iovisor / iovisor/bcc

can't deny access to a specific file

Open
#4,967 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

I want to deny acess to a specific file, for example "exa.txt". But failed. (Testing like this: "vi exa.txt", I can still create it)
Anything wrong in my code?

//my code
from bcc import BPF

prog = """
#include
#include
#include
#include

static int strnkkcmp(char *s1, char *s2, int size) {for (int i = 0; i < size; ++i)
if (s1[i] != s2[i])
return 1;
return 0;
}

int trace_syscall_openat(struct pt_regs *ctx, int dfd, const char __user *filename, int flags)
{
u32 pid = bpf_get_current_pid_tgid() >> 32;
u32 uid = bpf_get_current_uid_gid();

char buf[64];
char searchname[9]="exa.txt";
bpf_probe_read(&buf, sizeof(buf), filename);
buf[sizeof(buf) - 1] = 0;

if (strnkkcmp(buf, searchname, sizeof(searchname)) == 0) {
bpf_trace_printk(" This file is not accessible!\\n");
return -1;
}

return 0;
}

"""

b = BPF(text=prog)
fnname_openat = b.get_syscall_prefix().decode() + 'openat'
b.attach_kprobe(event=fnname_openat, fn_name="trace_syscall_openat")
while True:
try:
b.trace_print()
except KeyboardInterrupt:
exit()

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the Python BCC program and its trace_syscall_openat function, then inspect how the openat kprobe is attached and how the result is used. Reproduce the behavior with vi exa.txt and determine what enforcement mechanism is required for the requested denial; done means attempts to create or open exa.txt are actually rejected.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux, python
Domain
operating-systems, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.