Tetragon ptrace pause

attestation/commandrun/commandrun.go

@@ -16,15 +16,20 @@ package commandrun
 
 import (
 	"bytes"
+	"fmt"
 	"io"
+	"io/ioutil"
 	"os"
 	"os/exec"
+	"runtime"
+	"strings"
 	"syscall"
 	"time"
 
 	"github.com/testifysec/go-witness/attestation"
 	"github.com/testifysec/go-witness/attestation/environment"
 	"github.com/testifysec/go-witness/cryptoutil"
+	"github.com/testifysec/go-witness/log"
 )
 
 const (
@@ -105,6 +110,7 @@ type CommandRun struct {
 	environmentBlockList map[string]struct{}
 	tetragonAddress      string
 	tetragonWatchPrefix  []string
+	cleanedup            bool
 }
 
 type ProcessInfo struct {
@@ -223,33 +229,90 @@ func (r *CommandRun) runCmd(ctx *attestation.AttestationContext) error {
 		enableTracing(c)
 	}
 
-	if err := c.Start(); err != nil {
-		return err
-	}
+	var tc *TraceContext
+
 
 	if r.tetragonAddress != "" {
-		syscall.Kill(c.Process.Pid, syscall.SIGSTOP)
-		tc, err := NewTC(ctx, r, c.Process.Pid)
+		runtime.LockOSThread()
+
+		c.SysProcAttr = &syscall.SysProcAttr{
+			Ptrace: true,
+		}
+
+		log.Debugf("Tetragon enabled, connecting to %s", r.tetragonAddress)
+		if err := c.Start(); err != nil {
+			return err
+		}
+
+		tc, err = NewTC(ctx, r, c.Process.Pid)
 		if err != nil {
 			return err
 		}
+
 		err = tc.Start()
 		if err != nil {
 			return err
 		}
-		defer tc.Stop(r)
-		syscall.Kill(c.Process.Pid, syscall.SIGCONT)
+
+		log.Debugf("Proc PID: %d", c.Process.Pid)
+
+		runtime.UnlockOSThread()
+
+		log.Debugf("Tetragon enabled, waiting for %s", r.tetragonAddress)
+
+		syscall.PtraceDetach(c.Process.Pid)
+		if err != nil {
+			return err
+		}
+
 	}
 
-	if r.enableTracing {
-		t, err := r.trace(c, ctx)
+	// if r.enableTracing {
+	// 	t, err := r.trace(c, ctx)
+	// 	if err != nil {
+	// 		return err
+	// 	}
+	// 	r.Processes = t
+
+	// } else {
+	// 	err := c.Wait()
+	// 	if exitErr, ok := err.(*exec.ExitError); ok {
+	// 		r.ExitCode = exitErr.ExitCode()
+	// 	}
+	// }
+
+	//check if process is running
+	for {
+		procStatus, err := getProcStatus(c.Process.Pid)
 		if err != nil {
 			return err
 		}
-		r.Processes = t
 
-	} else {
-		err := c.Wait()
+		log.Debugf("Proc status: %s", procStatus)
+		if procStatus == "Z" {
+			log.Debugf("Process %d exited", c.Process.Pid)
+
+			//make sure we get all of the exit events
+			time.Sleep(time.Millisecond * 100)
+			err = tc.Stop(r)
+			if err != nil {
+				return err
+			}
+			log.Debugf("Tetragon stopped")
+
+			//wait for all exit events to for dependent processes
+			for {
+				if r.cleanedup {
+					break
+				}
+			}
+			break
+		}
+		time.Sleep(time.Millisecond * 100)
+
+	}
+
+	if err := c.Wait(); err != nil {
 		if exitErr, ok := err.(*exec.ExitError); ok {
 			r.ExitCode = exitErr.ExitCode()
 		}
@@ -260,3 +323,22 @@ func (r *CommandRun) runCmd(ctx *attestation.AttestationContext) error {
 
 	return err
 }
+
+func getProcStatus(pid int) (string, error) {
+	statusFile := fmt.Sprintf("/proc/%d/status", pid)
+	status, err := ioutil.ReadFile(statusFile)
+	if err != nil {
+		return "", err
+	}
+
+	parsedStatus := strings.Split(string(status), "\n")
+	for _, line := range parsedStatus {
+		if strings.HasPrefix(line, "State:") {
+			p := strings.TrimSpace(line[6:])
+			q := strings.Split(p, " ")
+			return q[0], nil
+		}
+	}
+
+	return "", fmt.Errorf("state not found in %s", statusFile)
+}