aquasecurity / aquasecurity/tracee

security_inode_unlink - Pathname is relative to mount

Open
#2,920 0 comments 0 reactions 0 assignees View on GitHub
kind/bug priority/backlog
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Description

The security_inode_unlink event appears with a path that is relative for its mount
Example:
`rm /home/jenkins/agent_home/workspace/Integrity E2E/Jenkins/ori`

Event:
```
TIME UID COMM PID TID RET EVENT ARGS
14:40:35:896963 0 rm 1448617 1448617 0 security_inode_unlink pathname: /workspace/Integrity E2E/Jenkins/ori, inode: 335675238, dev: 271581188, ctime: 1679841629319867850
```

## Output of `tracee -v`:

```
Tracee version "v0.12.0"
```

## Output of `uname -a`:

```
Linux ip-10-0-2-214 5.15.0-1015-aws #19-Ubuntu SMP Wed Jun 22 17:44:56 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
```

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the security_inode_unlink event from the reported rm command on Linux 5.15 with Tracee v0.12.0, then trace how its pathname is produced. Done means the event reports the expected full pathname rather than a path relative to its mount; add or update coverage where the event handling is tested if such coverage is found.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.