Skip to content

Syscalls str filter#30

Open
lacraig2 wants to merge 5 commits intomainfrom
syscalls_str_filter
Open

Syscalls str filter#30
lacraig2 wants to merge 5 commits intomainfrom
syscalls_str_filter

Conversation

@lacraig2
Copy link
Contributor

This pull request introduces support for string-based filtering in syscall hooks, adds robust string comparison helpers, and ensures proper memory management for dynamically allocated filter patterns. Additionally, it includes minor type and variable declaration improvements in the portal subsystem for clarity and correctness.

Syscall hook filtering improvements:

  • Added new string-based filter types to enum value_filter_type, enabling exact match, contains, startswith, and endswith comparisons for syscall argument and return value filtering.
  • Extended the struct value_filter to include a pattern pointer and its length for string comparisons.
  • Updated value_matches_filter to handle the new string filter types, invoking the appropriate helper for each.

String comparison helpers:

  • Introduced efficient, chunked string comparison helpers (check_str_exact, check_str_startswith, check_str_endswith, check_str_contains) to safely compare user-space strings from kernel space, minimizing stack usage and handling large strings.

Memory management:

  • Ensured that dynamically allocated string patterns in argument and return value filters are properly freed during syscall hook unregistration to prevent memory leaks.

Portal subsystem improvements:

  • Changed variable declarations in portal_get_vma_name to avoid shadowing and improve clarity; switched some types to const char * where appropriate. [1] [2] [3] [4]
  • Updated the type of copy_size in handle_op_copy_buf_guest to uint64_t for correctness and used min_t for type safety.

Other minor changes:

  • Included <linux/uaccess.h> in syscalls_hc.h to support user-space memory access in the new helpers.
  • Added a missing variable declaration (int i) in do_unregister_syscall_hook.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant