ROX-34920: track symlink events

CHANGELOG.md

@@ -6,6 +6,7 @@ possible include a PR number for easier tracking.
 
 ## Next
 
+* ROX-34920: track symlink events (#1440)
 * ROX-33036: add mount-related operations (#1059)
 * feat(endpoints): add inodes introspection endpoint (#1273)
 * feat: add --replay mode for JSONL event replay without eBPF (#1010)

fact-ebpf/src/bpf/bound_path.h

@@ -21,39 +21,6 @@ __always_inline static void path_write_char(char* p, unsigned int offset, char c
   *path_safe_access(p, offset) = c;
 }
 
-__always_inline static struct bound_path_t* _path_read(struct path* path, bound_path_buffer_t key, bool use_bpf_d_path) {
-  struct bound_path_t* bound_path = get_bound_path(key);
-  if (bound_path == NULL) {
-    return NULL;
-  }
-
-  bound_path->len = d_path(path, bound_path->path, PATH_MAX, use_bpf_d_path);
-  if (bound_path->len <= 0) {
-    return NULL;
-  }
-
-  // Ensure length is within PATH_MAX for the verifier
-  bound_path->len = PATH_LEN_CLAMP(bound_path->len);
-
-  return bound_path;
-}
-
-__always_inline static struct bound_path_t* path_read_unchecked(struct path* path, bool use_bpf_d_path) {
-  return _path_read(path, BOUND_PATH_MAIN, use_bpf_d_path);
-}
-
-__always_inline static struct bound_path_t* path_read_alt_unchecked(struct path* path, bool use_bpf_d_path) {
-  return _path_read(path, BOUND_PATH_ALTERNATE, use_bpf_d_path);
-}
-
-__always_inline static struct bound_path_t* path_read(struct path* path) {
-  return _path_read(path, BOUND_PATH_MAIN, path_hooks_support_bpf_d_path);
-}
-
-__always_inline static struct bound_path_t* path_read_alt(struct path* path) {
-  return _path_read(path, BOUND_PATH_ALTERNATE, path_hooks_support_bpf_d_path);
-}
-
 enum path_append_status_t {
   PATH_APPEND_SUCCESS = 0,
   PATH_APPEND_INVALID_LENGTH,
@@ -80,26 +47,66 @@ __always_inline static enum path_append_status_t path_append_dentry(struct bound
   return 0;
 }
 
-__always_inline static struct bound_path_t* _path_read_append_d_entry(struct path* dir, struct dentry* dentry, bound_path_buffer_t key) {
-  struct bound_path_t* path = _path_read(dir, key, path_hooks_support_bpf_d_path);
+__always_inline static struct bound_path_t* path_read_into(struct path* path,
+                                                           struct bound_path_t* bound_path,
+                                                           bool use_bpf_d_path) {
+  if (path == NULL || bound_path == NULL) {
+    return NULL;
+  }
+
+  long len = d_path(path, bound_path->path, PATH_MAX, use_bpf_d_path);
+  if (len <= 0) {
+    return NULL;
+  }
+
+  // Ensure length is within PATH_MAX for the verifier
+  bound_path->len = PATH_LEN_CLAMP(len);
 
-  if (path == NULL) {
+  return bound_path;
+}
+
+__always_inline static struct bound_path_t* path_read_into_append_d_entry(struct path* path,
+                                                                          struct dentry* dentry,
+                                                                          struct bound_path_t* bound_path,
+                                                                          bool use_bpf_d_path) {
+  if (path_read_into(path, bound_path, use_bpf_d_path) == NULL) {
     bpf_printk("Failed to read path");
     return NULL;
   }
-  path_write_char(path->path, path->len - 1, '/');
+  path_write_char(bound_path->path, bound_path->len - 1, '/');
 
-  switch (path_append_dentry(path, dentry)) {
+  switch (path_append_dentry(bound_path, dentry)) {
     case PATH_APPEND_SUCCESS:
       break;
     case PATH_APPEND_INVALID_LENGTH:
-      bpf_printk("Invalid path length: %u", path->len);
+      bpf_printk("Invalid path length: %u", bound_path->len);
       return NULL;
     case PATH_APPEND_READ_ERROR:
       bpf_printk("Failed to read final path component");
       return NULL;
   }
-  return path;
+  return bound_path;
+}
+
+__always_inline static struct bound_path_t* _path_read(struct path* path, bound_path_buffer_t key, bool use_bpf_d_path) {
+  struct bound_path_t* bound_path = get_bound_path(key);
+  return path_read_into(path, bound_path, use_bpf_d_path);
+}
+
+__always_inline static struct bound_path_t* path_read_unchecked(struct path* path, bool use_bpf_d_path) {
+  return _path_read(path, BOUND_PATH_MAIN, use_bpf_d_path);
+}
+
+__always_inline static struct bound_path_t* path_read_alt_unchecked(struct path* path, bool use_bpf_d_path) {
+  return _path_read(path, BOUND_PATH_ALTERNATE, use_bpf_d_path);
+}
+
+__always_inline static struct bound_path_t* path_read(struct path* path) {
+  return _path_read(path, BOUND_PATH_MAIN, path_hooks_support_bpf_d_path);
+}
+
+__always_inline static struct bound_path_t* path_read_alt(struct path* path) {
+  return _path_read(path, BOUND_PATH_ALTERNATE, path_hooks_support_bpf_d_path);
 }
 
 /**
@@ -110,7 +117,8 @@ __always_inline static struct bound_path_t* _path_read_append_d_entry(struct pat
  * provides a short way of resolving the full path in one call.
  */
 __always_inline static struct bound_path_t* path_read_append_d_entry(struct path* dir, struct dentry* dentry) {
-  return _path_read_append_d_entry(dir, dentry, BOUND_PATH_MAIN);
+  struct bound_path_t* bound_path = get_bound_path(BOUND_PATH_MAIN);
+  return path_read_into_append_d_entry(dir, dentry, bound_path, path_hooks_support_bpf_d_path);
 }
 
 /**
@@ -121,5 +129,6 @@ __always_inline static struct bound_path_t* path_read_append_d_entry(struct path
  * one path, like path_rename.
  */
 __always_inline static struct bound_path_t* path_read_alt_append_d_entry(struct path* dir, struct dentry* dentry) {
-  return _path_read_append_d_entry(dir, dentry, BOUND_PATH_ALTERNATE);
+  struct bound_path_t* bound_path = get_bound_path(BOUND_PATH_ALTERNATE);
+  return path_read_into_append_d_entry(dir, dentry, bound_path, path_hooks_support_bpf_d_path);
 }

fact-ebpf/src/bpf/events.h

@@ -245,3 +245,16 @@ __always_inline static void submit_move_mount_event(struct submit_event_args_t*
 
   __submit_event(args, false);
 }
+
+__always_inline static void submit_symlink_event(struct submit_event_args_t* args,
+                                                 const char from_filename[PATH_MAX]) {
+  if (!reserve_event(args)) {
+    return;
+  }
+  args->event->type = FILE_ACTIVITY_SYMLINK;
+  if (bpf_probe_read_str(args->event->from.filename, PATH_MAX, from_filename) <= 0) {
+    args->event->from.filename[0] = '\0';
+  }
+
+  __submit_event(args, false);
+}

fact-ebpf/src/bpf/file.h

@@ -42,19 +42,3 @@ __always_inline static monitored_t is_monitored(const inode_key_t* inode, struct
 
   return NOT_MONITORED;
 }
-
-// Check if a new directory should be tracked based on its parent and path.
-// This is used during mkdir operations where the child inode doesn't exist yet.
-__always_inline static monitored_t should_track_mkdir(inode_key_t parent_inode, struct bound_path_t* child_path) {
-  const inode_value_t* volatile parent_value = inode_get(&parent_inode);
-
-  if (parent_value != NULL) {
-    return MONITORED_BY_PARENT;
-  }
-
-  if (path_is_monitored(child_path)) {
-    return MONITORED_BY_PATH;
-  }
-
-  return NOT_MONITORED;
-}

fact-ebpf/src/bpf/main.c

@@ -300,50 +300,33 @@ int BPF_PROG(trace_path_mkdir, struct path* dir, struct dentry* dentry, umode_t
 
   m->path_mkdir.total++;
 
-  struct bound_path_t* path = path_read_append_d_entry(dir, dentry);
-  if (path == NULL) {
+  struct d_instantiate_ctx_t* mkdir_ctx = get_or_insert_d_instantiate_ctx();
+  if (mkdir_ctx == NULL) {
+    bpf_printk("Failed to get d_instantiate context entry");
+    goto error;
+  }
+
+  if (path_read_into_append_d_entry(dir, dentry, &mkdir_ctx->path, path_hooks_support_bpf_d_path) == NULL) {
     bpf_printk("Failed to read path");
-    m->path_mkdir.error++;
-    return 0;
+    goto error;
   }
 
   struct inode* parent_inode_ptr = BPF_CORE_READ(dir, dentry, d_inode);
-  inode_key_t parent_inode = inode_to_key(parent_inode_ptr);
+  mkdir_ctx->parent_inode = inode_to_key(parent_inode_ptr);
 
-  monitored_t monitored = should_track_mkdir(parent_inode, path);
-  if (monitored != MONITORED_BY_PARENT) {
+  mkdir_ctx->monitored = is_monitored(NULL, &mkdir_ctx->path, &mkdir_ctx->parent_inode);
+  if (mkdir_ctx->monitored != MONITORED_BY_PARENT) {
+    delete_d_instantiate_ctx();
     m->path_mkdir.ignored++;
     return 0;
   }
+  mkdir_ctx->event_type = DIR_ACTIVITY_CREATION;
 
-  // Stash mkdir context for security_d_instantiate
-  __u64 pid_tgid = bpf_get_current_pid_tgid();
-  struct mkdir_context_t* mkdir_ctx = bpf_map_lookup_elem(&mkdir_context, &pid_tgid);
-  if (mkdir_ctx == NULL) {
-    static const struct mkdir_context_t empty_ctx = {0};
-    if (bpf_map_update_elem(&mkdir_context, &pid_tgid, &empty_ctx, BPF_NOEXIST) != 0) {
-      bpf_printk("Failed to create mkdir context entry");
-      m->path_mkdir.error++;
-      return 0;
-    }
-    mkdir_ctx = bpf_map_lookup_elem(&mkdir_context, &pid_tgid);
-    if (mkdir_ctx == NULL) {
-      bpf_printk("Failed to lookup mkdir context after creation");
-      m->path_mkdir.error++;
-      return 0;
-    }
-  }
-
-  long path_copy_len = bpf_probe_read_str(mkdir_ctx->path, PATH_MAX, path->path);
-  if (path_copy_len < 0) {
-    bpf_printk("Failed to copy path string");
-    m->path_mkdir.error++;
-    bpf_map_delete_elem(&mkdir_context, &pid_tgid);
-    return 0;
-  }
-  mkdir_ctx->parent_inode = parent_inode;
-  mkdir_ctx->monitored = monitored;
+  return 0;
 
+error:
+  delete_d_instantiate_ctx();
+  m->path_mkdir.error++;
   return 0;
 }
 
@@ -364,28 +347,45 @@ int BPF_PROG(trace_d_instantiate, struct dentry* dentry, struct inode* inode) {
     goto cleanup;
   }
 
-  struct mkdir_context_t* mkdir_ctx = bpf_map_lookup_elem(&mkdir_context, &pid_tgid);
-
-  if (mkdir_ctx == NULL) {
+  struct d_instantiate_ctx_t* d_inst_ctx = get_d_instantiate_ctx();
+  if (d_inst_ctx == NULL || d_inst_ctx->event_type == FILE_ACTIVITY_INIT) {
     args.metrics->ignored++;
     return 0;
   }
-  args.filename = mkdir_ctx->path;
-  args.parent_inode = mkdir_ctx->parent_inode;
-  args.monitored = mkdir_ctx->monitored;
+  args.filename = d_inst_ctx->path.path;
+  args.parent_inode = d_inst_ctx->parent_inode;
+  args.monitored = d_inst_ctx->monitored;
 
   args.inode = inode_to_key(inode);
 
-  if (inode_add(&args.inode) == 0) {
-    args.metrics->added++;
-  } else {
-    args.metrics->error++;
-  }
+  switch (d_inst_ctx->event_type) {
+    case DIR_ACTIVITY_CREATION:
+      if (inode_add(&args.inode) != 0) {
+        args.metrics->error++;
+      }
+
+      submit_mkdir_event(&args);
+      break;
+    case FILE_ACTIVITY_SYMLINK:
+      args.monitored = is_monitored(&args.inode, &d_inst_ctx->path, &args.parent_inode);
+      if (args.monitored == MONITORED_BY_PARENT) {
+        if (inode_add(&args.inode) != 0) {
+          args.metrics->error++;
+        }
+      }
 
-  submit_mkdir_event(&args);
+      if (args.monitored != NOT_MONITORED) {
+        submit_symlink_event(&args, d_inst_ctx->symlink_target);
+      }
+      break;
+    default:
+      bpf_printk("Unexpected event type: %d", d_inst_ctx->event_type);
+      args.metrics->error++;
+      break;
+  }
 
 cleanup:
-  bpf_map_delete_elem(&mkdir_context, &pid_tgid);
+  bpf_map_delete_elem(&d_instantiate_ctx, &pid_tgid);
   return 0;
 }
 
@@ -601,3 +601,38 @@ int BPF_PROG(trace_move_mount, struct path* from, struct path* to) {
   args.metrics->error++;
   return 0;
 }
+
+SEC("lsm/path_symlink")
+int BPF_PROG(trace_path_symlink, struct path* dir, struct dentry* dentry, const char* old_name) {
+  struct metrics_t* m = get_metrics();
+  if (m == NULL) {
+    return 0;
+  }
+  m->path_symlink.total++;
+
+  struct d_instantiate_ctx_t* symlink_ctx = get_or_insert_d_instantiate_ctx();
+  if (symlink_ctx == NULL) {
+    bpf_printk("Failed to get d_instantiate context entry");
+    goto error;
+  }
+
+  if (path_read_into_append_d_entry(dir, dentry, &symlink_ctx->path, path_hooks_support_bpf_d_path) == NULL) {
+    bpf_printk("Failed to read path");
+    goto error;
+  }
+
+  symlink_ctx->parent_inode = inode_to_key(dir->dentry->d_inode);
+  symlink_ctx->event_type = FILE_ACTIVITY_SYMLINK;
+
+  if (bpf_probe_read_str(symlink_ctx->symlink_target, PATH_MAX, old_name) < 0) {
+    bpf_printk("Failed to read old_name");
+    goto error;
+  }
+
+  return 0;
+
+error:
+  delete_d_instantiate_ctx();
+  m->path_symlink.error++;
+  return 0;
+}