Jv rox 33034 track xattr changes test all events

fact-ebpf/src/bpf/events.h

@@ -37,7 +37,11 @@ __always_inline static void __submit_event(struct submit_event_args_t* args,
  event->monitored = args->monitored;
  inode_copy(&event->inode, &args->inode);
  inode_copy(&event->parent_inode, &args->parent_inode);
- bpf_probe_read_str(event->filename, PATH_MAX, args->filename);
+ if (args->filename != NULL) {
+ bpf_probe_read_str(event->filename, PATH_MAX, args->filename);
+ } else {
+ event->filename[0] = '\0';
+ }
 
  struct helper_t* helper = get_helper();
  if (helper == NULL) {
@@ -144,3 +148,15 @@ __always_inline static void submit_rmdir_event(struct submit_event_args_t* args)
 
  __submit_event(args, path_hooks_support_bpf_d_path);
 }
+
+__always_inline static void submit_xattr_event(struct submit_event_args_t* args,
+ file_activity_type_t event_type,
+ const char* xattr_name) {
+ if (!reserve_event(args)) {
+ return;
+ }
+ args->event->type = event_type;
+ bpf_probe_read_str(args->event->xattr.name, XATTR_NAME_MAX_LEN, xattr_name);
+
+ __submit_event(args, false);
+}

fact-ebpf/src/bpf/main.c

@@ -389,6 +389,48 @@ int BPF_PROG(trace_d_instantiate, struct dentry* dentry, struct inode* inode) {
  return 0;
 }
 
+__always_inline static int handle_xattr(struct metrics_by_hook_t* hook_metrics,
+ struct dentry* dentry,
+ const char* xattr_name,
+ file_activity_type_t event_type) {
+ struct submit_event_args_t args = {.metrics = hook_metrics};
+
+ args.metrics->total++;
+
+ args.inode = inode_to_key(dentry->d_inode);
+ args.parent_inode = inode_to_key(BPF_CORE_READ(dentry, d_parent, d_inode));
+
+ args.monitored = inode_is_monitored(inode_get(&args.inode), inode_get(&args.parent_inode));
+
+ if (args.monitored == NOT_MONITORED) {
+ args.metrics->ignored++;
+ return 0;
+ }
+
+ submit_xattr_event(&args, event_type, xattr_name);
+ return 0;
+}
+
+SEC("lsm/inode_setxattr")
+int BPF_PROG(trace_inode_setxattr, struct mnt_idmap* idmap, struct dentry* dentry,
+ const char* name, const void* value, size_t size, int flags) {
+ struct metrics_t* m = get_metrics();
+ if (m == NULL) {
+ return 0;
+ }
+ return handle_xattr(&m->inode_setxattr, dentry, name, FILE_ACTIVITY_SETXATTR);
+}
+
+SEC("lsm/inode_removexattr")
+int BPF_PROG(trace_inode_removexattr, struct mnt_idmap* idmap, struct dentry* dentry,
+ const char* name) {
+ struct metrics_t* m = get_metrics();
+ if (m == NULL) {
+ return 0;
+ }
+ return handle_xattr(&m->inode_removexattr, dentry, name, FILE_ACTIVITY_REMOVEXATTR);
+}
+
 SEC("lsm/path_rmdir")
 int BPF_PROG(trace_path_rmdir, struct path* dir, struct dentry* dentry) {
  struct metrics_t* m = get_metrics();

fact-ebpf/src/bpf/types.h

@@ -15,6 +15,10 @@
 
 #define LINEAGE_MAX 2
 
+// Matches Linux kernel XATTR_NAME_MAX (255) + null terminator.
+// https://github.com/torvalds/linux/blob/66affa37cfac0aec061cc4bcf4a065b0c52f7e19/include/uapi/linux/limits.h#L15
+#define XATTR_NAME_MAX_LEN 256
+
 #define LPM_SIZE_MAX 256
 
 typedef struct lineage_t {
@@ -64,6 +68,8 @@ typedef enum file_activity_type_t {
  FILE_ACTIVITY_RENAME,
  DIR_ACTIVITY_CREATION,
  DIR_ACTIVITY_UNLINK,
+ FILE_ACTIVITY_SETXATTR,
+ FILE_ACTIVITY_REMOVEXATTR,
 } file_activity_type_t;
 
 struct event_t {
@@ -90,6 +96,9 @@ struct event_t {
  inode_key_t inode;
  monitored_t monitored;
  } rename;
+ struct {
+ char name[XATTR_NAME_MAX_LEN];
+ } xattr;
  };
 };
 
@@ -132,4 +141,6 @@ struct metrics_t {
  struct metrics_by_hook_t path_mkdir;
  struct metrics_by_hook_t d_instantiate;
  struct metrics_by_hook_t path_rmdir;
+ struct metrics_by_hook_t inode_setxattr;
+ struct metrics_by_hook_t inode_removexattr;
 };

fact/src/event/mod.rs

@@ -9,7 +9,9 @@ use std::{
 use globset::GlobSet;
 use serde::Serialize;
 
-use fact_ebpf::{PATH_MAX, event_t, file_activity_type_t, inode_key_t, monitored_t};
+use fact_ebpf::{
+ PATH_MAX, XATTR_NAME_MAX_LEN, event_t, file_activity_type_t, inode_key_t, monitored_t,
+};
 
 use crate::host_info;
 use process::Process;
@@ -131,6 +133,10 @@ impl Event {
  matches!(self.file, FileData::Creation(_) | FileData::MkDir(_))
  }
 
+ pub fn is_xattr(&self) -> bool {
+ matches!(self.file, FileData::SetXattr(_) | FileData::RemoveXattr(_))
+ }
+
  pub fn is_mkdir(&self) -> bool {
  matches!(self.file, FileData::MkDir(_))
  }
@@ -162,6 +168,8 @@ impl Event {
  FileData::Chmod(data) => &data.inner.inode,
  FileData::Chown(data) => &data.inner.inode,
  FileData::Rename(data) => &data.new.inode,
+ FileData::SetXattr(data) => &data.inner.inode,
+ FileData::RemoveXattr(data) => &data.inner.inode,
  }
  }
 
@@ -176,6 +184,8 @@ impl Event {
  FileData::Chmod(data) => &data.inner.parent_inode,
  FileData::Chown(data) => &data.inner.parent_inode,
  FileData::Rename(data) => &data.new.parent_inode,
+ FileData::SetXattr(data) => &data.inner.parent_inode,
+ FileData::RemoveXattr(data) => &data.inner.parent_inode,
  }
  }
 
@@ -199,6 +209,8 @@ impl Event {
  FileData::Chmod(data) => &data.inner.filename,
  FileData::Chown(data) => &data.inner.filename,
  FileData::Rename(data) => &data.new.filename,
+ FileData::SetXattr(data) => &data.inner.filename,
+ FileData::RemoveXattr(data) => &data.inner.filename,
  }
  }
 
@@ -219,6 +231,8 @@ impl Event {
  FileData::Chmod(data) => &data.inner.host_file,
  FileData::Chown(data) => &data.inner.host_file,
  FileData::Rename(data) => &data.new.host_file,
+ FileData::SetXattr(data) => &data.inner.host_file,
+ FileData::RemoveXattr(data) => &data.inner.host_file,
  }
  }
 
@@ -243,6 +257,8 @@ impl Event {
  FileData::Chmod(data) => data.inner.host_file = host_path,
  FileData::Chown(data) => data.inner.host_file = host_path,
  FileData::Rename(data) => data.new.host_file = host_path,
+ FileData::SetXattr(data) => data.inner.host_file = host_path,
+ FileData::RemoveXattr(data) => data.inner.host_file = host_path,
  }
  }
 
@@ -264,6 +280,8 @@ impl Event {
  FileData::Chmod(data) => data.inner.monitored,
  FileData::Chown(data) => data.inner.monitored,
  FileData::Rename(data) => data.new.monitored,
+ FileData::SetXattr(data) => data.inner.monitored,
+ FileData::RemoveXattr(data) => data.inner.monitored,
  }
  }
 
@@ -356,6 +374,8 @@ pub enum FileData {
  Chmod(ChmodFileData),
  Chown(ChownFileData),
  Rename(RenameFileData),
+ SetXattr(XattrFileData),
+ RemoveXattr(XattrFileData),
 }
 
 impl FileData {
@@ -407,6 +427,18 @@ impl FileData {
  };
  FileData::Rename(data)
  }
+ file_activity_type_t::FILE_ACTIVITY_SETXATTR => {
+ let xattr_name = slice_to_string(
+ &unsafe { extra_data.xattr }.name[..XATTR_NAME_MAX_LEN as usize],
+ )?;
+ FileData::SetXattr(XattrFileData { inner, xattr_name })
+ }
+ file_activity_type_t::FILE_ACTIVITY_REMOVEXATTR => {
+ let xattr_name = slice_to_string(
+ &unsafe { extra_data.xattr }.name[..XATTR_NAME_MAX_LEN as usize],
+ )?;
+ FileData::RemoveXattr(XattrFileData { inner, xattr_name })
+ }
  invalid => unreachable!("Invalid event type: {invalid:?}"),
  };
 
@@ -433,6 +465,14 @@ impl From<FileData> for fact_api::file_activity::File {
  FileData::RmDir(_) => {
  unreachable!("RmDir event reached protobuf conversion");
  }
+ FileData::SetXattr(event) => {
+ let f_act = fact_api::FileXattrChange::from(event);
+ fact_api::file_activity::File::XattrSet(f_act)
+ }
+ FileData::RemoveXattr(event) => {
+ let f_act = fact_api::FileXattrChange::from(event);
+ fact_api::file_activity::File::XattrRemove(f_act)
+ }
  FileData::Unlink(event) => {
  let activity = Some(fact_api::FileActivityBase::from(event));
  let f_act = fact_api::FileUnlink { activity };
@@ -465,6 +505,8 @@ impl PartialEq for FileData {
  (FileData::Unlink(this), FileData::Unlink(other)) => this == other,
  (FileData::Chmod(this), FileData::Chmod(other)) => this == other,
  (FileData::Rename(this), FileData::Rename(other)) => this == other,
+ (FileData::SetXattr(this), FileData::SetXattr(other)) => this == other,
+ (FileData::RemoveXattr(this), FileData::RemoveXattr(other)) => this == other,
  _ => false,
  }
  }
@@ -595,6 +637,29 @@ impl PartialEq for RenameFileData {
  }
 }
 
+#[derive(Debug, Clone, Serialize)]
+pub struct XattrFileData {
+ inner: BaseFileData,
+ xattr_name: String,
+}
+
+impl From<XattrFileData> for fact_api::FileXattrChange {
+ fn from(value: XattrFileData) -> Self {
+ let activity = fact_api::FileActivityBase::from(value.inner);
+ fact_api::FileXattrChange {
+ activity: Some(activity),
+ xattr_name: value.xattr_name,
+ }
+ }
+}
+
+#[cfg(test)]
+impl PartialEq for XattrFileData {
+ fn eq(&self, other: &Self) -> bool {
+ self.xattr_name == other.xattr_name && self.inner == other.inner
+ }
+}
+
 #[cfg(test)]
 mod test_utils {
  use std::os::raw::c_char;

fact/src/metrics/kernel_metrics.rs

@@ -70,4 +70,6 @@ define_kernel_metrics!(
  path_mkdir,
  path_rmdir,
  d_instantiate,
+ inode_setxattr,
+ inode_removexattr,
 );

tests/conftest.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import os
+import subprocess
 from shutil import rmtree
 from tempfile import NamedTemporaryFile, mkdtemp
 from time import sleep
@@ -12,8 +13,41 @@
 import requests
 import yaml
 
+from event import Event, EventType, Process
 from server import FileActivityService
 
+
+def get_dockerd_process() -> Process | None:
+ result = subprocess.run(
+ ['pgrep', 'dockerd'],
+ capture_output=True,
+ text=True,
+ )
+ if result.returncode != 0:
+ return None
+ pid = int(result.stdout.strip().split('\n')[0])
+ proc = Process.from_proc(pid)
+ # Process.from_proc uses os.path.realpath on /proc/<pid>/exe,
+ # which may not resolve across mount namespaces (e.g. CoreOS).
+ # Use the path from pgrep -a instead.
+ result = subprocess.run(
+ ['pgrep', '-a', 'dockerd'],
+ capture_output=True,
+ text=True,
+ )
+ exe_path = result.stdout.strip().split('\n')[0].split()[1]
+ return Process(
+ pid=None,
+ uid=proc.uid,
+ gid=proc.gid,
+ exe_path=exe_path,
+ args=proc.args,
+ name=proc.name,
+ container_id=proc.container_id,
+ loginuid=proc.loginuid,
+ )
+
+
 # Declare files holding fixtures
 pytest_plugins = ['test_editors.commons']
 
@@ -185,6 +219,47 @@ def test_container(
  container.remove()
 
 
+@pytest.fixture
+def docker_selinux_xattr(
+ docker_client: docker.DockerClient,
+ monitored_dir: str,
+ test_file: str,
+) -> list[Event]:
+ """
+ Expected xattr events from Docker SELinux relabeling.
+
+ When Docker creates a container with ':z' volume mounts, it
+ relabels files with security.selinux. This fixture returns the
+ expected events if Docker has SELinux enabled, or an empty list
+ otherwise.
+
+ Docker relabels both the file and its parent directory.
+ """
+ info = docker_client.info()
+ selinux = any('selinux' in opt for opt in info.get('SecurityOptions', []))
+ if not selinux:
+ return []
+ dockerd = get_dockerd_process()
+ if dockerd is None:
+ return []
+ return [
+ Event(
+ process=dockerd,
+ event_type=EventType.XATTR_SET,
+ file='',
+ host_path=test_file,
+ xattr_name='security.selinux',
+ ),
+ Event(
+ process=dockerd,
+ event_type=EventType.XATTR_SET,
+ file='',
+ host_path=monitored_dir,
+ xattr_name='security.selinux',
+ ),
+ ]
+
+
 @pytest.fixture(autouse=True)
 def fact(
  request: pytest.FixtureRequest,