Skip to content

Syscalls str filter#30

Merged
lacraig2 merged 3 commits intomainfrom
syscalls_str_filter
Apr 6, 2026
Merged

Syscalls str filter#30
lacraig2 merged 3 commits intomainfrom
syscalls_str_filter

Conversation

@lacraig2
Copy link
Copy Markdown
Contributor

This pull request introduces support for string-based filtering in syscall hooks, adds robust string comparison helpers, and ensures proper memory management for dynamically allocated filter patterns. Additionally, it includes minor type and variable declaration improvements in the portal subsystem for clarity and correctness.

Syscall hook filtering improvements:

  • Added new string-based filter types to enum value_filter_type, enabling exact match, contains, startswith, and endswith comparisons for syscall argument and return value filtering.
  • Extended the struct value_filter to include a pattern pointer and its length for string comparisons.
  • Updated value_matches_filter to handle the new string filter types, invoking the appropriate helper for each.

String comparison helpers:

  • Introduced efficient, chunked string comparison helpers (check_str_exact, check_str_startswith, check_str_endswith, check_str_contains) to safely compare user-space strings from kernel space, minimizing stack usage and handling large strings.

Memory management:

  • Ensured that dynamically allocated string patterns in argument and return value filters are properly freed during syscall hook unregistration to prevent memory leaks.

Portal subsystem improvements:

  • Changed variable declarations in portal_get_vma_name to avoid shadowing and improve clarity; switched some types to const char * where appropriate. [1] [2] [3] [4]
  • Updated the type of copy_size in handle_op_copy_buf_guest to uint64_t for correctness and used min_t for type safety.

Other minor changes:

  • Included <linux/uaccess.h> in syscalls_hc.h to support user-space memory access in the new helpers.
  • Added a missing variable declaration (int i) in do_unregister_syscall_hook.

@lacraig2 lacraig2 force-pushed the syscalls_str_filter branch from 1320c03 to 9966724 Compare April 6, 2026 15:37
@lacraig2 lacraig2 merged commit e11507b into main Apr 6, 2026
1 check passed
@lacraig2 lacraig2 deleted the syscalls_str_filter branch April 6, 2026 15:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant