Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

added return value of bash module. #52

Merged
merged 1 commit into from
May 3, 2022
Merged

added return value of bash module. #52

merged 1 commit into from
May 3, 2022

Conversation

huzai9527
Copy link
Contributor

the commond which been exec successfully will return 0,otherwhise will return errcode.
image

@cfc4n cfc4n added enhancement New feature or request good first issue Good for newcomers labels May 2, 2022
Copy link
Contributor

@yihong0618 yihong0618 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems need some code format to follow this repo c code style.

kern/bash_kern.c Show resolved Hide resolved
kern/bash_kern.c Show resolved Hide resolved
@cfc4n
Copy link
Member

cfc4n commented May 2, 2022

please fix all issues,and merge all commits into one commit with command

git reset --soft HEAD~3
git commit
git push -f

and This PR will autorefresh

Copy link
Member

@cfc4n cfc4n left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please fix them ,and run make format to format c code before git commit

@@ -104,6 +104,7 @@ func (this *MBashProbe) setupManagers() {
}

this.logger.Printf("HOOK binrayPath:%s, FunctionName:readline\n", binaryPath)
this.logger.Printf("HOOK binrayPath:%s, FunctionName:execute_command\n", binaryPath)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it repeated here? Line 106 and 107

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

107 is another hook, execute_command

{
Section: "uretprobe/bash_retval",
EbpfFuncName: "uretprobe_bash_retval",
AttachToFuncName: "execute_command",
Copy link
Member

@cfc4n cfc4n May 2, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you give some source code about bash return like https://github.com/ehids/ecapture/blob/master/kern/README.md .

Copy link
Contributor Author

@huzai9527 huzai9527 May 2, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you want func_prototype or others?
proto like this

int
execute_command (command)
     COMMAND *command;
{
  struct fd_bitmap *bitmap;
  int result;

  current_fds_to_close = (struct fd_bitmap *)NULL;
  bitmap = new_fd_bitmap (FD_BITMAP_DEFAULT_SIZE);
  begin_unwind_frame ("execute-command");
  add_unwind_protect (dispose_fd_bitmap, (char *)bitmap);

  /* Just do the command, but not asynchronously. */
  result = execute_command_internal (command, 0, NO_PIPE, NO_PIPE, bitmap);

  dispose_fd_bitmap (bitmap);
  discard_unwind_frame ("execute-command");

#if defined (PROCESS_SUBSTITUTION)
  /* don't unlink fifos if we're in a shell function; wait until the function
     returns. */
  if (variable_context == 0)
    unlink_fifo_list ();
#endif /* PROCESS_SUBSTITUTION */

  QUIT;
  return (result);
}

the bash workflow like this

 main()
        |
   reader_loop()       解析
        |--------------------------->read_command()-->parse_command()-->yyparse()-->yylex()-->read_token()-->read_token_word()
        |                                 |                               |                       |                 |
 execute_command() <-------------- current_command <--------------- global_command <------------token------------word
        |
execute_command_internal()
        |
 execute_xxxx_command()
        |
execute_simple_command()
        |
        |--->expand_words()-->expand_word_list_internal()
        |                                                                  子进程
        |------------------------------------->execute_disk_command()------------->shell_execve()-->execve()                
        |                  磁盘命令                       |                |                       |
        |函数及内置命令                              make_child()          |                       |FAILED
        |                                                |                |                       |
execute_builtin_or_function()                          fork()----------->pid                      ->execute_shell_script()
                                                                          |
                                                                          --------->return(result)
                                                                            父进程

@huzai9527
Copy link
Contributor Author

huzai9527 commented May 2, 2022

I have run the command up, is that works? I want to add falgs on bash command which will be used like this sudo ./ecapture bash -err 100, this command will show user which command don't have permisson to run. But i am ambigous about iConfig,i don't konw how to extract flag from submod like bash without using gloable var. can you give me some advice?

@huzai9527
Copy link
Contributor Author

copy that, Do you have any other issues with this PR?

@huzai9527
Copy link
Contributor Author

huzai9527 commented May 3, 2022

I have implemented the command func like sudo ./ecapture bash --err 100 and it's result like this

  • with err flag

image

  • no err flag

image

@cfc4n
Copy link
Member

cfc4n commented May 3, 2022

please merge all commits into one commit. ref: https://www.internalpointers.com/post/squash-commits-into-one-git

@huzai9527
Copy link
Contributor Author

sorry about these commits, I am not familiar with github's instruction, I am trying to merge all commits now.

@cfc4n
Copy link
Member

cfc4n commented May 3, 2022

加下 https://raw.githubusercontent.com/ehids/ecapture/master/images/wechat_gzhh.png 微信公众号,里面回复“微信群”,会给发给你群二维码,我们群里沟通吧。

@huzai9527
Copy link
Contributor Author

群二维码过期啦

Copy link
Member

@cfc4n cfc4n left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cfc4n cfc4n changed the title update about bash,show command resultcode added return value of bash module. May 3, 2022
@cfc4n cfc4n merged commit 06d50a8 into gojue:master May 3, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request good first issue Good for newcomers
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants