Add option to set argument matchtype

Author: axtloss

README.md

@@ -28,6 +28,18 @@ syscalls:
     arg0: 3
     arg0_char: false
 ```
+In the case, that the argument is a char pointer, it can be specified how the argument should be matched, possible options are "full", "begins" and "contains":
+```
+log_file: /some/random/path
+syscalls:
+  - umount2
+    log: true
+    block: true
+    arg0: "/some/path"
+    arg0_char: true
+    arg0_matchtype: "begins"
+```
+In this example, syscall interceptor checks if the argument in the syscall begins with "/some/path", meaning that trying to call `umount2` on `/some/path` or `/some/path/nested` would be blocked.
 
 In the future an extra tool may be developed to either fully generate or at least assist with the generation of a configuration file.
 

config.yml

@@ -1,19 +1,17 @@
 log_file: ./log.txt
 syscalls:
-    - umount2:
+    - openat:
         log: true
         block: true
-        arg0: "/usr"
-        arg0_char: true
-        arg1: 1
-        arg1_char: false
+        arg1: "/usr"
+        arg1_char: true
+        arg1_matchtype: "begins"
     - umount2:
         log: false
         block: true
         arg0: "/home/xen/Projects/syscall-interceptor/test"
         arg0_char: true
-        arg1: 2
-        arg1_char: false
+        arg0_matchtype: "full"
     - getdents64:
         log: true
         block: false

parse_config.py

@@ -22,20 +22,26 @@
   bool block;
   char *arg0;
   long arg0_long;
+  int arg0_matchtype;
   char *arg1;
   long arg1_long;
+  int arg1_matchtype;
   char *arg2;
   long arg2_long;
+  int arg2_matchtype;
   char *arg3;
   long arg3_long;
+  int arg3_matchtype;
   char *arg4;
   long arg4_long;
+  int arg4_matchtype;
   char *arg5;
   long arg5_long;
+  int arg5_matchtype;
 
   struct syscall *next;
   struct syscall *prev;
-}} syscall_default = {{NULL, -1, false, false, NULL, -1, NULL, -1, NULL, -1, NULL, -1, NULL, -1, NULL, -1, NULL, NULL}};
+}} syscall_default = {{NULL, -1, false, false, NULL, -1, 0, NULL, -1, 0, NULL, -1, 0, NULL, -1, 0, NULL, -1, 0, NULL, -1, 0, NULL, NULL}};
 
 typedef struct syscall syscall;
 
@@ -53,6 +59,7 @@
     "set_block": "{varname}->block = {block};\n",
     "set_arg_char": '{varname}->{argname} = (char *) malloc(strlen("{arg}")+1);\nstrcpy({varname}->{argname}, "{arg}");\n',
     "set_arg_long": '{varname}->{argname}_long = {arg};\n',
+    "set_arg_matchtype": '{varname}->{argname}_matchtype = {matchtype};\n',
     "set_next": "{varname}->next = {nextcall};\n",
     "set_prev": "{varname}->prev = {prevcall};\n",
 }
@@ -63,17 +70,23 @@ class Syscall:
     log: bool
     block: bool
     arg0: str = ""
-    arg_char: bool = True
+    arg0_char: bool = True
+    arg0_matchtype: str = "full"
     arg1: str = ""
     arg1_char: bool = True
+    arg1_matchtype: str = "full"
     arg2: str = ""
     arg2_char: bool = True
+    arg2_matchtype: str = "full"
     arg3: str = ""
     arg3_char: bool = True
+    arg3_matchtype: str = "full"
     arg4: str = ""
     arg4_char: bool = True
+    arg4_matchtype: str = "full"
     arg5: str = ""
     arg5_char: bool = True
+    arg5_matchtype: str = "full"
 
     def __init__(
         self,
@@ -82,32 +95,44 @@ def __init__(
         block: bool,
         arg0: str = "",
         arg0_char: bool = True,
+        arg0_matchtype: str = "full",
         arg1: str = "",
         arg1_char: bool = True,
+        arg1_matchtype: str = "full",
         arg2: str = "",
         arg2_char: bool = True,
+        arg2_matchtype: str = "full",
         arg3: str = "",
         arg3_char: bool = True,
+        arg3_matchtype: str = "full",
         arg4: str = "",
         arg4_char: bool = True,
+        arg4_matchtype: str = "full",
         arg5: str = "",
         arg5_char: bool = True,
+        arg5_matchtype: str = "full",
     ):
         self.name = name
         self.log = log
         self.block = block
         self.arg0 = arg0
         self.arg0_char = arg0_char
+        self.arg0_matchtype = arg0_matchtype
         self.arg1 = arg1
         self.arg1_char = arg1_char
+        self.arg1_matchtype = arg1_matchtype
         self.arg2 = arg2
         self.arg2_char = arg2_char
+        self.arg2_matchtype = arg2_matchtype
         self.arg3 = arg3
         self.arg3_char = arg3_char
+        self.arg3_matchtype = arg3_matchtype
         self.arg4 = arg4
         self.arg4_char = arg4_char
+        self.arg4_matchtype = arg4_matchtype
         self.arg5 = arg5
         self.arg5_char = arg5_char
+        self.arg5_matchtype = arg5_matchtype
 
     def build_c_code(self, varname: str) -> str:
         c_code = structbuild_template["var_define"].format(varname=varname)
@@ -132,16 +157,21 @@ def build_c_code(self, varname: str) -> str:
                 c_code = c_code + structbuild_template["set_arg_char"].format(
                     varname=varname, argname="arg0", arg=self.arg0
                 )
+                c_code = c_code + structbuild_template["set_arg_matchtype"].format(
+                    varname=varname, argname="arg0", matchtype=0 if self.arg0_matchtype == "full" else -1 if self.arg0_matchtype == "begins" else 1
+                )
             else:
                 c_code = c_code + structbuild_template["set_arg_long"].format(
                     varname=varname, argname="arg0", arg=self.arg0
                 )
-
         if self.arg1 != "":
             if self.arg1_char:
                 c_code = c_code + structbuild_template["set_arg_char"].format(
                     varname=varname, argname="arg1", arg=self.arg1
                 )
+                c_code = c_code + structbuild_template["set_arg_matchtype"].format(
+                    varname=varname, argname="arg1", matchtype=0 if self.arg1_matchtype == "full" else -1 if self.arg1_matchtype == "begins" else 1
+                )
             else:
                 c_code = c_code + structbuild_template["set_arg_long"].format(
                     varname=varname, argname="arg1", arg=self.arg1
@@ -152,6 +182,9 @@ def build_c_code(self, varname: str) -> str:
                 c_code = c_code + structbuild_template["set_arg_char"].format(
                     varname=varname, argname="arg2", arg=self.arg2
                 )
+                c_code = c_code + structbuild_template["set_arg_matchtype"].format(
+                    varname=varname, argname="arg2", matchtype=0 if self.arg2_matchtype == "full" else -1 if self.arg2_matchtype == "begins" else 1
+                )
             else:
                 c_code = c_code + structbuild_template["set_arg_long"].format(
                     varname=varname, argname="arg2", arg=self.arg2
@@ -163,6 +196,9 @@ def build_c_code(self, varname: str) -> str:
                 c_code = c_code + structbuild_template["set_arg_char"].format(
                     varname=varname, argname="arg3", arg=self.arg3
                 )
+                c_code = c_code + structbuild_template["set_arg_matchtype"].format(
+                    varname=varname, argname="arg3", matchtype=0 if self.arg3_matchtype == "full" else -1 if self.arg3_matchtype == "begins" else 1
+                )
             else:
                 c_code = c_code + structbuild_template["set_arg_long"].format(
                     varname=varname, argname="arg3", arg=self.arg3
@@ -173,6 +209,9 @@ def build_c_code(self, varname: str) -> str:
                 c_code = c_code + structbuild_template["set_arg_char"].format(
                     varname=varname, argname="arg4", arg=self.arg4
                 )
+                c_code = c_code + structbuild_template["set_arg_matchtype"].format(
+                    varname=varname, argname="arg4", matchtype=0 if self.arg4_matchtype == "full" else -1 if self.arg4_matchtype == "begins" else 1
+                )
             else:
                 c_code = c_code + structbuild_template["set_arg_long"].format(
                     varname=varname, argname="arg4", arg=self.arg4
@@ -183,6 +222,9 @@ def build_c_code(self, varname: str) -> str:
                 c_code = c_code + structbuild_template["set_arg_char"].format(
                     varname=varname, argname="arg5", arg=self.arg5
                 )
+                c_code = c_code + structbuild_template["set_arg_matchtype"].format(
+                    varname=varname, argname="arg5", matchtype=0 if self.arg5_matchtype == "full" else -1 if self.arg5_matchtype == "begins" else 1
+                )
             else:
                 c_code = c_code + structbuild_template["set_arg_long"].format(
                     varname=varname, argname="arg5", arg=self.arg5
@@ -200,21 +242,27 @@ def init_from_dict(parsed: dict):
         if parsed.get("arg0") is not None:
             call.arg0 = str(parsed.get("arg0"))
             call.arg0_char = bool(parsed.get("arg0_char"))
+            call.arg0_matchtype = str(parsed.get("arg0_matchtype"))
         if parsed.get("arg1") is not None:
             call.arg1 = str(parsed.get("arg1"))
             call.arg1_char = bool(parsed.get("arg1_char"))
+            call.arg1_matchtype = str(parsed.get("arg1_matchtype"))
         if parsed.get("arg2") is not None:
             call.arg2 = str(parsed.get("arg2"))
             call.arg2_char = bool(parsed.get("arg2_char"))
+            call.arg2_matchtype = str(parsed.get("arg2_matchtype"))
         if parsed.get("arg3") is not None:
             call.arg3 = str(parsed.get("arg3"))
             call.arg3_char = bool(parsed.get("arg3_char"))
+            call.arg3_matchtype = str(parsed.get("arg3_matchtype"))
         if parsed.get("arg4") is not None:
             call.arg4 = str(parsed.get("arg4"))
             call.arg4_char = bool(parsed.get("arg4_char"))
+            call.arg4_matchtype = str(parsed.get("arg4_matchtype"))
         if parsed.get("arg5") is not None:
             call.arg5 = str(parsed.get("arg5"))
             call.arg5_char = bool(parsed.get("arg5_char"))
+            call.arg5_matchtype = str(parsed.get("arg5_matchtype"))
         return call
 
 

src/main.c

@@ -15,12 +15,23 @@ has_flag(long search_flag, long all_flags) {
 }
 
 bool
-argcmp(long config_arg_long, char *config_arg_char, long sys_arg) {
+argcmp(int matchtype, long config_arg_long, char *config_arg_char, long sys_arg) {
     if (!config_arg_char && config_arg_long != -1) {
         return has_flag(config_arg_long, sys_arg);
     } else if (config_arg_char) {
-        if (strcmp((char *)sys_arg, config_arg_char) == 0) {
-            return true;
+        switch (matchtype) {
+        case -1:
+            return strncmp(config_arg_char, (char*)sys_arg, strlen(config_arg_char)) == 0;
+        case 0:
+            if (strcmp((char *)sys_arg, config_arg_char) == 0)
+                return true;
+            break;
+        case 1:
+            if (strstr((char *)sys_arg, config_arg_char) != NULL)
+                return true;
+            break;
+        default:
+            return false;
         }
     }
     return false;
@@ -30,22 +41,22 @@ bool
 match_args(syscall *call, long arg0, long arg1, long arg2, long arg3, long arg4, long arg5) {
     bool arg0_match = true, arg1_match = true, arg2_match = true, arg3_match = true, arg4_match = true, arg5_match = true;
     if (call->arg0 || call->arg0_long != -1) {
-        arg0_match = argcmp(call->arg0_long, call->arg0, arg0);
+        arg0_match = argcmp(call->arg0_matchtype, call->arg0_long, call->arg0, arg0);
     }
     if (call->arg1 || call->arg1_long != -1) {
-        arg1_match = argcmp(call->arg1_long, call->arg1, arg1);
+        arg1_match = argcmp(call->arg1_matchtype, call->arg1_long, call->arg1, arg1);
     }
     if (call->arg2 || call->arg2_long != -1) {
-        arg2_match = argcmp(call->arg2_long, call->arg2, arg2);
+        arg2_match = argcmp(call->arg2_matchtype, call->arg2_long, call->arg2, arg2);
     }
     if (call->arg3 || call->arg3_long != -1) {
-        arg3_match = argcmp(call->arg3_long, call->arg3, arg3);
+        arg3_match = argcmp(call->arg3_matchtype, call->arg3_long, call->arg3, arg3);
     }
     if (call->arg4 || call->arg4_long != -1) {
-        arg4_match = argcmp(call->arg4_long, call->arg4, arg4);
+        arg4_match = argcmp(call->arg4_matchtype, call->arg4_long, call->arg4, arg4);
     }
     if (call->arg5 || call->arg5_long != -1) {
-        arg5_match = argcmp(call->arg5_long, call->arg5, arg5);
+        arg5_match = argcmp(call->arg5_matchtype, call->arg5_long, call->arg5, arg5);
     }
 
     return arg0_match && arg1_match && arg2_match && arg3_match && arg4_match && arg5_match;