Module exec_record 

The image a process executes, which its /proc/<pid>/exe link names.

Detcore records it at each exec, on every backend, and checks it against the kernel’s own link when the exec completes (tool_global). Where the backend’s own procfs is not the guest’s kernel procfs (KVM), the caller’s own link (/proc/self/exe and its other spellings) is answered from the record while it still names exactly the image the process executes (ExecRecord::names_path_exactly; Detcore::readlink_own_task_link, package K slice E1); otherwise it is answered as before. Where the kernel’s link names a launcher in the guest’s place (SaBRe’s loader, DynamoRIO’s library; Detcore::launched_exe), the record answers every process’s link while the image is at its path, as before. The kernel’s link stands elsewhere.

Only the path is recorded. Where the image ends, which a program-break model would need, is known only once the image is loaded, and nothing reads it yet.

Structs

ElfLayout

What decides where Linux starts a process’s program break after it execs an ELF image (load_elf_binary, fs/binfmt_elf.c), from the image’s file header and program headers.

ExecRecord

The image a process executes.

Enums

BrkCheck

What Detcore found when it checked its model of a process’s program break (ElfLayout::start_brk) against the kernel’s start_brk.

Functions

auxv_entry

The value of entry key in an auxiliary vector read from /proc/<pid>/auxv as auxv, native-endian pairs ended by AT_NULL.

load_bias

The load bias of the image file at path with inode ino, in a process whose /proc/<pid>/maps reads maps: the start of the file’s executable mapping at the text segment’s offset less the text segment’s address (ElfLayout::text), or why there is none. The executable mapping, because a launcher may also map the file to read it (SaBRe’s rewriter maps it read-only at offset 0) and may not map the image’s first page at all. The file is matched by inode and its whole pathname as the reader sees it, not by device: maps shows the superblock’s device, which on btrfs and overlay is not the st_dev a stat of the file reports. Where several such mappings give different biases, there is no answer. This is how Detcore finds an image’s bias where the kernel exec’d a launcher, whose AT_PHDR the process’s auxiliary vector holds.

program_interpreter

The program interpreter (PT_INTERP) the ELF64 image at path names, which the kernel opens and maps at the exec (load_elf_binary, fs/binfmt_elf.c), or None for any other file, an image without one, and one the caller cannot read. Like the kernel, this refuses a name shorter than 2 or longer than PATH_MAX bytes or one whose last byte is not NUL, and the name is the string up to its first NUL, which open_exec opens.

stat_start_brk

The kernel’s start_brk in a /proc/<pid>/stat line: field 47, counted past the command, which may hold spaces and parentheses.