Feature request: Command cwd

[mahdi-jfri]

Is it possible to extract command cwd and have them in the event?

[matthill]

Kind of, there's some interesting limitations here.

This would need to be read inside the BPF code which operates in the kernel. In that code, the limitations are very strict. The function that would read this data is:
static int sys_enter_exec_common(struct trace_event_raw_sys_enter* ctx) {
// field:const char * filename; offset:16; size:8; signed:0;
// field:const char *const * argv; offset:24; size:8; signed:0;
// field:const char *const * envp; offset:32; size:8; signed:0;

The current_task (task_struct) $\rightarrow$ fs (fs_struct) $\rightarrow$ pwd (path)

Will point to the last folder. For example if cwd was /home/mahdi/Downloads this will give you the value "Downloads"

You can technically walk up the tree to keep pulling the parents, however, you can't do it in a loop, all the loops have to be constrained by some maximum and unrolled. After unrolling the total instructions need to be below a particular value (e.g., 4096) or it won't compile.

So, let's say you need to restrict it to 7 iterations to fit the code in the kernel, then the working directory /a/b/c/d/e/f/g/h/i/j/k/l/m/ would be reported as g/h/i/j/k/l/m/ -- it would stop resolving parents after it hit 7 iterations.

And that iteration value would go down in the future if other code needed to also fit in that function.

Given the constraints, is the feature still worth doing if it's not 100% reliable that you will get the full directory path?