Implement userland

missing user/group mapping to string representation

Author: ovalenti

fact/src/bpf/mod.rs

@@ -155,7 +155,8 @@ impl Bpf {
     fn load_progs(&mut self, btf: &Btf) -> anyhow::Result<()> {
         self.load_lsm_prog("trace_file_open", "file_open", btf)?;
         self.load_lsm_prog("trace_path_unlink", "path_unlink", btf)?;
-        self.load_lsm_prog("trace_path_chmod", "path_chmod", btf)
+        self.load_lsm_prog("trace_path_chmod", "path_chmod", btf)?;
+        self.load_lsm_prog("trace_path_chown", "path_chown", btf)
     }
 
     fn attach_progs(&mut self) -> anyhow::Result<()> {

fact/src/event/mod.rs

@@ -68,6 +68,7 @@ impl Event {
             FileData::Creation(data) => &data.inode,
             FileData::Unlink(data) => &data.inode,
             FileData::Chmod(data) => &data.file.inode,
+            FileData::Chown(data) => &data.file.inode,
         }
     }
 
@@ -77,6 +78,7 @@ impl Event {
             FileData::Creation(data) => data.host_file = host_path,
             FileData::Unlink(data) => data.host_file = host_path,
             FileData::Chmod(data) => data.file.host_file = host_path,
+            FileData::Chown(data) => data.file.host_file = host_path,
         }
     }
 }
@@ -131,6 +133,7 @@ pub enum FileData {
     Creation(BaseFileData),
     Unlink(BaseFileData),
     Chmod(ChmodFileData),
+    Chown(ChownFileData),
 }
 
 impl FileData {
@@ -153,6 +156,16 @@ impl FileData {
                 };
                 FileData::Chmod(data)
             }
+            file_activity_type_t::FILE_ACTIVITY_CHOWN => {
+                let data = ChownFileData {
+                    file: inner,
+                    new_uid: unsafe { extra_data.chown.new.uid },
+                    new_gid: unsafe { extra_data.chown.new.gid },
+                    old_uid: unsafe { extra_data.chown.old.uid },
+                    old_gid: unsafe { extra_data.chown.old.gid },
+                };
+                FileData::Chown(data)
+            }
             invalid => unreachable!("Invalid event type: {invalid:?}"),
         };
 
@@ -182,6 +195,10 @@ impl From<FileData> for fact_api::file_activity::File {
                 let f_act = fact_api::FilePermissionChange::from(event);
                 fact_api::file_activity::File::Permission(f_act)
             }
+            FileData::Chown(event) => {
+                let f_act = fact_api::FileOwnershipChange::from(event);
+                fact_api::file_activity::File::Ownership(f_act)
+            }
         }
     }
 }
@@ -271,3 +288,52 @@ impl From<ChmodFileData> for fact_api::FilePermissionChange {
         }
     }
 }
+
+#[derive(Debug, Clone, Serialize)]
+pub struct ChownFileData {
+    file: BaseFileData,
+    new_uid: u32,
+    new_gid: u32,
+    old_uid: u32,
+    old_gid: u32,
+}
+
+impl ChownFileData {
+    pub fn new(
+        filename: [c_char; PATH_MAX as usize],
+        inode: inode_key_t,
+        new_uid: u32,
+        new_gid: u32,
+        old_uid: u32,
+        old_gid: u32,
+    ) -> anyhow::Result<Self> {
+        let file = BaseFileData::new(filename, inode)?;
+
+        Ok(ChownFileData {
+            file,
+            new_uid,
+            new_gid,
+            old_uid,
+            old_gid,
+        })
+    }
+}
+impl From<ChownFileData> for fact_api::FileOwnershipChange {
+    fn from(value: ChownFileData) -> Self {
+        let ChownFileData {
+            file,
+            new_uid,
+            new_gid,
+            old_uid: _,
+            old_gid: _,
+        } = value;
+        let activity = fact_api::FileActivityBase::from(file);
+        fact_api::FileOwnershipChange {
+            activity: Some(activity),
+            uid: new_uid,
+            gid: new_gid,
+            username: "".to_string(),
+            group: "".to_string(),
+        }
+    }
+}