chore: add events triggers (scripts)

Author: geyslan

cmd/evt/cmd/trigger/triggers/arch_prctl.sh

@@ -0,0 +1 @@
+common/true.sh

cmd/evt/cmd/trigger/triggers/bpf_attach.sh

@@ -0,0 +1 @@
+common/bpftrace.sh

cmd/evt/cmd/trigger/triggers/commit_creds.sh

@@ -0,0 +1 @@
+common/sudo.sh

cmd/evt/cmd/trigger/triggers/common/bpftrace.sh

@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# common
+
+# security_file_open   60
+# shared_object_loaded 44
+# sched_process_exec    2
+# arch_prctl            2
+# security_bpf_prog     4
+# kallsyms_lookup_name  2
+# kprobe_attach         1
+# bpf_attach            1
+# sched_process_exit    2
+
+bpftrace -e 'kprobe:__do_sys_vfork { }' &
+bpftrace_pid=$!
+sleep 3
+kill -KILL $bpftrace_pid

cmd/evt/cmd/trigger/triggers/common/docker.sh

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+# common
+
+sh -c 'docker run --rm -it ubuntu /bin/bash'

cmd/evt/cmd/trigger/triggers/common/mktemp-ln-rm.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+
+# common
+
+# sched_process_exec      5
+# security_file_open     17
+# shared_object_loaded    5
+# arch_prctl              5
+# security_inode_unlink   3
+# security_inode_symlink  1
+# sched_process_exit      5
+
+file=$(mktemp /tmp/fileXXXXXX)
+link1=$(mktemp /tmp/link1XXXXXX)
+
+rm -f "$link1"
+
+ln -s "$file" "$link1"
+rm "$file" "$link1"

cmd/evt/cmd/trigger/triggers/common/ping.sh

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+# common
+
+# sched_process_exec      1
+# security_file_open      8
+# shared_object_loaded    4
+# arch_prctl              1
+# security_socket_create  3
+# security_socket_connect 1
+# sched_process_exit      1
+
+ping 0.0.0.0 -c 1

cmd/evt/cmd/trigger/triggers/common/self-comm.sh

@@ -0,0 +1,11 @@
+#!/bin/sh
+
+# common
+
+# magic_write        2
+# security_file_open 1
+# do_truncate        1
+# sched_process_exit 1
+
+echo "fake-comm" > /proc/self/comm # trigger magic-write by fake-comm
+echo "fake-comm" > /proc/self/comm # trigger do_truncate by fake-comm

cmd/evt/cmd/trigger/triggers/common/sudo.sh

@@ -0,0 +1,15 @@
+#!/bin/sh
+
+# common
+
+# sched_process_exec       3
+# security_file_open     113
+# shared_object_loaded    40
+# arch_prctl               3
+# security_socket_create  19
+# commit_creds             4
+# sched_process_fork       3
+# sched_process_exit       3
+# socket_dup               2
+
+sudo echo sudo >/dev/null

cmd/evt/cmd/trigger/triggers/common/timeout-nc.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+# sched_process_exec      2
+# security_file_open     11
+# shared_object_loaded    2
+# arch_prctl              2
+# security_file_open     12
+# sched_process_fork      1
+# process_execute_failed  5 (the amount of wrong PATH entries)
+# security_socket_create  1
+# security_socket_bind    1
+# sched_process_exit      2
+
+basename=$(basename "$0")
+socket_path=$(mktemp -u /tmp/"$basename"_XXXXXX)
+timeout 0.1 nc -l -U "$socket_path"
+rm -f "$socket_path"