mirror of
https://github.com/gravitational/teleport.git
synced 2026-10-25 10:40:02 +08:00
Andrew LeFevreandAndrew LeFevre
7e0e6c9794
* refactor command and disk eBPF programs to fix some events not getting emitted * fixed handling of flags in disk events * remove unused constants to appease linter * handle failing to read filename in enter_execve correctly * added more tests * prevent potential panic if args_len exceed args buffer size * handle empty args in command events correctly * minor changes from feedback * update comments in eBPF files --------- Co-authored-by: Andrew LeFevre <andrewlefevre@goteleport.com>
39 lines
833 B
C
39 lines
833 B
C
#include <fcntl.h>
|
|
#include <string.h>
|
|
#include <unistd.h>
|
|
|
|
int main(int argc, char **argv) {
|
|
if (argc != 2) {
|
|
return 1;
|
|
}
|
|
|
|
const char *successStr = "success";
|
|
if (strncmp(argv[1], successStr, sizeof(successStr)) == 0) {
|
|
if (!fork()) {
|
|
const char *const args[] = {
|
|
"can you see",
|
|
"me?",
|
|
NULL,
|
|
};
|
|
|
|
open("/etc/hostname", O_RDONLY);
|
|
execv("/usr/bin/echo", (char *const *)args);
|
|
}
|
|
|
|
return 0;
|
|
} else {
|
|
if (!fork()) {
|
|
const char *const args[] = {
|
|
"this should",
|
|
"fail.",
|
|
NULL,
|
|
};
|
|
|
|
open("/who/now", O_RDONLY);
|
|
execv("whereami", (char *const *)args);
|
|
}
|
|
|
|
return 42;
|
|
}
|
|
}
|