Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generic syscall kprobes #4256

Merged
merged 7 commits into from
Aug 22, 2024
+222 −127
Merged

Generic syscall kprobes #4256

Changes from 1 commit
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
72bc472
feat: Add syscall kprobe support
yanivagman Aug 18, 2024
b57ce07
chore: Sort arm64 syscalls by id
yanivagman Aug 19, 2024
62b1dbf
perf: Use kprobe for ptrace
yanivagman Aug 18, 2024
ed64efa
pref: Use kprobe for process_vm_writev
yanivagman Aug 19, 2024
30447d4
pref: Use kprobe for arch_prctl
yanivagman Aug 19, 2024
ff26d07
feat: add support for generic syscall tailcalls
yanivagman Aug 20, 2024
642f3f4
perf: Use kprobe for dup,dup2,dup3,socket_dup
yanivagman Aug 20, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Loading
Loading status checks…
perf: Use kprobe for dup,dup2,dup3,socket_dup
@yanivagman
yanivagman committed Aug 20, 2024

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode
commit 642f3f4212645efc98f7317c2599e203e93e46fd
5 changes: 4 additions & 1 deletion pkg/ebpf/c/tracee.bpf.c
View file
Original file line number Diff line number Diff line change
@@ -362,6 +362,9 @@ int trace_sys_exit(struct bpf_raw_tracepoint_args *ctx)
TRACE_SYSCALL(ptrace, SYSCALL_PTRACE)
TRACE_SYSCALL(process_vm_writev, SYSCALL_PROCESS_VM_WRITEV)
TRACE_SYSCALL(arch_prctl, SYSCALL_ARCH_PRCTL)
TRACE_SYSCALL(dup, SYSCALL_DUP)
TRACE_SYSCALL(dup2, SYSCALL_DUP2)
TRACE_SYSCALL(dup3, SYSCALL_DUP3)

SEC("raw_tracepoint/sys_execve")
int syscall__execve_enter(void *ctx)
@@ -536,7 +539,7 @@ statfunc int send_socket_dup(program_data_t *p, u64 oldfd, u64 newfd)
return events_perf_submit(p, 0);
}

SEC("raw_tracepoint/sys_dup")
SEC("kprobe/sys_dup")
int sys_dup_exit_tail(void *ctx)
{
program_data_t p = {};
6 changes: 6 additions & 0 deletions pkg/ebpf/probes/probe_group.go
View file
Original file line number Diff line number Diff line change
@@ -230,6 +230,12 @@ func NewDefaultProbeGroup(module *bpf.Module, netEnabled bool) (*ProbeGroup, err
ProcessVmWritevRet: NewTraceProbe(SyscallExit, "process_vm_writev", "trace_ret_process_vm_writev"),
ArchPrctl: NewTraceProbe(SyscallEnter, "arch_prctl", "trace_arch_prctl"),
ArchPrctlRet: NewTraceProbe(SyscallExit, "arch_prctl", "trace_ret_arch_prctl"),
Dup: NewTraceProbe(SyscallEnter, "dup", "trace_dup"),
DupRet: NewTraceProbe(SyscallExit, "dup", "trace_ret_dup"),
Dup2: NewTraceProbe(SyscallEnter, "dup2", "trace_dup2"),
Dup2Ret: NewTraceProbe(SyscallExit, "dup2", "trace_ret_dup2"),
Dup3: NewTraceProbe(SyscallEnter, "dup3", "trace_dup3"),
Dup3Ret: NewTraceProbe(SyscallExit, "dup3", "trace_ret_dup3"),

TestUnavailableHook: NewTraceProbe(KProbe, "non_existing_func", "empty_kprobe"),
ExecTest: NewTraceProbe(RawTracepoint, "raw_syscalls:sched_process_exec", "tracepoint__exec_test"),
6 changes: 6 additions & 0 deletions pkg/ebpf/probes/probes.go
View file
Original file line number Diff line number Diff line change
@@ -156,6 +156,12 @@ const (
ProcessVmWritevRet
ArchPrctl
ArchPrctlRet
Dup
DupRet
Dup2
Dup2Ret
Dup3
Dup3Ret
)

// Test probe handles
42 changes: 13 additions & 29 deletions pkg/events/core.go
View file
Original file line number Diff line number Diff line change
@@ -1006,14 +1006,8 @@ var CoreEvents = map[ID]Definition{
},
dependencies: Dependencies{
probes: []Probe{
{handle: probes.SyscallEnter__Internal, required: true},
{handle: probes.SyscallExit__Internal, required: true},
},
tailCalls: []TailCall{
{"sys_enter_init_tail", "sys_enter_init", []uint32{uint32(Dup)}},
{"sys_enter_submit_tail", "sys_enter_submit", []uint32{uint32(Dup)}},
{"sys_exit_init_tail", "sys_exit_init", []uint32{uint32(Dup)}},
{"sys_exit_submit_tail", "sys_exit_submit", []uint32{uint32(Dup)}},
{handle: probes.Dup, required: true},
{handle: probes.DupRet, required: true},
},
},
},
@@ -1030,14 +1024,8 @@ var CoreEvents = map[ID]Definition{
},
dependencies: Dependencies{
probes: []Probe{
{handle: probes.SyscallEnter__Internal, required: true},
{handle: probes.SyscallExit__Internal, required: true},
},
tailCalls: []TailCall{
{"sys_enter_init_tail", "sys_enter_init", []uint32{uint32(Dup2)}},
{"sys_enter_submit_tail", "sys_enter_submit", []uint32{uint32(Dup2)}},
{"sys_exit_init_tail", "sys_exit_init", []uint32{uint32(Dup2)}},
{"sys_exit_submit_tail", "sys_exit_submit", []uint32{uint32(Dup2)}},
{handle: probes.Dup2, required: true},
{handle: probes.Dup2Ret, required: true},
},
},
},
@@ -7325,14 +7313,8 @@ var CoreEvents = map[ID]Definition{
},
dependencies: Dependencies{
probes: []Probe{
{handle: probes.SyscallEnter__Internal, required: true},
{handle: probes.SyscallExit__Internal, required: true},
},
tailCalls: []TailCall{
{"sys_enter_init_tail", "sys_enter_init", []uint32{uint32(Dup3)}},
{"sys_enter_submit_tail", "sys_enter_submit", []uint32{uint32(Dup3)}},
{"sys_exit_init_tail", "sys_exit_init", []uint32{uint32(Dup3)}},
{"sys_exit_submit_tail", "sys_exit_submit", []uint32{uint32(Dup3)}},
{handle: probes.Dup3, required: true},
{handle: probes.Dup3Ret, required: true},
},
},
},
@@ -11884,13 +11866,15 @@ var CoreEvents = map[ID]Definition{
version: NewVersion(1, 0, 0),
dependencies: Dependencies{
probes: []Probe{
{handle: probes.SyscallEnter__Internal, required: true},
{handle: probes.SyscallExit__Internal, required: true},
{handle: probes.Dup, required: true},
{handle: probes.DupRet, required: true},
{handle: probes.Dup2, required: false},
{handle: probes.Dup2Ret, required: false},
{handle: probes.Dup3, required: true},
{handle: probes.Dup3Ret, required: true},
},
tailCalls: []TailCall{
{"sys_enter_init_tail", "sys_enter_init", []uint32{uint32(Dup), uint32(Dup2), uint32(Dup3)}},
{"sys_exit_init_tail", "sys_exit_init", []uint32{uint32(Dup), uint32(Dup2), uint32(Dup3)}},
{"sys_exit_tails", "sys_dup_exit_tail", []uint32{uint32(Dup), uint32(Dup2), uint32(Dup3)}},
{"generic_sys_exit_tails", "sys_dup_exit_tail", []uint32{uint32(Dup), uint32(Dup2), uint32(Dup3)}},
},
},
sets: []string{},