A PoC tty tracker that allows filtering out known good processes

tty_tracker_with_filters.stp

#! /usr/bin/env stap

global allowed_ttys;  //holds a list of processes allowed to generate ttys

probe begin
{
	println("Tracking spawned TTYs...");
	allowed_ttys["sshd"] <<<1;
	allowed_ttys["gnome-pty-helpe"] <<<1;
}

function is_allowed(proc_to_check)
{
	rcode = 1;
	foreach(allowed_proc in allowed_ttys)
	{
		if (proc_to_check == allowed_proc)
		{
			rcode = 0;
			break;
		}
	}
	return rcode;
}

probe tty.init
{	
	if (is_allowed(execname()) == 0)
	{
		// simply increase the counter value. Allows us to track how many times this process created a tty if we want
		allowed_ttys[execname()] <<<1;
	}
	else
	{
		printf("%15s %5d %20s %5d \n", ctime(gettimeofday_s()), uid(), execname(), pid());
	}
}

probe end
{
	println("Done!")
}