Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Packetbeat] - Sniffer failed to start (linux/386 binary on x86_64) with seccomp #7839

Closed
andrewkroh opened this issue Aug 2, 2018 · 0 comments
Closed

[Packetbeat] - Sniffer failed to start (linux/386 binary on x86_64) with seccomp #7839

andrewkroh opened this issue Aug 2, 2018 · 0 comments
Labels
bug Packetbeat

Comments

@andrewkroh
Copy link
Member

andrewkroh commented Aug 2, 2018 •
edited
Loading

Packetbeat 32-bit on Debian 9 (x86_64) fails to start the sniffer when running with seccomp enabled.

2018-06-07T14:33:10.103Z ERROR instance/beat.go:714 Exiting: Sniffer main loop failed: Error starting sniffer: can't get FD flags when changing filter: Operation not permitted

Auditbeat was also reporting the seccomp violation.

{
  "@timestamp": "2018-06-07T14:57:06.350Z",
  "@metadata": {
    "beat": "auditbeat",
    "type": "doc",
    "version": "7.0.0-alpha1"
  },
  "event": {
    "category": "dac-decision",
    "type": "seccomp",
    "action": "violated-seccomp-policy",
    "module": "auditd"
  },
  "user": {
    "gid": "0",
    "auid": "unset",
    "name_map": {
      "gid": "root",
      "uid": "root"
    },
    "uid": "0"
  },
  "process": {
    "pid": "30690",
    "name": "packetbeat",
    "exe": "/beats/packetbeat/build/distributions/packetbeat-7.0.0-alpha1-SNAPSHOT-linux-x86/packetbeat"
  },
  "auditd": {
    "data": {
      "code": "0x50000",
      "sig": "0",
      "syscall": "221",
      "compat": "1",
      "ip": "0xf775ab49",
      "arch": "40000003"
    },
    "summary": {
      "actor": {
        "primary": "unset",
        "secondary": "root"
      },
      "object": {
        "primary": "221",
        "type": "process"
      },
      "how": "/beats/packetbeat/build/distributions/packetbeat-7.0.0-alpha1-SNAPSHOT-linux-x86/packetbeat"
    },
    "sequence": 7,
    "result": "unknown",
    "session": "unset"
  },
  "beat": {
    "name": "a271a8ba1505",
    "hostname": "a271a8ba1505",
    "version": "7.0.0-alpha1"
  },
  "host": {
    "name": "a271a8ba1505"
  }
}

For confirmed bugs, please report:

  • Version: Packetbeat 6.4 and master for linux/386
  • Operating System: Debian 9 on x86_64
  • Steps to Reproduce: Start Packetbeat with seccomp enabled (default).
andrewkroh added a commit to andrewkroh/beats that referenced this issue Aug 2, 2018
@andrewkroh
Add fcntl64 to the default seccomp policy for 32-bit binaries
de97e48 
Fixes elastic#7839

I received an error while running the 32-bit Packetbeat binary on a 64-bit Debian 9 OS.

```
2018-06-07T14:33:10.103Z    ERROR    instance/beat.go:714    Exiting: Sniffer main loop failed: Error starting sniffer: can't get FD flags when changing filter: Operation not permitted
```

When the error occurred this is what Auditbeat reported. 0x40000003 is i386 and 221 is fcntl64.

```
{
  "event": {
    "category": "dac-decision",
    "type": "seccomp",
    "action": "violated-seccomp-policy",
    "module": "auditd"
  },
  "process": {
    "pid": "30690",
    "name": "packetbeat",
    "exe": "/beats/packetbeat/build/distributions/packetbeat-7.0.0-alpha1-SNAPSHOT-linux-x86/packetbeat"
  },
  "auditd": {
    "data": {
      "code": "0x50000",
      "sig": "0",
      "syscall": "221",
      "compat": "1",
      "ip": "0xf775ab49",
      "arch": "40000003"
    }
  }
}
```
@andrewkroh andrewkroh mentioned this issue Aug 2, 2018
Merged
@andrewkroh andrewkroh changed the title Packetbeat - Sniffer failed to start (linux/386 binary on x86_64) with seccomp [Packetbeat] - Sniffer failed to start (linux/386 binary on x86_64) with seccomp Aug 2, 2018
ruflin pushed a commit that referenced this issue Aug 8, 2018
@andrewkroh @ruflin
Add fcntl64 to the default seccomp policy for 32-bit binaries (#7840)
c4e7b13 
Fixes #7839

I received an error while running the 32-bit Packetbeat binary on a 64-bit Debian 9 OS.

```
2018-06-07T14:33:10.103Z    ERROR    instance/beat.go:714    Exiting: Sniffer main loop failed: Error starting sniffer: can't get FD flags when changing filter: Operation not permitted
```

When the error occurred this is what Auditbeat reported. 0x40000003 is i386 and 221 is fcntl64.

```
{
  "event": {
    "category": "dac-decision",
    "type": "seccomp",
    "action": "violated-seccomp-policy",
    "module": "auditd"
  },
  "process": {
    "pid": "30690",
    "name": "packetbeat",
    "exe": "/beats/packetbeat/build/distributions/packetbeat-7.0.0-alpha1-SNAPSHOT-linux-x86/packetbeat"
  },
  "auditd": {
    "data": {
      "code": "0x50000",
      "sig": "0",
      "syscall": "221",
      "compat": "1",
      "ip": "0xf775ab49",
      "arch": "40000003"
    }
  }
}
```
andrewkroh added a commit to andrewkroh/beats that referenced this issue Aug 8, 2018
@andrewkroh
Add fcntl64 to the default seccomp policy for 32-bit binaries (elasti…
89907c4 
…c#7840)

Fixes elastic#7839

I received an error while running the 32-bit Packetbeat binary on a 64-bit Debian 9 OS.

```
2018-06-07T14:33:10.103Z    ERROR    instance/beat.go:714    Exiting: Sniffer main loop failed: Error starting sniffer: can't get FD flags when changing filter: Operation not permitted
```

When the error occurred this is what Auditbeat reported. 0x40000003 is i386 and 221 is fcntl64.

```
{
  "event": {
    "category": "dac-decision",
    "type": "seccomp",
    "action": "violated-seccomp-policy",
    "module": "auditd"
  },
  "process": {
    "pid": "30690",
    "name": "packetbeat",
    "exe": "/beats/packetbeat/build/distributions/packetbeat-7.0.0-alpha1-SNAPSHOT-linux-x86/packetbeat"
  },
  "auditd": {
    "data": {
      "code": "0x50000",
      "sig": "0",
      "syscall": "221",
      "compat": "1",
      "ip": "0xf775ab49",
      "arch": "40000003"
    }
  }
}
```

(cherry picked from commit c4e7b13)
@andrewkroh andrewkroh mentioned this issue Aug 8, 2018
Merged
andrewkroh added a commit to andrewkroh/beats that referenced this issue Aug 8, 2018
@andrewkroh
Add fcntl64 to the default seccomp policy for 32-bit binaries (elasti…
6728286 
…c#7840)

Fixes elastic#7839

I received an error while running the 32-bit Packetbeat binary on a 64-bit Debian 9 OS.

```
2018-06-07T14:33:10.103Z    ERROR    instance/beat.go:714    Exiting: Sniffer main loop failed: Error starting sniffer: can't get FD flags when changing filter: Operation not permitted
```

When the error occurred this is what Auditbeat reported. 0x40000003 is i386 and 221 is fcntl64.

```
{
  "event": {
    "category": "dac-decision",
    "type": "seccomp",
    "action": "violated-seccomp-policy",
    "module": "auditd"
  },
  "process": {
    "pid": "30690",
    "name": "packetbeat",
    "exe": "/beats/packetbeat/build/distributions/packetbeat-7.0.0-alpha1-SNAPSHOT-linux-x86/packetbeat"
  },
  "auditd": {
    "data": {
      "code": "0x50000",
      "sig": "0",
      "syscall": "221",
      "compat": "1",
      "ip": "0xf775ab49",
      "arch": "40000003"
    }
  }
}
```

(cherry picked from commit c4e7b13)
@andrewkroh andrewkroh mentioned this issue Aug 8, 2018
Merged
adriansr pushed a commit that referenced this issue Aug 9, 2018
@andrewkroh @adriansr
Add fcntl64 to the default seccomp policy for 32-bit binaries (#7840)
48be801 
Fixes #7839

I received an error while running the 32-bit Packetbeat binary on a 64-bit Debian 9 OS.

```
2018-06-07T14:33:10.103Z    ERROR    instance/beat.go:714    Exiting: Sniffer main loop failed: Error starting sniffer: can't get FD flags when changing filter: Operation not permitted
```

When the error occurred this is what Auditbeat reported. 0x40000003 is i386 and 221 is fcntl64.

```
{
  "event": {
    "category": "dac-decision",
    "type": "seccomp",
    "action": "violated-seccomp-policy",
    "module": "auditd"
  },
  "process": {
    "pid": "30690",
    "name": "packetbeat",
    "exe": "/beats/packetbeat/build/distributions/packetbeat-7.0.0-alpha1-SNAPSHOT-linux-x86/packetbeat"
  },
  "auditd": {
    "data": {
      "code": "0x50000",
      "sig": "0",
      "syscall": "221",
      "compat": "1",
      "ip": "0xf775ab49",
      "arch": "40000003"
    }
  }
}
```

(cherry picked from commit c4e7b13)
jsoriano pushed a commit that referenced this issue Aug 17, 2018
@andrewkroh @jsoriano
Add fcntl64 to the default seccomp policy for 32-bit binaries (#7840) (…
04611dd 
…#7918)

Fixes #7839

I received an error while running the 32-bit Packetbeat binary on a 64-bit Debian 9 OS.

```
2018-06-07T14:33:10.103Z    ERROR    instance/beat.go:714    Exiting: Sniffer main loop failed: Error starting sniffer: can't get FD flags when changing filter: Operation not permitted
```

When the error occurred this is what Auditbeat reported. 0x40000003 is i386 and 221 is fcntl64.

```
{
  "event": {
    "category": "dac-decision",
    "type": "seccomp",
    "action": "violated-seccomp-policy",
    "module": "auditd"
  },
  "process": {
    "pid": "30690",
    "name": "packetbeat",
    "exe": "/beats/packetbeat/build/distributions/packetbeat-7.0.0-alpha1-SNAPSHOT-linux-x86/packetbeat"
  },
  "auditd": {
    "data": {
      "code": "0x50000",
      "sig": "0",
      "syscall": "221",
      "compat": "1",
      "ip": "0xf775ab49",
      "arch": "40000003"
    }
  }
}
```

(cherry picked from commit c4e7b13)
leweafan pushed a commit to leweafan/beats that referenced this issue Apr 28, 2023
@andrewkroh @adriansr
Add fcntl64 to the default seccomp policy for 32-bit binaries (elasti…
ae218ba 
…c#7840)

Fixes elastic#7839

I received an error while running the 32-bit Packetbeat binary on a 64-bit Debian 9 OS.

```
2018-06-07T14:33:10.103Z    ERROR    instance/beat.go:714    Exiting: Sniffer main loop failed: Error starting sniffer: can't get FD flags when changing filter: Operation not permitted
```

When the error occurred this is what Auditbeat reported. 0x40000003 is i386 and 221 is fcntl64.

```
{
  "event": {
    "category": "dac-decision",
    "type": "seccomp",
    "action": "violated-seccomp-policy",
    "module": "auditd"
  },
  "process": {
    "pid": "30690",
    "name": "packetbeat",
    "exe": "/beats/packetbeat/build/distributions/packetbeat-7.0.0-alpha1-SNAPSHOT-linux-x86/packetbeat"
  },
  "auditd": {
    "data": {
      "code": "0x50000",
      "sig": "0",
      "syscall": "221",
      "compat": "1",
      "ip": "0xf775ab49",
      "arch": "40000003"
    }
  }
}
```

(cherry picked from commit f397916)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug Packetbeat
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@andrewkroh