aquasecurity / aquasecurity/tracee
`symbols_loaded` and `symbols_collision` events work incorrectly with multiple policies
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
## Description
The derive logic for these events does not take into account cases where multiple policies select the event and specify different sets of symbols or whitelisted libraries.
The current behavior is that the filters for these events are overwritten by the last policy that specifies them:
```go
symbolsLoadedFilters := map[string]filters.Filter[*filters.StringFilter]{}
for it := pManager.CreateAllIterator(); it.HasNext(); {
p := it.Next()
f := p.DataFilter.GetEventFilters(events.SymbolsLoaded)
maps.Copy(symbolsLoadedFilters, f)
}
```
The copy operation overwrites filters from previous policies. This is easy to observe using 2 simple policies that specify different symbols for `symbols_loaded`:
**policy1.yaml**
```yaml
apiVersion: tracee.aquasec.com/v1beta1
kind: Policy
metadata:
name: policy1
spec:
scope:
- global
rules:
- event: symbols_loaded
filters:
- args.symbols=read
```
**policy2.yaml**
```yaml
apiVersion: tracee.aquasec.com/v1beta1
kind: Policy
metadata:
name: policy2
spec:
scope:
- global
rules:
- event: symbols_loaded
filters:
- args.symbols=fopen
```
Running with each policy by itself results in the expected behavior, but when using both:
```
$ sudo dist/tracee --policy policy1.yaml --policy policy2.yaml
TIME UID COMM PID TID RET EVENT ARGS
09:59:19:734864 1000 sh 728898 728898 0 symbols_loaded library_path: /usr/lib/x86_64-linux-gnu/libc.so.6, symbols: [fopen], sha256:
```
Only the `fopen` symbol from the second policy is shown.
Fixing this behavior is not as simple as combining the filters, because the whitelisted libraries of `symbols_loaded` must be taken into account such that an event from a library excluded by one policy will not be excluded completely.
This probably requires some sort of per-policy derive logic, where a separate event or set of events is derived for each policy and only sent to that policy's output (to avoid duplications in cases where the output filter accepts events that were created for a different policy).
## Output of `tracee version`:
```
Tracee version: v0.21.0-rc-261-g30b33a4db
```
Contributor guide
Research direction
Start by tracing the derive logic around pManager.CreateAllIterator and GetEventFilters for symbols_loaded and symbols_collision. Reproduce the issue with the two policy YAML examples, then examine how per-policy outputs and whitelisted libraries affect filtering. Done means multiple policies retain their distinct symbol filters without excluding or duplicating events incorrectly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100