readline_events table, capturing shell interaction in real time

Blueprint

This table is able to capture the shell prompt and user input for any running bash instance on the system.

Querying the table would return something similar to this:

 timestamp = 8442831439641
   user_id = 1000
  group_id = 1000
process_id = 10822
 thread_id = 10822
    prompt = alessandro@ubuntu1910-beta:~/Projects/Public/linux$
user_input = git status
      time = 1580830272

How it works

Two BPF programs (one for the enter event, and another one for the exit) are generated at runtime to process data compatible with the function signature we are going to trace.

The programs are then attached to a pair of Uprobe/Uretprobe events that have been setup to perform system-wide tracing of the readline function.

Demo

https://asciinema.org/a/8Ud1Vm5MtfvxRRZUkVMGmuW65

Required dependencies

This new feature would make use of the ebpfpub library to implement function tracing capabilities within osquery using BPF.

The library itself has no dependencies other than the BPF architecture support in the osquery-toolchain. Kernel headers are not required, since this feature makes use of uprobes (the sample would apply to tracepoints).

Start by reviewing the readline function tracing entry and exit points described in the issue, along with the ebpfpub dependency and its Uprobe/Uretprobe support. Done means a new readline_events table captures prompt and user input from running bash instances in real time and exposes the listed process, identity, prompt, input, timestamp, and time fields.