Skip to content

Add tty information to bpf-lsm generated telemetry #2022

@rksharma95

Description

@rksharma95

system monitor provides tty information for any observed event.

// check if tty is attached
struct signal_struct *signal;
signal = READ_KERN(task->signal);
if (signal != NULL){
struct tty_struct *tty = READ_KERN(signal->tty);
if (tty != NULL){
// a tty is attached
bpf_probe_read_str(&context->tty, TTY_LEN, (void *)tty->name);
}
}

we need to have same information with the telemetry generated by BPF-LSM enforcer.

Metadata

Metadata

Labels

Type

No type

Projects

Status

Done

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions