Improve visibility on the ioctl events

Motivation

This syscall can be handy to detect suspicious/malicious operations with network interfaces. To achieve this we need more details about the interface provided in the entry event: at the moment we see the memory address of the object (in the argument field).

for example, here an example of C code to set a network interface in promiscuos mode:

 ifr.ifr_flags |= IFF_PROMISC;

    if (ioctl(sock, SIOCSIFFLAGS, &ifr) == -1) {
        perror("Failed to set promiscuous mode");
        close(sock);
        exit(1);
    }

this is what we see in Falco:

14:19:29.179213999: Warning IOCTL event (evt.args=fd=3(<4>) request=8913 argument=7FFE4A0E97B0  fd.type=ipv4 fd.name= fd.sockfamily=ip proc.name=set-promiscous)
14:19:29.179219373: Warning IOCTL event (evt.args=fd=3(<4>) request=8914 argument=7FFE4A0E97B0  fd.type=ipv4 fd.name= fd.sockfamily=ip proc.name=set-promiscous)

Feature

in this case we might need to update the arguments to see the flags applied to the network interface and get only the malicious/suspicious ones.

Alternatives

Additional context

@Biagio-Dipalma

ei @Biagio-Dipalma! The request makes sense! We will try to schedule some time for this in the next release. For the moment I will put the milestone

/milestone TBD

Here I think we can only get socket relative ioctl cmd. Handling all possible ioctl commands for all possible devices would be a huge task.

I think we can reproduce in some way what sock_do_ioctl check if the cmd is relative to sockets is_socket_ioctl_cmd and then convert types to a PPM notation, WDYT?

Moving to 0.17.0.
/milestone 0.17.0

/milestone 0.18.0

We had no time to work on this during the 0.17.0 release cycle.

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

/remove-lifecycle stale

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

/remove-lifecycle stale

Navigation Menu

Repository navigation

Improve visibility on the `ioctl` events #1328

24 remaining items

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Improve visibility on the ioctl events #1328

Description

Activity

andreaterzolo commented on Sep 6, 2023

andreaterzolo commented on Sep 26, 2023

FedeDP commented on Apr 16, 2024

FedeDP commented on May 21, 2024

24 remaining items

poiana commented on Mar 19, 2026

ekoops commented on Apr 16, 2026

poiana commented on Jul 15, 2026

ekoops commented on Jul 17, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

Improve visibility on the `ioctl` events #1328