ebpf_ctty__fill(&event->ctty, child);
     ebpf_comm__fill(event->comm, sizeof(event->comm), child);
 
     // Variable length fields

diff --git a/non-GPL/Events/EventsTrace/EventsTrace.c b/non-GPL/Events/EventsTrace/EventsTrace.c
@@ -752,6 +752,9 @@ static void out_process_fork(struct ebpf_process_fork_event *evt)
     out_cred_info("creds", &evt->creds);
     out_comma();
 
+    out_tty_dev("ctty", &evt->ctty);
+    out_comma();
+
     out_string("comm", evt->comm);
 
     struct ebpf_varlen_field *field;

diff --git a/testing/testrunner/utils.go b/testing/testrunner/utils.go
@@ -93,6 +93,7 @@ type ProcessForkEvent struct {
 	ParentPids PidInfo  `json:"parent_pids"`
 	ChildPids  PidInfo  `json:"child_pids"`
 	Creds      CredInfo `json:"creds"`
+	Ctty       TtyInfo  `json:"ctty"`
 }
 
 type ProcessExecEvent struct {