ProcessCreate: ParentImage is empty when the parent starts the process from a non-main thread
還沒有人認領這個 Issue。
評估
- 難度
- 3/5
- 預估耗時
- 1-2 天
- 新手友好度
- 68/100
- Issue 類型
- 缺陷
- 描述清晰度
- 描述清楚
- 活躍度
- 活躍
- 技術堆疊
- c, linux
研究方向
Start with ebpfKern/sysmonProcCreate.c around lines 124–134, where the parent task and pid are read, then trace how the process cache looks up parent details. Check how Linux thread ids, process ids, and thread group leaders are represented in this path. Done means ProcessCreate events from worker threads report the parent process id, image, and command line correctly; the issue provides a Python reproduction to verify the behavior.
由索引模型根據 Issue 內容生成。
描述
Version: sysmonforlinux 1.6.0 and sysinternalsebpf 2.3.0 from packages.microsoft.com, Ubuntu 24.04.5 on WSL2 (kernel 6.18.33.1-microsoft-standard-WSL2), with a config that logs all ProcessCreate events.
Repro
python3 -c 'import subprocess, threading
subprocess.run(["bash", "-c", "echo from-main-thread"])
t = threading.Thread(target=lambda: subprocess.run(["bash", "-c", "echo from-worker-thread"]))
t.start(); t.join()'
Result (event ID 1)
ProcessId CommandLine ParentProcessId ParentImage
23208 bash -c echo from-main-thread 23207 /usr/bin/python3.12
23210 bash -c echo from-worker-thread 23209 -
Both bash processes have the same parent process (python, 23207), but the second one gets ParentProcessId 23209, the id of the Python worker thread, and ParentImage -. ParentCommandLine is - too.
Cause
sysmonProcCreate.c takes task->parent and then parent->pid (L124-L134). When the child was created by a thread that is not the group leader, parent is that thread, so pid is a thread id; the process id is tgid. The process cache has no entry for that id, so the parent fields stay empty. Reading tgid, and using the thread group leader as the parent process object for the cache lookup, should fix it.
Impact
Any program that starts processes from a worker thread is affected. With Java it is every child process, because the JVM runs main() on a second thread: in my test, the children of java (pid 22953) got ParentProcessId 22954 and ParentImage -. So detections based on the parent image, like "unusual child of java", never match.
Related
When a process execs twice without forking, children of the second image get the first one as ParentImage. Java starts jspawnhelper, which execs the target in the same pid, and a child of that target shows ParentImage .../jspawnhelper. ProcessCache::ProcessGet returns the first open entry for the pid (eventsCommon.cpp L186-L210). I can open a separate issue for this one if you prefer.
- 主要語言
- C
- 星號
- 2.2k
- 分支
- 224
- 平均合併
- 4 小時 50 分鐘
- 30 天內合併 PR
- 3
環境準備
- 沒有 Dockerfile 或 Docker Compose 檔案
- 沒有 Pull Request 範本
- 閱讀貢獻指南
從這裡開始
- 先讀完整個 Issue，再讀專案的貢獻指南。
- 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
- Fork 儲存庫，在一個分支上完成修改。
- 送出 Pull Request，並在描述裡引用這個 Issue 編號。
microsoft/Sysmon-Linux 的其他 Issue
-
難度 3/5 1-2 天 新手友好度 72/100
microsoft/Sysmon-Linux#252 ·
-
難度 3/5 1-2 天 新手友好度 55/100
microsoft/Sysmon-Linux#247 ·
-
難度 1/5 1 小時以內 新手友好度 12/100
microsoft/Sysmon-Linux#246 · 3 則留言 ·
-
Sysmon service executable remains `(deleted)` after restart, causing repeated needrestart restarts and systemd start-limit-hit可能重新可做 @MarioHewardt 於 32 天前認領，目前沒有進行中的 PR。 未關閉
microsoft/Sysmon-Linux#244 · 已指派 1 人 ·
-
ProcessTerminate events intermittently report an unrelated user's UID instead of the terminating process's UID可能已有人在做 @MarioHewardt 於 111 天前認領。 未關閉
microsoft/Sysmon-Linux#238 · 已指派 1 人 ·
查看 microsoft/Sysmon-Linux 的全部 Issue
相似的 Issue
-
難度 2/5 1-3 小時 新手友好度 73/100
ChupathingyCE/chupathingyce#1020 · 1 則留言 ·
維護者通常 1 天內回覆
-
難度 2/5 1-3 小時 新手友好度 85/100
-
enhancement good first issue
難度 1/5 1 小時以內 新手友好度 91/100
-
C:dataplane
難度 2/5 1-3 小時 新手友好度 76/100
yanet-platform/yanet2#3395 ·
維護者通常 1 天內回覆
-
難度 1/5 1 小時以內 新手友好度 75/100
openvehicles/Open-Vehicle-Monitoring-System-3#1575 ·
維護者通常 4 天內回覆