Skip to content

Commit

Permalink
update(pkg/runner/helper): SpawnAsWithSymlink and SpawnAs to copy the…
Browse files Browse the repository at this point in the history
… binary

This can be used to trigger rules that are based on proc.exepath rather than proc.name
for better detection purposes.

Signed-off-by: Lorenzo Susini <susinilorenzo1@gmail.com>
  • Loading branch information
loresuso authored and poiana committed Apr 9, 2024
1 parent b09fc0f commit 939b3e0
Show file tree
Hide file tree
Showing 8 changed files with 32 additions and 8 deletions.
6 changes: 6 additions & 0 deletions events/interfaces.go
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,14 @@ type Helper interface {

// SpawnAs starts a child process and waits for it to complete.
// The child runs the given action as a different program name.
// The current event-generator binary is copied with a differen name
// prior to be run.
SpawnAs(name string, action string, args ...string) error

// SpawnAsWithSymlink works like SpawnAs, except that it does not make a
// copy of the the current event-generator binary, but creates a symlink instead.
SpawnAsWithSymlink(name string, action string, args ...string) error

// Spawned returns true if the action is running in a child process.
Spawned() bool

Expand Down
2 changes: 1 addition & 1 deletion events/syscall/db_program_spawned_process.go
Original file line number Diff line number Diff line change
Expand Up @@ -25,5 +25,5 @@ var _ = events.Register(
)

func DbProgramSpawnedProcess(h events.Helper) error {
return h.SpawnAs("mysqld", "helper.ExecLs")
return h.SpawnAsWithSymlink("mysqld", "helper.ExecLs")
}
2 changes: 1 addition & 1 deletion events/syscall/non_sudo_setuid.go
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,6 @@ func NonSudoSetuid(h events.Helper) error {
h.Log().WithError(err).Debug("ignore root setuid error")
return nil
} else {
return h.SpawnAs("child", "syscall.NonSudoSetuid")
return h.SpawnAsWithSymlink("child", "syscall.NonSudoSetuid")
}
}
Original file line number Diff line number Diff line change
Expand Up @@ -21,5 +21,5 @@ import (
var _ = events.Register(ReadSensitiveFileTrustedAfterStartup)

func ReadSensitiveFileTrustedAfterStartup(h events.Helper) error {
return h.SpawnAs("httpd", "syscall.ReadSensitiveFileUntrusted", "--sleep", "6s")
return h.SpawnAsWithSymlink("httpd", "syscall.ReadSensitiveFileUntrusted", "--sleep", "6s")
}
2 changes: 1 addition & 1 deletion events/syscall/run_shell_untrusted.go
Original file line number Diff line number Diff line change
Expand Up @@ -22,5 +22,5 @@ import (
var _ = events.Register(RunShellUntrusted)

func RunShellUntrusted(h events.Helper) error {
return h.SpawnAs("httpd", "helper.RunShell")
return h.SpawnAsWithSymlink("httpd", "helper.RunShell")
}
2 changes: 1 addition & 1 deletion events/syscall/system_procs_network_activity.go
Original file line number Diff line number Diff line change
Expand Up @@ -25,5 +25,5 @@ var _ = events.Register(
)

func SystemProcsNetworkActivity(h events.Helper) error {
return h.SpawnAs("sha1sum", "helper.NetworkActivity")
return h.SpawnAsWithSymlink("sha1sum", "helper.NetworkActivity")
}
2 changes: 1 addition & 1 deletion events/syscall/user_mgmt_binaries.go
Original file line number Diff line number Diff line change
Expand Up @@ -32,5 +32,5 @@ func UserMgmtBinaries(h events.Helper) error {
Reason: "'User mgmt binaries' is excluded in containers",
}
}
return h.SpawnAs("vipw", "helper.ExecLs")
return h.SpawnAsWithSymlink("vipw", "helper.ExecLs")
}
22 changes: 20 additions & 2 deletions pkg/runner/helper.go
Original file line number Diff line number Diff line change
Expand Up @@ -80,6 +80,14 @@ func (h *helper) Cleanup(f func(), args ...interface{}) {
}

func (h *helper) SpawnAs(name string, action string, args ...string) error {
return h.spawnAs(name, action, true, args...)
}

func (h *helper) SpawnAsWithSymlink(name string, action string, args ...string) error {
return h.spawnAs(name, action, false, args...)
}

func (h *helper) spawnAs(name string, action string, copy bool, args ...string) error {
fullArgs := append([]string{fmt.Sprintf("^%s$", action)}, args...)
h.Log().WithField("args", strings.Join(fullArgs, " ")).Infof(`spawn as "%s"`, name)
if h.Spawned() {
Expand All @@ -92,8 +100,18 @@ func (h *helper) SpawnAs(name string, action string, args ...string) error {
defer os.RemoveAll(tmpDir)

name = filepath.Join(tmpDir, name)
if err := os.Symlink(h.runner.exePath, name); err != nil {
return err
if copy {
var data []byte
if data, err = os.ReadFile(h.runner.exePath); err != nil {
return err
}
if err = os.WriteFile(name, data, 0755); err != nil {
return err
}
} else {
if err := os.Symlink(h.runner.exePath, name); err != nil {
return err
}
}

cmd := exec.Command(name, append(h.runner.exeArgs, fullArgs...)...)
Expand Down

0 comments on commit 939b3e0

Please sign in to comment.