aquasecurity / aquasecurity/tracee
Capture file is overwritten when inode is reused
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
## Description
We noticed that when we capture file writes, we are exposed to duplication of device-inode.
The file system can choose to use inodes of deleted files for the new files generated in it.
This will cause the new file to have the exact same inode-device as the deleted one.
We use the device-inode combination to generate the capture file name, so if a new file is given the same combination we will overwrite the old file capture with the new one.
### Example
We run the following:
```bash
echo a > file
ls -l file
129071 -rw-r--r-- 1 user user 1 Jul 7 11:13 file
rm file
echo b > file
ls -l file
129071 -rw-r--r-- 1 user user 1 Jul 7 11:22 file
```
Lets say the device ID is 12.
We would want Tracee to generate 2 captured files for both files written - one containing 'a' and one 'b'.
However, what we will receive is a single file named `write.dev-12.inode-129071` containing the value 'b'.
This is because the second capture will override the first one, as both are write capture and both have the same device ID and inode ID.
Contributor guide
Research direction
No source file or test is named in the issue. Start by locating Tracee's file-capture naming and write-capture paths, then inspect any existing capture tests; done means creating distinct captures when deleted files and replacement files reuse the same device-inode pair, preserving both contents.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100