68 lines
1.8 KiB
Plaintext
Executable File
68 lines
1.8 KiB
Plaintext
Executable File
#!/usr/bin/env bpftrace
|
|
/*
|
|
* setuids - Trace the setuid syscalls: privilege escalation.
|
|
*
|
|
* See BPF Performance Tools, Chapter 11, for an explanation of this tool.
|
|
*
|
|
* Copyright (c) 2019 Brendan Gregg.
|
|
* Licensed under the Apache License, Version 2.0 (the "License").
|
|
* This was originally created for the BPF Performance Tools book
|
|
* published by Addison Wesley. ISBN-13: 9780136554820
|
|
* When copying or porting, include this comment.
|
|
*
|
|
* 26-Feb-2019 Brendan Gregg Created this.
|
|
*/
|
|
|
|
BEGIN
|
|
{
|
|
printf("Tracing setuid(2) family syscalls. Hit Ctrl-C to end.\n");
|
|
printf("%-8s %-6s %-16s %-6s %-9s %s\n", "TIME",
|
|
"PID", "COMM", "UID", "SYSCALL", "ARGS (RET)");
|
|
}
|
|
|
|
tracepoint:syscalls:sys_enter_setuid,
|
|
tracepoint:syscalls:sys_enter_setfsuid
|
|
{
|
|
@uid[tid] = uid;
|
|
@setuid[tid] = args.uid;
|
|
@seen[tid] = 1;
|
|
}
|
|
|
|
tracepoint:syscalls:sys_enter_setresuid
|
|
{
|
|
@uid[tid] = uid;
|
|
@ruid[tid] = args.ruid;
|
|
@euid[tid] = args.euid;
|
|
@suid[tid] = args.suid;
|
|
@seen[tid] = 1;
|
|
}
|
|
|
|
tracepoint:syscalls:sys_exit_setuid
|
|
/@seen[tid]/
|
|
{
|
|
time("%H:%M:%S ");
|
|
printf("%-6d %-16s %-6d setuid uid=%d (%d)\n", pid, comm,
|
|
@uid[tid], @setuid[tid], args.ret);
|
|
delete(@seen[tid]); delete(@uid[tid]); delete(@setuid[tid]);
|
|
}
|
|
|
|
tracepoint:syscalls:sys_exit_setfsuid
|
|
/@seen[tid]/
|
|
{
|
|
time("%H:%M:%S ");
|
|
printf("%-6d %-16s %-6d setfsuid uid=%d (prevuid=%d)\n", pid, comm,
|
|
@uid[tid], @setuid[tid], args.ret);
|
|
delete(@seen[tid]); delete(@uid[tid]); delete(@setuid[tid]);
|
|
}
|
|
|
|
tracepoint:syscalls:sys_exit_setresuid
|
|
/@seen[tid]/
|
|
{
|
|
time("%H:%M:%S ");
|
|
printf("%-6d %-16s %-6d setresuid ", pid, comm, @uid[tid]);
|
|
printf("ruid=%d euid=%d suid=%d (%d)\n", @ruid[tid], @euid[tid],
|
|
@suid[tid], args.ret);
|
|
delete(@seen[tid]); delete(@uid[tid]); delete(@ruid[tid]);
|
|
delete(@euid[tid]); delete(@suid[tid]);
|
|
}
|