Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

On Windows capture and log the username of named pipe client peer #18

Open
jeffhostetler opened this issue Jan 17, 2024 · 1 comment
Open

Comments

@jeffhostetler
Copy link
Collaborator

On Windows the collector (usually) runs as a Control Panel Service process and therefore inherits whatever system identity (LOCAL SERVICE). Logging the username of the collector in the OTLP data stream is not very useful.

We should use the feature of named pipes to get the (Windows) SID of the client process upon receiving an incoming named pipe connection and map that to a username and log that.

This is PII-sensitive, so it should only be done if requested in the pii.yml.

On Linux/Mac Unix domain sockets have a similar feature and IIRC is already being used.

@jeffhostetler
Copy link
Collaborator Author

To get the client peer data you need the OS handle to the pipe (rather than just the GO wrapper). This wasn't available at the time, so I couldn't do it then. But now that I've forked the relevant parts of the go-winio libraries to handle the multi-threaded problems, we can hack it a little further to get the peer data.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant