Environment
- EDR Linux Sensor: 7.0 to 7.2
- RHEL/CentOS: 7 and 8
Question
On Linux sensors, why does the recorded path include ellipsis?
Answer
For kernel module :
When the path or command line goes beyond the max number of characters, Linux OS returns an error.
In this case, kmod includes ellipsis (...) in the path, to inform the user space about path truncation.
The full path can be determined using native Linux commands. Due to possible performance issues, this is not performed by the sensor.
For BPF based systems :
The path, or command line, is limited by the number of instructions supported by BPF and validation by BPF verifier. Newer kernels support longer paths.
Essentially, the ability to support arbitrarily long paths is an OS technical limitation and the ellipses provides notification that the limit was reached.
Additional Notes
- Native Linux tools, like 'find', via remote access or Live Response could be used to identify the full path.
