fix(events): pick syscall_pathname for execve(at) syscalls (#3298)

syscall_pathname was fetched only for open(at) syscalls, thus was empty for security_file_open originated from execve(at) syscall.
aquasecurity · Jul 11, 2023 · 48c2d97 · 48c2d97
1 parent 9c4dd04
commit 48c2d97
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/pkg/ebpf/c/tracee.bpf.c b/pkg/ebpf/c/tracee.bpf.c
@@ -1974,9 +1974,12 @@ int BPF_KPROBE(trace_security_file_open)
     if (syscall_traced) {
         sys = &p.task_info->syscall_data;
         switch (sys->id) {
+            case SYSCALL_EXECVE:
             case SYSCALL_OPEN:
                 syscall_pathname = (void *) sys->args.args[0];
                 break;
+
+            case SYSCALL_EXECVEAT:
             case SYSCALL_OPENAT:
             case SYSCALL_OPENAT2:
                 syscall_pathname = (void *) sys->args.args[1];