ProcessCreate: ParentImage is empty when the parent starts the process from a non-main thread

Aperta
  • Qualcosa non va?
#253 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
3/5
Tempo stimato
1-2 giorni
Idoneità per principianti
68/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
c, linux
Ambito
backend, operating-systems

Direzione di ricerca

Start with ebpfKern/sysmonProcCreate.c around lines 124–134, where the parent task and pid are read, then trace how the process cache looks up parent details. Check how Linux thread ids, process ids, and thread group leaders are represented in this path. Done means ProcessCreate events from worker threads report the parent process id, image, and command line correctly; the issue provides a Python reproduction to verify the behavior.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Version: sysmonforlinux 1.6.0 and sysinternalsebpf 2.3.0 from packages.microsoft.com, Ubuntu 24.04.5 on WSL2 (kernel 6.18.33.1-microsoft-standard-WSL2), with a config that logs all ProcessCreate events.

Repro

python3 -c 'import subprocess, threading
subprocess.run(["bash", "-c", "echo from-main-thread"])
t = threading.Thread(target=lambda: subprocess.run(["bash", "-c", "echo from-worker-thread"]))
t.start(); t.join()'

Result (event ID 1)

ProcessId  CommandLine                      ParentProcessId  ParentImage
23208      bash -c echo from-main-thread    23207            /usr/bin/python3.12
23210      bash -c echo from-worker-thread  23209            -

Both bash processes have the same parent process (python, 23207), but the second one gets ParentProcessId 23209, the id of the Python worker thread, and ParentImage -. ParentCommandLine is - too.

Cause

sysmonProcCreate.c takes task->parent and then parent->pid (L124-L134). When the child was created by a thread that is not the group leader, parent is that thread, so pid is a thread id; the process id is tgid. The process cache has no entry for that id, so the parent fields stay empty. Reading tgid, and using the thread group leader as the parent process object for the cache lookup, should fix it.

Impact

Any program that starts processes from a worker thread is affected. With Java it is every child process, because the JVM runs main() on a second thread: in my test, the children of java (pid 22953) got ParentProcessId 22954 and ParentImage -. So detections based on the parent image, like "unusual child of java", never match.

Related

When a process execs twice without forking, children of the second image get the first one as ParentImage. Java starts jspawnhelper, which execs the target in the same pid, and a child of that target shows ParentImage .../jspawnhelper. ProcessCache::ProcessGet returns the first open entry for the pid (eventsCommon.cpp L186-L210). I can open a separate issue for this one if you prefer.

Lingua principale
C
Stelle
2.2k
Fork
222
Merge medio
4h 50m
PR unite (30g)
3

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di microsoft/Sysmon-Linux

Tutte le issue di microsoft/Sysmon-Linux

Issue simili

Altre issue su C

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.