aquasecurity / aquasecurity/tracee

`symbols_loaded` and `symbols_collision` events work incorrectly with multiple policies

Open
#4,352 1 comment 0 reactions 0 assignees View on GitHub
kind/bug
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

## Description

The derive logic for these events does not take into account cases where multiple policies select the event and specify different sets of symbols or whitelisted libraries.

The current behavior is that the filters for these events are overwritten by the last policy that specifies them:

```go
symbolsLoadedFilters := map[string]filters.Filter[*filters.StringFilter]{}

for it := pManager.CreateAllIterator(); it.HasNext(); {
p := it.Next()
f := p.DataFilter.GetEventFilters(events.SymbolsLoaded)
maps.Copy(symbolsLoadedFilters, f)
}
```

The copy operation overwrites filters from previous policies. This is easy to observe using 2 simple policies that specify different symbols for `symbols_loaded`:

**policy1.yaml**

```yaml
apiVersion: tracee.aquasec.com/v1beta1
kind: Policy
metadata:
name: policy1
spec:
scope:
- global
rules:
- event: symbols_loaded
filters:
- args.symbols=read
```

**policy2.yaml**

```yaml
apiVersion: tracee.aquasec.com/v1beta1
kind: Policy
metadata:
name: policy2
spec:
scope:
- global
rules:
- event: symbols_loaded
filters:
- args.symbols=fopen
```

Running with each policy by itself results in the expected behavior, but when using both:

```
$ sudo dist/tracee --policy policy1.yaml --policy policy2.yaml
TIME UID COMM PID TID RET EVENT ARGS
09:59:19:734864 1000 sh 728898 728898 0 symbols_loaded library_path: /usr/lib/x86_64-linux-gnu/libc.so.6, symbols: [fopen], sha256:
```
Only the `fopen` symbol from the second policy is shown.

Fixing this behavior is not as simple as combining the filters, because the whitelisted libraries of `symbols_loaded` must be taken into account such that an event from a library excluded by one policy will not be excluded completely.

This probably requires some sort of per-policy derive logic, where a separate event or set of events is derived for each policy and only sent to that policy's output (to avoid duplications in cases where the output filter accepts events that were created for a different policy).

## Output of `tracee version`:

```
Tracee version: v0.21.0-rc-261-g30b33a4db
```

Contributor guide

Open the contributing guide

Research direction

Start by tracing the derive logic around pManager.CreateAllIterator and GetEventFilters for symbols_loaded and symbols_collision. Reproduce the issue with the two policy YAML examples, then examine how per-policy outputs and whitelisted libraries affect filtering. Done means multiple policies retain their distinct symbol filters without excluding or duplicating events incorrectly.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.