Skip to content

added return value of bash module.#52

Merged
cfc4n merged 1 commit into
gojue:masterfrom
huzai9527:master
May 3, 2022
Merged

added return value of bash module.#52
cfc4n merged 1 commit into
gojue:masterfrom
huzai9527:master

Conversation

@huzai9527
Copy link
Copy Markdown
Contributor

the commond which been exec successfully will return 0,otherwhise will return errcode.
image

@cfc4n cfc4n added enhancement New feature or request good first issue Good for newcomers labels May 2, 2022
Copy link
Copy Markdown
Contributor

@yihong0618 yihong0618 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

seems need some code format to follow this repo c code style.

Comment thread kern/bash_kern.c
Comment thread kern/bash_kern.c
@cfc4n
Copy link
Copy Markdown
Member

cfc4n commented May 2, 2022

please fix all issues,and merge all commits into one commit with command

git reset --soft HEAD~3
git commit
git push -f

and This PR will autorefresh

Copy link
Copy Markdown
Member

@cfc4n cfc4n left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

please fix them ,and run make format to format c code before git commit

Comment thread user/probe_bash.go
}

this.logger.Printf("HOOK binrayPath:%s, FunctionName:readline\n", binaryPath)
this.logger.Printf("HOOK binrayPath:%s, FunctionName:execute_command\n", binaryPath)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it repeated here? Line 106 and 107

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

107 is another hook, execute_command

Comment thread user/probe_bash.go
{
Section: "uretprobe/bash_retval",
EbpfFuncName: "uretprobe_bash_retval",
AttachToFuncName: "execute_command",
Copy link
Copy Markdown
Member

@cfc4n cfc4n May 2, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can you give some source code about bash return like https://github.com/ehids/ecapture/blob/master/kern/README.md .

Copy link
Copy Markdown
Contributor Author

@huzai9527 huzai9527 May 2, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

you want func_prototype or others?
proto like this

int
execute_command (command)
     COMMAND *command;
{
  struct fd_bitmap *bitmap;
  int result;

  current_fds_to_close = (struct fd_bitmap *)NULL;
  bitmap = new_fd_bitmap (FD_BITMAP_DEFAULT_SIZE);
  begin_unwind_frame ("execute-command");
  add_unwind_protect (dispose_fd_bitmap, (char *)bitmap);

  /* Just do the command, but not asynchronously. */
  result = execute_command_internal (command, 0, NO_PIPE, NO_PIPE, bitmap);

  dispose_fd_bitmap (bitmap);
  discard_unwind_frame ("execute-command");

#if defined (PROCESS_SUBSTITUTION)
  /* don't unlink fifos if we're in a shell function; wait until the function
     returns. */
  if (variable_context == 0)
    unlink_fifo_list ();
#endif /* PROCESS_SUBSTITUTION */

  QUIT;
  return (result);
}

the bash workflow like this

 main()
        |
   reader_loop()       解析
        |--------------------------->read_command()-->parse_command()-->yyparse()-->yylex()-->read_token()-->read_token_word()
        |                                 |                               |                       |                 |
 execute_command() <-------------- current_command <--------------- global_command <------------token------------word
        |
execute_command_internal()
        |
 execute_xxxx_command()
        |
execute_simple_command()
        |
        |--->expand_words()-->expand_word_list_internal()
        |                                                                  子进程
        |------------------------------------->execute_disk_command()------------->shell_execve()-->execve()                
        |                  磁盘命令                       |                |                       |
        |函数及内置命令                              make_child()          |                       |FAILED
        |                                                |                |                       |
execute_builtin_or_function()                          fork()----------->pid                      ->execute_shell_script()
                                                                          |
                                                                          --------->return(result)
                                                                            父进程

@huzai9527
Copy link
Copy Markdown
Contributor Author

huzai9527 commented May 2, 2022

I have run the command up, is that works? I want to add falgs on bash command which will be used like this sudo ./ecapture bash -err 100, this command will show user which command don't have permisson to run. But i am ambigous about iConfig,i don't konw how to extract flag from submod like bash without using gloable var. can you give me some advice?

@cfc4n
Copy link
Copy Markdown
Member

cfc4n commented May 2, 2022

@huzai9527
Copy link
Copy Markdown
Contributor Author

copy that, Do you have any other issues with this PR?

@huzai9527
Copy link
Copy Markdown
Contributor Author

huzai9527 commented May 3, 2022

I have implemented the command func like sudo ./ecapture bash --err 100 and it's result like this

  • with err flag

image

  • no err flag

image

@cfc4n
Copy link
Copy Markdown
Member

cfc4n commented May 3, 2022

please merge all commits into one commit. ref: https://www.internalpointers.com/post/squash-commits-into-one-git

@huzai9527
Copy link
Copy Markdown
Contributor Author

sorry about these commits, I am not familiar with github's instruction, I am trying to merge all commits now.

@cfc4n
Copy link
Copy Markdown
Member

cfc4n commented May 3, 2022

加下 https://raw.githubusercontent.com/ehids/ecapture/master/images/wechat_gzhh.png 微信公众号,里面回复“微信群”,会给发给你群二维码,我们群里沟通吧。

@huzai9527
Copy link
Copy Markdown
Contributor Author

群二维码过期啦

Copy link
Copy Markdown
Member

@cfc4n cfc4n left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@cfc4n cfc4n changed the title update about bash,show command resultcode added return value of bash module. May 3, 2022
@cfc4n cfc4n merged commit 06d50a8 into gojue:master May 3, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

enhancement New feature or request good first issue Good for newcomers

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants