ProcessCreate: ParentImage is empty when the parent starts the process from a non-main thread

Aberta
  • Algo errado?
#253 0 comentários 0 reações 0 responsáveis Ver no GitHub

Ninguém assumiu esta issue ainda.

Avaliação

Dificuldade
3/5
Tempo estimado
1-2 dias
Facilidade para iniciantes
68/100
Tipo de issue
Bug
Clareza
Claramente especificada
Status de atividade
Ativa
Stack de tecnologia
c, linux
Domínio
backend, operating-systems

Direção de pesquisa

Start with ebpfKern/sysmonProcCreate.c around lines 124–134, where the parent task and pid are read, then trace how the process cache looks up parent details. Check how Linux thread ids, process ids, and thread group leaders are represented in this path. Done means ProcessCreate events from worker threads report the parent process id, image, and command line correctly; the issue provides a Python reproduction to verify the behavior.

Escrita pelo modelo de indexação a partir do texto da issue.

Descrição

Version: sysmonforlinux 1.6.0 and sysinternalsebpf 2.3.0 from packages.microsoft.com, Ubuntu 24.04.5 on WSL2 (kernel 6.18.33.1-microsoft-standard-WSL2), with a config that logs all ProcessCreate events.

Repro

python3 -c 'import subprocess, threading
subprocess.run(["bash", "-c", "echo from-main-thread"])
t = threading.Thread(target=lambda: subprocess.run(["bash", "-c", "echo from-worker-thread"]))
t.start(); t.join()'

Result (event ID 1)

ProcessId  CommandLine                      ParentProcessId  ParentImage
23208      bash -c echo from-main-thread    23207            /usr/bin/python3.12
23210      bash -c echo from-worker-thread  23209            -

Both bash processes have the same parent process (python, 23207), but the second one gets ParentProcessId 23209, the id of the Python worker thread, and ParentImage -. ParentCommandLine is - too.

Cause

sysmonProcCreate.c takes task->parent and then parent->pid (L124-L134). When the child was created by a thread that is not the group leader, parent is that thread, so pid is a thread id; the process id is tgid. The process cache has no entry for that id, so the parent fields stay empty. Reading tgid, and using the thread group leader as the parent process object for the cache lookup, should fix it.

Impact

Any program that starts processes from a worker thread is affected. With Java it is every child process, because the JVM runs main() on a second thread: in my test, the children of java (pid 22953) got ParentProcessId 22954 and ParentImage -. So detections based on the parent image, like "unusual child of java", never match.

Related

When a process execs twice without forking, children of the second image get the first one as ParentImage. Java starts jspawnhelper, which execs the target in the same pid, and a child of that target shows ParentImage .../jspawnhelper. ProcessCache::ProcessGet returns the first open entry for the pid (eventsCommon.cpp L186-L210). I can open a separate issue for this one if you prefer.

Linguagem predominante
C
Estrelas
2.2k
Forks
224
Merge médio
4h 50min
PRs com merge (30d)
3

Preparar o ambiente

Primeiros passos

  1. Leia a issue inteira e depois o guia de contribuição do projeto.
  2. Comente na issue dizendo que vai assumir — evita que duas pessoas façam o mesmo trabalho.
  3. Faça um fork do repositório e trabalhe em uma branch.
  4. Abra um pull request que referencie o número da issue.

Mais de microsoft/Sysmon-Linux

Todas as issues de microsoft/Sysmon-Linux

Issues semelhantes

Mais issues de C

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.