ProcessCreate: ParentImage is empty when the parent starts the process from a non-main thread

Offen
  • Stimmt etwas nicht?
#253 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen

Dieses Issue hat noch niemand übernommen.

Bewertung

Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Anfängerfreundlichkeit
68/100
Issue-Typ
Bug
Klarheit
Klar beschrieben
Aktivitätsstatus
Aktiv
Tech-Stack
c, linux
Bereich
backend, operating-systems

Rechercherichtung

Start with ebpfKern/sysmonProcCreate.c around lines 124–134, where the parent task and pid are read, then trace how the process cache looks up parent details. Check how Linux thread ids, process ids, and thread group leaders are represented in this path. Done means ProcessCreate events from worker threads report the parent process id, image, and command line correctly; the issue provides a Python reproduction to verify the behavior.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Beschreibung

Version: sysmonforlinux 1.6.0 and sysinternalsebpf 2.3.0 from packages.microsoft.com, Ubuntu 24.04.5 on WSL2 (kernel 6.18.33.1-microsoft-standard-WSL2), with a config that logs all ProcessCreate events.

Repro

python3 -c 'import subprocess, threading
subprocess.run(["bash", "-c", "echo from-main-thread"])
t = threading.Thread(target=lambda: subprocess.run(["bash", "-c", "echo from-worker-thread"]))
t.start(); t.join()'

Result (event ID 1)

ProcessId  CommandLine                      ParentProcessId  ParentImage
23208      bash -c echo from-main-thread    23207            /usr/bin/python3.12
23210      bash -c echo from-worker-thread  23209            -

Both bash processes have the same parent process (python, 23207), but the second one gets ParentProcessId 23209, the id of the Python worker thread, and ParentImage -. ParentCommandLine is - too.

Cause

sysmonProcCreate.c takes task->parent and then parent->pid (L124-L134). When the child was created by a thread that is not the group leader, parent is that thread, so pid is a thread id; the process id is tgid. The process cache has no entry for that id, so the parent fields stay empty. Reading tgid, and using the thread group leader as the parent process object for the cache lookup, should fix it.

Impact

Any program that starts processes from a worker thread is affected. With Java it is every child process, because the JVM runs main() on a second thread: in my test, the children of java (pid 22953) got ParentProcessId 22954 and ParentImage -. So detections based on the parent image, like "unusual child of java", never match.

Related

When a process execs twice without forking, children of the second image get the first one as ParentImage. Java starts jspawnhelper, which execs the target in the same pid, and a child of that target shows ParentImage .../jspawnhelper. ProcessCache::ProcessGet returns the first open entry for the pid (eventsCommon.cpp L186-L210). I can open a separate issue for this one if you prefer.

Vorherrschende Sprache
C
Sterne
2.2k
Forks
224
Ø Merge
4 Std. 50 Min.
Gemergte PRs (30 T.)
3

Entwicklungsumgebung

Erste Schritte

  1. Lesen Sie das ganze Issue und danach den Beitragsleitfaden des Projekts.
  2. Schreiben Sie ins Issue, dass Sie es übernehmen — das erspart doppelte Arbeit.
  3. Forken Sie das Repository und arbeiten Sie in einem Branch.
  4. Öffnen Sie einen Pull Request, der die Issue-Nummer nennt.

Mehr aus microsoft/Sysmon-Linux

Alle Issues in microsoft/Sysmon-Linux

Ähnliche Issues

Weitere Issues zu C

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.