-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
added return value of bash module. #52
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
seems need some code format to follow this repo
c code style.
please fix all issues,and merge all commits into one commit with command git reset --soft HEAD~3
git commit
git push -f and This PR will autorefresh |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
please fix them ,and run make format
to format c code before git commit
@@ -104,6 +104,7 @@ func (this *MBashProbe) setupManagers() { | |||
} | |||
|
|||
this.logger.Printf("HOOK binrayPath:%s, FunctionName:readline\n", binaryPath) | |||
this.logger.Printf("HOOK binrayPath:%s, FunctionName:execute_command\n", binaryPath) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Is it repeated here? Line 106 and 107
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
107 is another hook, execute_command
{ | ||
Section: "uretprobe/bash_retval", | ||
EbpfFuncName: "uretprobe_bash_retval", | ||
AttachToFuncName: "execute_command", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can you give some source code about bash return like https://github.com/ehids/ecapture/blob/master/kern/README.md .
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
you want func_prototype or others?
proto like this
int
execute_command (command)
COMMAND *command;
{
struct fd_bitmap *bitmap;
int result;
current_fds_to_close = (struct fd_bitmap *)NULL;
bitmap = new_fd_bitmap (FD_BITMAP_DEFAULT_SIZE);
begin_unwind_frame ("execute-command");
add_unwind_protect (dispose_fd_bitmap, (char *)bitmap);
/* Just do the command, but not asynchronously. */
result = execute_command_internal (command, 0, NO_PIPE, NO_PIPE, bitmap);
dispose_fd_bitmap (bitmap);
discard_unwind_frame ("execute-command");
#if defined (PROCESS_SUBSTITUTION)
/* don't unlink fifos if we're in a shell function; wait until the function
returns. */
if (variable_context == 0)
unlink_fifo_list ();
#endif /* PROCESS_SUBSTITUTION */
QUIT;
return (result);
}
the bash workflow like this
main()
|
reader_loop() 解析
|--------------------------->read_command()-->parse_command()-->yyparse()-->yylex()-->read_token()-->read_token_word()
| | | | |
execute_command() <-------------- current_command <--------------- global_command <------------token------------word
|
execute_command_internal()
|
execute_xxxx_command()
|
execute_simple_command()
|
|--->expand_words()-->expand_word_list_internal()
| 子进程
|------------------------------------->execute_disk_command()------------->shell_execve()-->execve()
| 磁盘命令 | | |
|函数及内置命令 make_child() | |FAILED
| | | |
execute_builtin_or_function() fork()----------->pid ->execute_shell_script()
|
--------->return(result)
父进程
I have run the command up, is that works? I want to add falgs on bash command which will be used like this |
copy that, Do you have any other issues with this PR? |
please merge all commits into one commit. ref: https://www.internalpointers.com/post/squash-commits-into-one-git |
sorry about these commits, I am not familiar with github's instruction, I am trying to merge all commits now. |
加下 https://raw.githubusercontent.com/ehids/ecapture/master/images/wechat_gzhh.png 微信公众号,里面回复“微信群”,会给发给你群二维码,我们群里沟通吧。 |
群二维码过期啦 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
the commond which been exec successfully will return 0,otherwhise will return errcode.