How to fetch certain fields as part of fsuid and euid

[Engg-blogger]

Hi Team - I am working on writing a bt script to fetch the fsuid, euid, fsguid and egid through kernel probes and with the examples in the tools section. I want to use fetch the filesystem user name, group name, effective user and group name. I am not able to find the probes or command examples that can provide me that info. "getent" command can give me this information, but I am not sure if it is supported in bt script. Could you please guide me?

[jordalgo]

Other folks might know more but the best we have right now is the system function which lets you execute arbitrary commands but it doesn't allow you to store the user name, for example, in any variables accessible to other parts of the bpftrace program. https://github.com/bpftrace/bpftrace/blob/master/man/adoc/bpftrace.adoc#system

[Engg-blogger]

ok.. i would not be running this in --unsafe mode. So will look at other options. But is there a way to get the cwd of the executable without using system command?

[viktormalik]

You can access pwd entry from task_struct via curtask->fs->pwd but if you want the full path name, you'd have to dig it out (I'm not even sure if that's possible in a BPF program).

[Engg-blogger]

how to print this value. I am getting curtask->fs->pwd { .mnt = oxff-----, .dentry = oxff}

[viktormalik]

Is there a reason why you can't use fsuid/euid/fsgid/egid in the bpftrace script and then do the id -> name translation afterwards in some post-processing step? I don't think that the translation can be done synchronously in the BPF program anyways.

[Engg-blogger]

@viktormalik id command need to be run in system function, which requires --unsafe operation. I don't think we want to enable unsafe in prod environment.

[fbs]

The suggestion here is to do something like:

bpftrace --output=json ./script.bt | python3 uid-to-name.py

the bpftrace part outputs the UID, as the kernel doesn't know user names. The python script handles the conversion. It can be something like:

import sys
import json
import pwd

for line in sys.stdin:
    data = json.loads(line)
    data['username'] = pwd.getpwuid(int(data['uid'])).pw_name
    print(json.dumps(data))

Another option would be to dynamically generate the bpftrace script to insert all uids in a map, e.g.

BEGIN {
   @users[0] = "root"
   @users[1] = "sshd"
   ...