feat(ebpf): make process_execute_failed not rely on sys_enter/exit

aquasecurity · Aug 5, 2024 · 3a8f7f0 · 3a8f7f0
1 parent 0a32ea2
commit 3a8f7f0
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 4 deletions.
diff --git a/pkg/ebpf/c/tracee.bpf.c b/pkg/ebpf/c/tracee.bpf.c
@@ -4978,13 +4978,15 @@ statfunc int execute_failed_tail2(struct pt_regs *ctx)
     if (!init_tailcall_program_data(&p, ctx))
         return -1;
 
-    syscall_data_t *sys = &p.task_info->syscall_data;
+    struct pt_regs *task_regs = get_task_pt_regs((struct task_struct *) bpf_get_current_task());
+    u64 argv = PT_REGS_PARM2_CORE_SYSCALL(task_regs);
+    u64 envp = PT_REGS_PARM3_CORE_SYSCALL(task_regs);
     save_str_arr_to_buf(
-        &p.event->args_buf, (const char *const *) sys->args.args[1], 10); // userspace argv
+        &p.event->args_buf, (const char *const *) argv, 10); // userspace argv
 
     if (p.config->options & OPT_EXEC_ENV) {
         save_str_arr_to_buf(
-            &p.event->args_buf, (const char *const *) sys->args.args[2], 11); // userspace envp
+            &p.event->args_buf, (const char *const *) envp, 11); // userspace envp
     }
 
     int ret = PT_REGS_RC(ctx); // needs to be int

diff --git a/pkg/events/core.go b/pkg/events/core.go
@@ -12986,7 +12986,6 @@ var CoreEvents = map[ID]Definition{
 			probes: []Probe{
 				{handle: probes.ExecBinprm, required: false},
 				{handle: probes.ExecBinprmRet, required: false},
-				{handle: probes.SyscallEnter__Internal, required: true},
 			},
 			tailCalls: []TailCall{
 				{"prog_array", "trace_execute_failed1", []uint32{TailProcessExecuteFailed1}},