From baa23e09cd4e211b6f86c60479c8e2c4370d5435 Mon Sep 17 00:00:00 2001 From: Sylvain Afchain Date: Thu, 19 Dec 2024 17:51:41 +0100 Subject: [PATCH] [CWS] fix inode i_ino offset on aws kernel >= 6.8 (#32370) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> --- .../c/include/constants/offsets/filesystem.h | 5 +- .../ebpf/c/include/helpers/filesystem.h | 19 +- .../probe/constantfetch/btfhub/constants.json | 720 ++++++++++++++++++ .../probe/constantfetch/constant_names.go | 7 + pkg/security/probe/constantfetch/fallback.go | 30 + pkg/security/probe/probe_ebpf.go | 7 + .../resolvers/process/resolver_ebpf.go | 11 +- 7 files changed, 790 insertions(+), 9 deletions(-) diff --git a/pkg/security/ebpf/c/include/constants/offsets/filesystem.h b/pkg/security/ebpf/c/include/constants/offsets/filesystem.h index 24b2d5f769af1..797070a8534e7 100644 --- a/pkg/security/ebpf/c/include/constants/offsets/filesystem.h +++ b/pkg/security/ebpf/c/include/constants/offsets/filesystem.h @@ -9,8 +9,11 @@ struct mount; unsigned long __attribute__((always_inline)) get_inode_ino(struct inode *inode) { + u64 inode_ino_offset; + LOAD_CONSTANT("inode_ino_offset", inode_ino_offset); + unsigned long ino; - bpf_probe_read(&ino, sizeof(inode), &inode->i_ino); + bpf_probe_read(&ino, sizeof(inode), (void *)inode + inode_ino_offset); return ino; } diff --git a/pkg/security/ebpf/c/include/helpers/filesystem.h b/pkg/security/ebpf/c/include/helpers/filesystem.h index 07ca0431d7382..aca8413a89aab 100644 --- a/pkg/security/ebpf/c/include/helpers/filesystem.h +++ b/pkg/security/ebpf/c/include/helpers/filesystem.h @@ -102,10 +102,15 @@ void __attribute__((always_inline)) fill_file(struct dentry *dentry, struct file file->dev = get_dentry_dev(dentry); - bpf_probe_read(&file->metadata.nlink, sizeof(file->metadata.nlink), (void *)&d_inode->i_nlink); + u64 inode_nlink_offset; + LOAD_CONSTANT("inode_nlink_offset", inode_nlink_offset); + u64 inode_gid_offset; + LOAD_CONSTANT("inode_gid_offset", inode_gid_offset); + + bpf_probe_read(&file->metadata.nlink, sizeof(file->metadata.nlink), (void *)d_inode + inode_nlink_offset); bpf_probe_read(&file->metadata.mode, sizeof(file->metadata.mode), &d_inode->i_mode); bpf_probe_read(&file->metadata.uid, sizeof(file->metadata.uid), &d_inode->i_uid); - bpf_probe_read(&file->metadata.gid, sizeof(file->metadata.gid), &d_inode->i_gid); + bpf_probe_read(&file->metadata.gid, sizeof(file->metadata.gid), (void *)d_inode + inode_gid_offset); u64 inode_ctime_sec_offset; LOAD_CONSTANT("inode_ctime_sec_offset", inode_ctime_sec_offset); @@ -121,7 +126,10 @@ void __attribute__((always_inline)) fill_file(struct dentry *dentry, struct file #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 6, 0) bpf_probe_read(&file->metadata.ctime, sizeof(file->metadata.ctime), &d_inode->i_ctime); #elif LINUX_VERSION_CODE < KERNEL_VERSION(6, 11, 0) - bpf_probe_read(&file->metadata.ctime, sizeof(file->metadata.ctime), &d_inode->__i_ctime); + u64 inode_ctime_offset; + LOAD_CONSTANT("inode_ctime_offset", inode_ctime_offset); + + bpf_probe_read(&file->metadata.ctime, sizeof(file->metadata.ctime), (void *)d_inode + inode_ctime_offset); #else bpf_probe_read(&file->metadata.ctime.tv_sec, sizeof(file->metadata.ctime.tv_sec), &d_inode->i_ctime_sec); bpf_probe_read(&file->metadata.ctime.tv_nsec, sizeof(file->metadata.ctime.tv_nsec), &d_inode->i_ctime_nsec); @@ -142,7 +150,10 @@ void __attribute__((always_inline)) fill_file(struct dentry *dentry, struct file #if LINUX_VERSION_CODE < KERNEL_VERSION(6, 7, 0) bpf_probe_read(&file->metadata.mtime, sizeof(file->metadata.mtime), &d_inode->i_mtime); #elif LINUX_VERSION_CODE < KERNEL_VERSION(6, 11, 0) - bpf_probe_read(&file->metadata.mtime, sizeof(file->metadata.mtime), &d_inode->__i_mtime); + u64 inode_mtime_offset; + LOAD_CONSTANT("inode_mtime_offset", inode_mtime_offset); + + bpf_probe_read(&file->metadata.mtime, sizeof(file->metadata.mtime), (void *)d_inode + inode_mtime_offset); #else bpf_probe_read(&file->metadata.mtime.tv_sec, sizeof(file->metadata.mtime.tv_sec), &d_inode->i_mtime_sec); bpf_probe_read(&file->metadata.mtime.tv_nsec, sizeof(file->metadata.mtime.tv_nsec), &d_inode->i_mtime_nsec); diff --git a/pkg/security/probe/constantfetch/btfhub/constants.json b/pkg/security/probe/constantfetch/btfhub/constants.json index abf445a40119a..d555e9f30ad21 100644 --- a/pkg/security/probe/constantfetch/btfhub/constants.json +++ b/pkg/security/probe/constantfetch/btfhub/constants.json @@ -20,6 +20,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -66,6 +69,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -112,6 +118,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -158,6 +167,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -204,6 +216,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -250,6 +265,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -296,6 +314,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -342,6 +363,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -388,6 +412,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -434,6 +461,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -477,6 +507,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -520,6 +553,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -566,6 +602,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -612,6 +651,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -658,6 +700,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -704,6 +749,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -750,6 +798,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -792,6 +843,9 @@ "flowi4_uli_offset": 28, "flowi6_saddr_offset": 36, "flowi6_uli_offset": 56, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -833,6 +887,9 @@ "flowi4_uli_offset": 28, "flowi6_saddr_offset": 36, "flowi6_uli_offset": 56, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -873,6 +930,9 @@ "flowi4_uli_offset": 28, "flowi6_saddr_offset": 36, "flowi6_uli_offset": 56, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -915,6 +975,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -959,6 +1022,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -1003,6 +1069,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -1050,6 +1119,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -1095,6 +1167,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -1140,6 +1215,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -1185,6 +1263,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -1230,6 +1311,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -1277,6 +1361,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -1323,6 +1410,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -1363,6 +1453,9 @@ "flowi4_uli_offset": 28, "flowi6_saddr_offset": 36, "flowi6_uli_offset": 56, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -1404,6 +1497,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -1451,6 +1547,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -1498,6 +1597,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -1545,6 +1647,9 @@ "flowi4_uli_offset": 28, "flowi6_saddr_offset": 36, "flowi6_uli_offset": 56, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -1592,6 +1697,9 @@ "flowi4_uli_offset": 28, "flowi6_saddr_offset": 36, "flowi6_uli_offset": 56, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -1640,6 +1748,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -1686,6 +1797,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -1732,6 +1846,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -1780,6 +1897,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -1827,6 +1947,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -1876,6 +1999,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -1925,6 +2051,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -1973,6 +2102,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2021,6 +2153,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2069,6 +2204,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2117,6 +2255,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2165,6 +2306,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2213,6 +2357,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2261,6 +2408,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2309,6 +2459,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2357,6 +2510,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -2406,6 +2562,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -2455,6 +2614,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -2504,6 +2666,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -2553,6 +2718,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2601,6 +2769,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2649,6 +2820,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2697,6 +2871,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2745,6 +2922,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2793,6 +2973,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2841,6 +3024,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2889,6 +3075,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2937,6 +3126,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -2985,6 +3177,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -3034,6 +3229,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -3083,6 +3281,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -3132,6 +3333,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -3175,6 +3379,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3218,6 +3425,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3261,6 +3471,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3305,6 +3518,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3348,6 +3564,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3394,6 +3613,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3437,6 +3659,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3481,6 +3706,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3529,6 +3757,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3578,6 +3809,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3626,6 +3860,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3675,6 +3912,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 200, "linux_binprm_envc_offset": 204, "linux_binprm_p_offset": 152, @@ -3722,6 +3962,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3771,6 +4014,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 200, "linux_binprm_envc_offset": 204, "linux_binprm_p_offset": 152, @@ -3819,6 +4065,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -3868,6 +4117,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -3918,6 +4170,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -3968,6 +4223,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -4017,6 +4275,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -4066,6 +4327,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -4116,6 +4380,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -4163,6 +4430,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -4212,6 +4482,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -4262,6 +4535,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -4312,6 +4588,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -4359,6 +4638,9 @@ "flowi4_uli_offset": 28, "flowi6_saddr_offset": 36, "flowi6_uli_offset": 56, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -4401,6 +4683,9 @@ "flowi4_uli_offset": 28, "flowi6_saddr_offset": 36, "flowi6_uli_offset": 56, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -4447,6 +4732,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -4493,6 +4781,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -4542,6 +4833,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -4592,6 +4886,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -4642,6 +4939,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -4692,6 +4992,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -4742,6 +5045,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -4789,6 +5095,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -4838,6 +5147,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -4888,6 +5200,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -4935,6 +5250,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -4984,6 +5302,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -5031,6 +5352,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -5077,6 +5401,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -5123,6 +5450,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -5170,6 +5500,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -5217,6 +5550,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -5264,6 +5600,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -5313,6 +5652,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -5363,6 +5705,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -5413,6 +5758,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -5463,6 +5811,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -5513,6 +5864,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -5563,6 +5917,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -5608,6 +5965,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -5652,6 +6012,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -5698,6 +6061,9 @@ "flowi4_uli_offset": 28, "flowi6_saddr_offset": 36, "flowi6_uli_offset": 56, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -5745,6 +6111,9 @@ "flowi4_uli_offset": 28, "flowi6_saddr_offset": 36, "flowi6_uli_offset": 56, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -5793,6 +6162,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -5840,6 +6212,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -5889,6 +6264,9 @@ "flowi4_uli_offset": 64, "flowi6_saddr_offset": 72, "flowi6_uli_offset": 92, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 320, "linux_binprm_envc_offset": 324, "linux_binprm_p_offset": 280, @@ -5932,6 +6310,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -5975,6 +6356,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6021,6 +6405,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6067,6 +6454,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6114,6 +6504,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6160,6 +6553,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6207,6 +6603,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6256,6 +6655,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -6306,6 +6708,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -6356,6 +6761,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -6406,6 +6814,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -6451,6 +6862,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6495,6 +6909,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6539,6 +6956,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6583,6 +7003,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6629,6 +7052,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6677,6 +7103,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6725,6 +7154,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6773,6 +7205,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6821,6 +7256,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6869,6 +7307,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6917,6 +7358,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -6965,6 +7409,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7014,6 +7461,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7057,6 +7507,9 @@ "flowi4_uli_offset": 28, "flowi6_saddr_offset": 36, "flowi6_uli_offset": 56, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7100,6 +7553,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7143,6 +7599,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7186,6 +7645,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7229,6 +7691,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7272,6 +7737,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7315,6 +7783,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7358,6 +7829,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7401,6 +7875,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7444,6 +7921,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7487,6 +7967,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7530,6 +8013,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7573,6 +8059,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7616,6 +8105,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7659,6 +8151,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7702,6 +8197,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7745,6 +8243,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7791,6 +8292,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7839,6 +8343,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7887,6 +8394,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7936,6 +8446,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -7985,6 +8498,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 200, "linux_binprm_envc_offset": 204, "linux_binprm_p_offset": 152, @@ -8033,6 +8549,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 200, "linux_binprm_envc_offset": 204, "linux_binprm_p_offset": 152, @@ -8081,6 +8600,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 200, "linux_binprm_envc_offset": 204, "linux_binprm_p_offset": 152, @@ -8129,6 +8651,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -8179,6 +8704,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -8229,6 +8757,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -8279,6 +8810,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -8329,6 +8863,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -8376,6 +8913,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -8424,6 +8964,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -8472,6 +9015,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -8520,6 +9066,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -8568,6 +9117,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -8616,6 +9168,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -8664,6 +9219,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -8713,6 +9271,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -8762,6 +9323,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -8811,6 +9375,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 192, "linux_binprm_envc_offset": 196, "linux_binprm_p_offset": 152, @@ -8860,6 +9427,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 200, "linux_binprm_envc_offset": 204, "linux_binprm_p_offset": 152, @@ -8908,6 +9478,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 200, "linux_binprm_envc_offset": 204, "linux_binprm_p_offset": 152, @@ -8956,6 +9529,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 200, "linux_binprm_envc_offset": 204, "linux_binprm_p_offset": 152, @@ -9004,6 +9580,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 200, "linux_binprm_envc_offset": 204, "linux_binprm_p_offset": 152, @@ -9052,6 +9631,9 @@ "flowi4_uli_offset": 40, "flowi6_saddr_offset": 48, "flowi6_uli_offset": 68, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "linux_binprm_argc_offset": 200, "linux_binprm_envc_offset": 204, "linux_binprm_p_offset": 152, @@ -9100,6 +9682,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9150,6 +9735,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9200,6 +9788,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9250,6 +9841,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9300,6 +9894,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9350,6 +9947,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9400,6 +10000,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9450,6 +10053,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9500,6 +10106,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9550,6 +10159,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9600,6 +10212,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9650,6 +10265,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9700,6 +10318,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9750,6 +10371,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -9799,6 +10423,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -9848,6 +10475,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9898,6 +10528,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9948,6 +10581,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -9998,6 +10634,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10048,6 +10687,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10098,6 +10740,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -10147,6 +10792,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -10196,6 +10844,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -10245,6 +10896,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -10294,6 +10948,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -10343,6 +11000,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10393,6 +11053,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10443,6 +11106,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10493,6 +11159,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10543,6 +11212,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10593,6 +11265,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 88, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10643,6 +11318,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10693,6 +11371,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10743,6 +11424,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10793,6 +11477,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10843,6 +11530,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10893,6 +11583,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10943,6 +11636,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -10993,6 +11689,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -11043,6 +11742,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 96, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 72, @@ -11093,6 +11795,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -11142,6 +11847,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -11191,6 +11899,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -11240,6 +11951,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -11289,6 +12003,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, @@ -11338,6 +12055,9 @@ "flowi4_uli_offset": 48, "flowi6_saddr_offset": 56, "flowi6_uli_offset": 76, + "inode_gid_offset": 8, + "inode_ino_offset": 64, + "inode_nlink_offset": 72, "iokiocb_ctx_offset": 80, "kernel_clone_args_exit_signal_offset": 32, "linux_binprm_argc_offset": 88, diff --git a/pkg/security/probe/constantfetch/constant_names.go b/pkg/security/probe/constantfetch/constant_names.go index 2feab9c5e0402..80d8b57c04a25 100644 --- a/pkg/security/probe/constantfetch/constant_names.go +++ b/pkg/security/probe/constantfetch/constant_names.go @@ -31,6 +31,13 @@ const ( OffsetNameDentryDSb = "dentry_d_sb_offset" OffsetNameMountMntID = "mount_id_offset" + // inode + OffsetInodeIno = "inode_ino_offset" + OffsetInodeNlink = "inode_nlink_offset" + OffsetInodeGid = "inode_gid_offset" + OffsetInodeMtime = "inode_mtime_offset" + OffsetInodeCtime = "inode_ctime_offset" + // inode times OffsetNameInodeCtimeSec = "inode_ctime_sec_offset" OffsetNameInodeCtimeNsec = "inode_ctime_nsec_offset" diff --git a/pkg/security/probe/constantfetch/fallback.go b/pkg/security/probe/constantfetch/fallback.go index 531edb59c29d3..3b48f14d1a5eb 100644 --- a/pkg/security/probe/constantfetch/fallback.go +++ b/pkg/security/probe/constantfetch/fallback.go @@ -147,6 +147,16 @@ func (f *FallbackConstantFetcher) appendRequest(id string) { value = getRenameStructOldDentryOffset(f.kernelVersion) case OffsetNameRenameStructNewDentry: value = getRenameStructNewDentryOffset(f.kernelVersion) + case OffsetInodeIno: + value = getInodeInoOffset(f.kernelVersion) + case OffsetInodeGid: + value = getInodeGIDOffset(f.kernelVersion) + case OffsetInodeNlink: + value = getInodeNlinkOffset(f.kernelVersion) + case OffsetInodeMtime: + value = getInodeMtimeOffset(f.kernelVersion) + case OffsetInodeCtime: + value = getInodeCtimeOffset(f.kernelVersion) } f.res[id] = value } @@ -236,6 +246,26 @@ func getSizeOfStructInode(kv *kernel.Version) uint64 { return sizeOf } +func getInodeInoOffset(_ *kernel.Version) uint64 { + return uint64(64) +} + +func getInodeGIDOffset(_ *kernel.Version) uint64 { + return uint64(8) +} + +func getInodeNlinkOffset(_ *kernel.Version) uint64 { + return uint64(72) +} + +func getInodeMtimeOffset(_ *kernel.Version) uint64 { + return uint64(104) +} + +func getInodeCtimeOffset(_ *kernel.Version) uint64 { + return uint64(120) +} + func getSuperBlockFlagsOffset(_ *kernel.Version) uint64 { return uint64(80) } diff --git a/pkg/security/probe/probe_ebpf.go b/pkg/security/probe/probe_ebpf.go index 5fd26b4f63f8a..c519c712f6fc0 100644 --- a/pkg/security/probe/probe_ebpf.go +++ b/pkg/security/probe/probe_ebpf.go @@ -2521,6 +2521,13 @@ func AppendProbeRequestsToFetcher(constantFetcher constantfetch.ConstantFetcher, if kv.Code != 0 && (kv.Code >= kernel.Kernel5_1) { constantFetcher.AppendOffsetofRequest(constantfetch.OffsetNameIoKiocbStructCtx, "struct io_kiocb", "ctx", "") } + + // inode + constantFetcher.AppendOffsetofRequest(constantfetch.OffsetInodeIno, "struct inode", "i_ino", "linux/fs.h") + constantFetcher.AppendOffsetofRequest(constantfetch.OffsetInodeGid, "struct inode", "i_gid", "linux/fs.h") + constantFetcher.AppendOffsetofRequest(constantfetch.OffsetInodeNlink, "struct inode", "i_nlink", "linux/fs.h") + constantFetcher.AppendOffsetofRequest(constantfetch.OffsetInodeMtime, "struct inode", "__i_mtime", "linux/fs.h") + constantFetcher.AppendOffsetofRequest(constantfetch.OffsetInodeCtime, "struct inode", "__i_ctime", "linux/fs.h") } // HandleActions handles the rule actions diff --git a/pkg/security/resolvers/process/resolver_ebpf.go b/pkg/security/resolvers/process/resolver_ebpf.go index 409ab86fc2da7..030b022a01c4a 100644 --- a/pkg/security/resolvers/process/resolver_ebpf.go +++ b/pkg/security/resolvers/process/resolver_ebpf.go @@ -334,6 +334,9 @@ func (p *EBPFResolver) enrichEventFromProc(entry *model.ProcessCacheEntry, proc // Get the file fields of the process binary info, err := p.retrieveExecFileFields(procExecPath) if err != nil { + if !os.IsNotExist(err) { + seclog.Errorf("snapshot failed for %d: couldn't retrieve inode info: %s", proc.Pid, err) + } return fmt.Errorf("snapshot failed for %d: couldn't retrieve inode info: %w", proc.Pid, err) } @@ -465,11 +468,11 @@ func (p *EBPFResolver) enrichEventFromProc(entry *model.ProcessCacheEntry, proc func (p *EBPFResolver) retrieveExecFileFields(procExecPath string) (*model.FileFields, error) { fi, err := os.Stat(procExecPath) if err != nil { - return nil, fmt.Errorf("snapshot failed for `%s`: couldn't stat binary: %w", procExecPath, err) + return nil, err } stat, ok := fi.Sys().(*syscall.Stat_t) if !ok { - return nil, fmt.Errorf("snapshot failed for `%s`: couldn't stat binary", procExecPath) + return nil, errors.New("wrong type") } inode := stat.Ino @@ -483,11 +486,11 @@ func (p *EBPFResolver) retrieveExecFileFields(procExecPath string) (*model.FileF var fileFields model.FileFields if _, err := fileFields.UnmarshalBinary(data); err != nil { - return nil, fmt.Errorf("unable to unmarshal entry for inode `%d`", inode) + return nil, fmt.Errorf("unable to unmarshal entry for inode `%d`: %v", inode, err) } if fileFields.Inode == 0 { - return nil, errors.New("not found") + return nil, fmt.Errorf("inode `%d` not found: %v", inode, err) } return &fileFields, nil