aquasecurity / aquasecurity/tracee
The key `ts` of fd_arg_path_map may be in conflict.
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
## Description
The key `ts` of fd_arg_path_map may be in conflict. If many threads do syscall invoke at the same time, the key of fd_arg_path_map will be conflict, which will lost some fd path.
```
if (f) {
u64 ts = sys->ts;
fd_arg_path_t fd_arg_path = {};
void *file_path = get_path_str(__builtin_preserve_access_index(&f->f_path));
bpf_probe_read_kernel_str(&fd_arg_path.path, sizeof(fd_arg_path.path), file_path);
bpf_map_update_elem(&fd_arg_path_map, &ts, &fd_arg_path, BPF_ANY);
}
}
```
## Output of `tracee version`:
```
Every version, include the latest.
```
## Output of `uname -a`:
```
Linux localhost 5.10.209-android13-4-00013-g2cf4978b8f8c #1 SMP PREEMPT Tue May 28 04:00:35 UTC 2024 aarch64 Toybo
```
## Additional details
Contributor guide
Research direction
The report does not name a source file; start by locating fd_arg_path_map and the syscall invocation path shown in the snippet. Reproduce concurrent invocations on the reported Linux environment and inspect how the timestamp key is generated. Done means concurrent calls no longer overwrite one another's file paths and the relevant regression test passes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100