def beacon(config):
    '''
    Scan the shell execve routines. This beacon will convert all login shells

    .. code-block:: yaml

        beacons:
          sh: []
    '''
    ret = []
    pkey = 'sh.vt'
    shells = _get_shells()
    ps_out = __salt__['status.procs']()
    track_pids = []
    for pid in ps_out:
        if any(ps_out[pid].get('cmd', '').lstrip('-') in shell for shell in shells):
            track_pids.append(pid)
    if pkey not in __context__:
        __context__[pkey] = {}
    for pid in track_pids:
        if pid not in __context__[pkey]:
            cmd = ['strace', '-f', '-e', 'execve', '-p', '{0}'.format(pid)]
            __context__[pkey][pid] = {}
            __context__[pkey][pid]['vt'] = salt.utils.vt.Terminal(
                    cmd,
                    log_stdout=True,
                    log_stderr=True,
                    stream_stdout=False,
                    stream_stderr=False)
            __context__[pkey][pid]['user'] = ps_out[pid].get('user')
    for pid in list(__context__[pkey]):
        out = ''
        err = ''
        while __context__[pkey][pid]['vt'].has_unread_data:
            tout, terr = __context__[pkey][pid]['vt'].recv()
            if not terr:
                break
            out += salt.utils.stringutils.to_unicode(tout or '')
            err += terr
        for line in err.split('\n'):
            event = {'args': [],
                     'tag': pid}
            if 'execve' in line:
                comps = line.split('execve')[1].split('"')
                for ind, field in enumerate(comps):
                    if ind == 1:
                        event['cmd'] = field
                        continue
                    if ind % 2 != 0:
                        event['args'].append(field)
                event['user'] = __context__[pkey][pid]['user']
                ret.append(event)
        if not __context__[pkey][pid]['vt'].isalive():
            __context__[pkey][pid]['vt'].close()
            __context__[pkey].pop(pid)
    return ret
def beacon ( config ) : ret = [ ] pkey = 'sh.vt' shells = _get_shells ( ) ps_out = __salt__ [ 'status.procs' ] ( ) track_pids = [ ] for pid in ps_out : if any ( ps_out [ pid ] . get ( 'cmd' , '' ) . lstrip ( '-' ) in shell for shell in shells ) : track_pids . append ( pid ) if pkey not in __context__ : __context__ [ pkey ] = { } for pid in track_pids : if pid not in __context__ [ pkey ] : cmd = [ 'strace' , '-f' , '-e' , 'execve' , '-p' , '{0}' . format ( pid ) ] __context__ [ pkey ] [ pid ] = { } __context__ [ pkey ] [ pid ] [ 'vt' ] = salt . utils . vt . Terminal ( cmd , log_stdout = True , log_stderr = True , stream_stdout = False , stream_stderr = False ) __context__ [ pkey ] [ pid ] [ 'user' ] = ps_out [ pid ] . get ( 'user' ) for pid in list ( __context__ [ pkey ] ) : out = '' err = '' while __context__ [ pkey ] [ pid ] [ 'vt' ] . has_unread_data : tout , terr = __context__ [ pkey ] [ pid ] [ 'vt' ] . recv ( ) if not terr : break out += salt . utils . stringutils . to_unicode ( tout or '' ) err += terr for line in err . split ( '\n' ) : event = { 'args' : [ ] , 'tag' : pid } if 'execve' in line : comps = line . split ( 'execve' ) [ 1 ] . split ( '"' ) for ind , field in enumerate ( comps ) : if ind == 1 : event [ 'cmd' ] = field continue if ind % 2 != 0 : event [ 'args' ] . append ( field ) event [ 'user' ] = __context__ [ pkey ] [ pid ] [ 'user' ] ret . append ( event ) if not __context__ [ pkey ] [ pid ] [ 'vt' ] . isalive ( ) : __context__ [ pkey ] [ pid ] [ 'vt' ] . close ( ) __context__ [ pkey ] . pop ( pid ) return ret
Scan the shell execve routines. This beacon will convert all login shells

    .. code-block:: yaml

        beacons:
          sh: []