aquasecurity / aquasecurity/tracee

Capture file is overwritten when inode is reused

Open
#2,888 1 comment 0 reactions 0 assignees View on GitHub
area/capture kind/bug priority/backlog
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Description
We noticed that when we capture file writes, we are exposed to duplication of device-inode.
The file system can choose to use inodes of deleted files for the new files generated in it.
This will cause the new file to have the exact same inode-device as the deleted one.
We use the device-inode combination to generate the capture file name, so if a new file is given the same combination we will overwrite the old file capture with the new one.

### Example
We run the following:
```bash
echo a > file
ls -l file
129071 -rw-r--r-- 1 user user 1 Jul 7 11:13 file

rm file
echo b > file
ls -l file
129071 -rw-r--r-- 1 user user 1 Jul 7 11:22 file
```
Lets say the device ID is 12.
We would want Tracee to generate 2 captured files for both files written - one containing 'a' and one 'b'.
However, what we will receive is a single file named `write.dev-12.inode-129071` containing the value 'b'.
This is because the second capture will override the first one, as both are write capture and both have the same device ID and inode ID.

Contributor guide

Open the contributing guide

Research direction

No source file or test is named in the issue. Start by locating Tracee's file-capture naming and write-capture paths, then inspect any existing capture tests; done means creating distinct captures when deleted files and replacement files reuse the same device-inode pair, preserving both contents.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.