policylibrary: add a catch all for setuid root and suid execution #1706
Conversation
tixxdz
changed the title
tixxdz
force-pushed
the
pr/tixxdz/policylibrary-setuid-family
branch
from
9d16f3b to
c29634a
Compare
tixxdz
added
the
release-note/minor
tixxdz
force-pushed
the
pr/tixxdz/policylibrary-setuid-family
branch
from
c29634a to
5686f7a
Compare
✅ Deploy Preview for tetragon ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
tixxdz
changed the title
tixxdz
force-pushed
the
pr/tixxdz/policylibrary-setuid-family
branch
2 times, most recently
from
a2fa14f to
963a113
Compare
| Detecting [setuid()](https://www.man7.org/linux/man-pages/man2/setuid.2.html) and [setgid()](https://www.man7.org/linux/man-pages/man2/setgid.2.html) calls that set the user ID or group ID to root is a common | ||
| best-practice to identify when privileges are raised or still elevated. |
There was a problem hiding this comment.
What's the difference between raised or "still elevated"? Should we just keep raised?
There was a problem hiding this comment.
I kept raised for simplicity and let users can parse the events...
We also report case when an already effective uid 0 do setuid(0). For now it is fine, as we don't have the filters based on uids, but this is planned next to reduce noise anyway.
| # - __ia32_sys_setfsgid | ||
| # - __x64_sys_setfsgid16 | ||
| # - __ia32_sys_setfsgid16 | ||
| # |
There was a problem hiding this comment.
do we miss seteuid/setegid ?
There was a problem hiding this comment.
The seteuid/setegid are usually library that call syscall setreuid and setregid which is handled
There was a problem hiding this comment.
hm, but it's still separate syscall right? should we cover any possible way? I might misunderstood the purpose of that spec though
There was a problem hiding this comment.
Hi Jiri so the seteuid/setegid are wrappers https://www.man7.org/linux/man-pages/man2/seteuid.2.html check c library, internally they are calling the real system calls setreuid/setregid (there is no seteuid syscall). In this tracing library we handle all the syscalls around that, if you check, the setreuid/setregid are covered ;-)
Thank you Jiri for the review ;-)
Signed-off-by: Djalal Harouni <[email protected]>
Signed-off-by: Djalal Harouni <[email protected]>
Signed-off-by: Djalal Harouni <[email protected]>
tixxdz
force-pushed
the
pr/tixxdz/policylibrary-setuid-family
branch
from
963a113 to
10b9707
Compare
No description provided.