aquasecurity / aquasecurity/tracee
security_inode_unlink - Pathname is relative to mount
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
## Description
The security_inode_unlink event appears with a path that is relative for its mount
Example:
`rm /home/jenkins/agent_home/workspace/Integrity E2E/Jenkins/ori`
Event:
```
TIME UID COMM PID TID RET EVENT ARGS
14:40:35:896963 0 rm 1448617 1448617 0 security_inode_unlink pathname: /workspace/Integrity E2E/Jenkins/ori, inode: 335675238, dev: 271581188, ctime: 1679841629319867850
```
## Output of `tracee -v`:
```
Tracee version "v0.12.0"
```
## Output of `uname -a`:
```
Linux ip-10-0-2-214 5.15.0-1015-aws #19-Ubuntu SMP Wed Jun 22 17:44:56 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
```
Contributor guide
Research direction
Start by reproducing the security_inode_unlink event from the reported rm command on Linux 5.15 with Tracee v0.12.0, then trace how its pathname is produced. Done means the event reports the expected full pathname rather than a path relative to its mount; add or update coverage where the event handling is tested if such coverage is found.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100