From c6df5b529fbb181f460f28a4541b66e9dbb06d12 Mon Sep 17 00:00:00 2001 From: Luke Craig Date: Mon, 29 Jun 2026 09:45:36 -0400 Subject: [PATCH] sock_hc: always report binds, regardless of analysis scope The netbinds logger should capture every bind/release, including Penguin's own infrastructure (vpnguin/console/gdbserver, etc.). Remove the igloo_in_scope gates added with the scope feature so bind visibility is no longer tied to the firmware subtree. Syscall/exec scoping (scope.c, igloo_in_scope, the per-hook scope_filter) is unchanged. --- src/hooks/sock_hc.c | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/src/hooks/sock_hc.c b/src/hooks/sock_hc.c index cc4780b..510582b 100644 --- a/src/hooks/sock_hc.c +++ b/src/hooks/sock_hc.c @@ -14,7 +14,6 @@ #include #include #include "igloo_hypercall_consts.h" -#include "portal/scope.h" #if LINUX_VERSION_CODE > KERNEL_VERSION(4,10,0) @@ -38,11 +37,9 @@ void igloo_sock_bind(struct socket *sock, struct sockaddr_storage *address){ char buffer[32]; int hrv = 1; int i; - // Only report binds from the firmware-under-analysis subtree, not from - // Penguin infrastructure (vpnguin/console/etc.) that stays in the initial ns. - if (!igloo_in_scope(current)) { - return; - } + // netbinds always reports, for every process (including Penguin + // infrastructure such as vpnguin/console/gdbserver) -- bind visibility is + // not scoped to the firmware subtree. mutex_lock(&bind_mutex); if (address->ss_family == AF_INET) { @@ -89,11 +86,7 @@ void igloo_sock_bind(struct socket *sock, struct sockaddr_storage *address){ */ void igloo_sock_release(struct socket *sock){ struct sock *sk = sock->sk; - // Mirror the bind gate: skip releases outside the firmware subtree so we - // don't emit release events for infra binds we never reported. - if (!igloo_in_scope(current)) { - return; - } + // Releases always report too, mirroring igloo_sock_bind (no scope gate). mutex_lock(&release_mutex); if (sk) {