diff --git a/driver/syscall_table.c b/driver/syscall_table.c index 4ccf144c24..c9e0c15b92 100644 --- a/driver/syscall_table.c +++ b/driver/syscall_table.c @@ -437,6 +437,12 @@ const struct syscall_evt_pair g_syscall_table[SYSCALL_TABLE_SIZE] = { #endif #ifdef __NR_delete_module [__NR_delete_module - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_DELETE_MODULE_E, PPME_SYSCALL_DELETE_MODULE_X, PPM_SC_DELETE_MODULE}, +#endif +#ifdef __NR_setreuid + [__NR_setreuid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETREUID_E, PPME_SYSCALL_SETREUID_X, PPM_SC_SETREUID}, +#endif +#ifdef __NR_setregid + [__NR_setregid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETREGID_E, PPME_SYSCALL_SETREGID_X, PPM_SC_SETREGID}, #endif [__NR_restart_syscall - SYSCALL_TABLE_ID0] = { .ppm_sc = PPM_SC_RESTART_SYSCALL }, [__NR_exit - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_EXIT}, @@ -505,13 +511,6 @@ const struct syscall_evt_pair g_syscall_table[SYSCALL_TABLE_SIZE] = { [__NR_rt_sigqueueinfo - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_RT_SIGQUEUEINFO}, [__NR_rt_sigsuspend - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_RT_SIGSUSPEND}, [__NR_capget - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_CAPGET}, - -#ifdef __NR_setreuid - [__NR_setreuid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETREUID_E, PPME_SYSCALL_SETREUID_X, PPM_SC_SETREUID}, -#endif -#ifdef __NR_setregid - [__NR_setregid - SYSCALL_TABLE_ID0] = {UF_USED, PPME_SYSCALL_SETREGID_E, PPME_SYSCALL_SETREGID_X, PPM_SC_SETREGID}, -#endif [__NR_getgroups - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_GETGROUPS}, [__NR_setgroups - SYSCALL_TABLE_ID0] = {.ppm_sc = PPM_SC_SETGROUPS}, #ifdef __NR_fchown diff --git a/userspace/libsinsp/parsers.cpp b/userspace/libsinsp/parsers.cpp index 70f7d5cbc9..76c80d649b 100644 --- a/userspace/libsinsp/parsers.cpp +++ b/userspace/libsinsp/parsers.cpp @@ -4903,14 +4903,15 @@ void sinsp_parser::parse_setresuid_exit(sinsp_evt *evt) // retval = evt->get_param(0)->as(); - if(retval >= 0 && retrieve_enter_event(enter_evt, evt)) + if(retval == 0 && retrieve_enter_event(enter_evt, evt)) { uint32_t new_euid = enter_evt->get_param(1)->as(); if(new_euid < std::numeric_limits::max()) { - if (evt->get_thread_info()) { - evt->get_thread_info()->set_user(new_euid); + sinsp_threadinfo* ti = evt->get_thread_info(); + if (ti) { + ti->set_user(new_euid); } } } @@ -4925,14 +4926,15 @@ void sinsp_parser::parse_setreuid_exit(sinsp_evt *evt) // retval = evt->get_param(0)->as(); - if(retval >= 0) + if(retval == 0) { uint32_t new_euid = evt->get_param(1)->as(); if(new_euid < std::numeric_limits::max()) { - if (evt->get_thread_info()) { - evt->get_thread_info()->set_user(new_euid); + sinsp_threadinfo* ti = evt->get_thread_info(); + if (ti) { + ti->set_user(new_euid); } } } @@ -4948,14 +4950,15 @@ void sinsp_parser::parse_setresgid_exit(sinsp_evt *evt) // retval = evt->get_param(0)->as(); - if(retval >= 0 && retrieve_enter_event(enter_evt, evt)) + if(retval == 0 && retrieve_enter_event(enter_evt, evt)) { uint32_t new_egid = enter_evt->get_param(1)->as(); if(new_egid < std::numeric_limits::max()) { - if (evt->get_thread_info()) { - evt->get_thread_info()->set_group(new_egid); + sinsp_threadinfo* ti = evt->get_thread_info(); + if (ti) { + ti->set_group(new_egid); } } } @@ -4970,14 +4973,15 @@ void sinsp_parser::parse_setregid_exit(sinsp_evt *evt) // retval = evt->get_param(0)->as(); - if(retval >= 0) + if(retval == 0) { uint32_t new_egid = evt->get_param(1)->as(); if(new_egid < std::numeric_limits::max()) { - if (evt->get_thread_info()) { - evt->get_thread_info()->set_group(new_egid); + sinsp_threadinfo* ti = evt->get_thread_info(); + if (ti) { + ti->set_group(new_egid); } } } @@ -4993,11 +4997,12 @@ void sinsp_parser::parse_setuid_exit(sinsp_evt *evt) // retval = evt->get_param(0)->as(); - if(retval >= 0 && retrieve_enter_event(enter_evt, evt)) + if(retval == 0 && retrieve_enter_event(enter_evt, evt)) { uint32_t new_euid = enter_evt->get_param(0)->as(); - if (evt->get_thread_info()) { - evt->get_thread_info()->set_user(new_euid); + sinsp_threadinfo* ti = evt->get_thread_info(); + if (ti) { + ti->set_user(new_euid); } } } @@ -5012,11 +5017,12 @@ void sinsp_parser::parse_setgid_exit(sinsp_evt *evt) // retval = evt->get_param(0)->as(); - if(retval >= 0 && retrieve_enter_event(enter_evt, evt)) + if(retval == 0 && retrieve_enter_event(enter_evt, evt)) { uint32_t new_egid = enter_evt->get_param(0)->as(); - if (evt->get_thread_info()) { - evt->get_thread_info()->set_group(new_egid); + sinsp_threadinfo* ti = evt->get_thread_info(); + if (ti) { + ti->set_group(new_egid); } } }