mirror of
https://github.com/eunomia-bpf/bpf-developer-tutorial.git
synced 2026-02-08 04:44:44 +08:00
fix bpf programs with useless attach
This commit is contained in:
yunwei37
@@ -1,7 +1,35 @@
|
||||
## eBPF 入门实践教程七：捕获进程执行/退出时间，通过 perf event array 向用户态打印输出
|
||||
# eBPF 入门实践教程七：捕获进程执行/退出时间，通过 perf event array 向用户态打印输出
|
||||
|
||||
eBPF (Extended Berkeley Packet Filter) 是 Linux 内核上的一个强大的网络和性能分析工具，它允许开发者在内核运行时动态加载、更新和运行用户定义的代码。
|
||||
|
||||
本文是 eBPF 入门开发实践指南的第七篇，主要介绍如何捕获 Linux 内核中进程执行的事件，并且通过 perf event array 向用户态命令行打印输出，不需要再通过查看 /sys/kernel/debug/tracing/trace_pipe 文件来查看 eBPF 程序的输出。
|
||||
|
||||
## execsnoop
|
||||
|
||||
通过 perf event array 向用户态命令行打印输出，需要编写一个头文件，一个 C 源文件。示例代码如下：
|
||||
|
||||
头文件：execsnoop.h
|
||||
|
||||
```c
|
||||
#ifndef __EXECSNOOP_H
|
||||
#define __EXECSNOOP_H
|
||||
|
||||
#define TASK_COMM_LEN 16
|
||||
|
||||
struct event {
|
||||
int pid;
|
||||
int ppid;
|
||||
int uid;
|
||||
int retval;
|
||||
bool is_exit;
|
||||
char comm[TASK_COMM_LEN];
|
||||
};
|
||||
|
||||
#endif /* __EXECSNOOP_H */
|
||||
```
|
||||
|
||||
源文件：execsnoop.bpf.c
|
||||
|
||||
```c
|
||||
// SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
|
||||
#include <vmlinux.h>
|
||||
@@ -76,8 +104,6 @@ char LICENSE[] SEC("license") = "GPL";
|
||||
|
||||
使用这段代码，我们就可以捕获 Linux 内核中进程执行的事件。我们可以通过工具（例如 eunomia-bpf）来查看这些事件，并分析进程的执行情况。
|
||||
|
||||
|
||||
|
||||
## Compile and Run
|
||||
|
||||
Compile:
|
||||
@@ -104,109 +130,3 @@ time pid ppid uid retval args_count args_size comm args
|
||||
23:07:57 32959 32946 1000 0 1 17 oneko /usr/games/oneko
|
||||
|
||||
```
|
||||
|
||||
## details in bcc
|
||||
|
||||
Demonstrations of execsnoop, the Linux eBPF/bcc version.
|
||||
|
||||
execsnoop traces the exec() syscall system-wide, and prints various details.
|
||||
Example output:
|
||||
|
||||
```
|
||||
# ./execsnoop
|
||||
COMM PID PPID RET ARGS
|
||||
bash 33161 24577 0 /bin/bash
|
||||
lesspipe 33163 33161 0 /usr/bin/lesspipe
|
||||
basename 33164 33163 0 /usr/bin/basename /usr/bin/lesspipe
|
||||
dirname 33166 33165 0 /usr/bin/dirname /usr/bin/lesspipe
|
||||
dircolors 33167 33161 0 /usr/bin/dircolors -b
|
||||
ls 33172 33161 0 /usr/bin/ls --color=auto
|
||||
top 33173 33161 0 /usr/bin/top
|
||||
oneko 33174 33161 0 /usr/games/oneko
|
||||
systemctl 33175 2975 0 /bin/systemctl is-enabled -q whoopsie.path
|
||||
apport-checkrep 33176 2975 0 /usr/share/apport/apport-checkreports
|
||||
apport-checkrep 33177 2975 0 /usr/share/apport/apport-checkreports --system
|
||||
apport-checkrep 33178 2975 0 /usr/share/apport/apport-checkreports --system
|
||||
|
||||
```
|
||||
|
||||
This shows process information when exec system call is called.
|
||||
|
||||
USAGE message:
|
||||
|
||||
```
|
||||
usage: execsnoop [-h] [-T] [-t] [-x] [--cgroupmap CGROUPMAP]
|
||||
[--mntnsmap MNTNSMAP] [-u USER] [-q] [-n NAME]
|
||||
[-l LINE] [-U] [--max-args MAX_ARGS]
|
||||
|
||||
Trace exec() syscalls
|
||||
|
||||
options:
|
||||
-h, --help show this help message and exit
|
||||
-T, --time include time column on output (HH:MM:SS)
|
||||
-t, --timestamp include timestamp on output
|
||||
-x, --fails include failed exec()s
|
||||
--cgroupmap CGROUPMAP
|
||||
trace cgroups in this BPF map only
|
||||
--mntnsmap MNTNSMAP trace mount namespaces in this BPF map only
|
||||
-u USER, --uid USER trace this UID only
|
||||
-q, --quote Add quotemarks (") around arguments.
|
||||
-n NAME, --name NAME only print commands matching this name (regex), any
|
||||
arg
|
||||
-l LINE, --line LINE only print commands where arg contains this line
|
||||
(regex)
|
||||
-U, --print-uid print UID column
|
||||
--max-args MAX_ARGS maximum number of arguments parsed and displayed,
|
||||
defaults to 20
|
||||
|
||||
examples:
|
||||
./execsnoop # trace all exec() syscalls
|
||||
./execsnoop -x # include failed exec()s
|
||||
./execsnoop -T # include time (HH:MM:SS)
|
||||
./execsnoop -U # include UID
|
||||
./execsnoop -u 1000 # only trace UID 1000
|
||||
./execsnoop -u user # get user UID and trace only them
|
||||
./execsnoop -t # include timestamps
|
||||
./execsnoop -q # add "quotemarks" around arguments
|
||||
./execsnoop -n main # only print command lines containing "main"
|
||||
./execsnoop -l tpkg # only print command where arguments contains "tpkg"
|
||||
./execsnoop --cgroupmap mappath # only trace cgroups in this BPF map
|
||||
./execsnoop --mntnsmap mappath # only trace mount namespaces in the map
|
||||
|
||||
|
||||
```
|
||||
|
||||
The -T and -t option include time and timestamps on output:
|
||||
|
||||
```
|
||||
# ./execsnoop -T -t
|
||||
TIME TIME(s) PCOMM PID PPID RET ARGS
|
||||
23:35:25 4.335 bash 33360 24577 0 /bin/bash
|
||||
23:35:25 4.338 lesspipe 33361 33360 0 /usr/bin/lesspipe
|
||||
23:35:25 4.340 basename 33362 33361 0 /usr/bin/basename /usr/bin/lesspipe
|
||||
23:35:25 4.342 dirname 33364 33363 0 /usr/bin/dirname /usr/bin/lesspipe
|
||||
23:35:25 4.347 dircolors 33365 33360 0 /usr/bin/dircolors -b
|
||||
23:35:40 19.327 touch 33367 33366 0 /usr/bin/touch /run/udev/gdm-machine-has-hardware-gpu
|
||||
23:35:40 19.329 snap-device-hel 33368 33366 0 /usr/lib/snapd/snap-device-helper change snap_firefox_firefox /devices/pci0000:00/0000:00:02.0/drm/card0 226:0
|
||||
23:35:40 19.331 snap-device-hel 33369 33366 0 /usr/lib/snapd/snap-device-helper change snap_firefox_geckodriver /devices/pci0000:00/0000:00:02.0/drm/card0 226:0
|
||||
23:35:40 19.332 snap-device-hel 33370 33366 0 /usr/lib/snapd/snap-device-helper change snap_snap-store_snap-store /devices/pci0000:00/0000:00:02.0/drm/card0 226:0
|
||||
|
||||
```
|
||||
|
||||
The -u option filtering UID:
|
||||
|
||||
```
|
||||
# ./execsnoop -Uu 1000
|
||||
UID PCOMM PID PPID RET ARGS
|
||||
1000 bash 33604 24577 0 /bin/bash
|
||||
1000 lesspipe 33606 33604 0 /usr/bin/lesspipe
|
||||
1000 basename 33607 33606 0 /usr/bin/basename /usr/bin/lesspipe
|
||||
1000 dirname 33609 33608 0 /usr/bin/dirname /usr/bin/lesspipe
|
||||
1000 dircolors 33610 33604 0 /usr/bin/dircolors -b
|
||||
1000 sleep 33615 33604 0 /usr/bin/sleep
|
||||
1000 sleep 33616 33604 0 /usr/bin/sleep 1
|
||||
1000 clear 33617 33604 0 /usr/bin/clear
|
||||
|
||||
```
|
||||
|
||||
Report bugs to https://github.com/iovisor/bcc/tree/master/libbpf-tools.
|
||||
|
||||
@@ -2,13 +2,7 @@
|
||||
#ifndef __EXECSNOOP_H
|
||||
#define __EXECSNOOP_H
|
||||
|
||||
#define ARGSIZE 128
|
||||
#define TASK_COMM_LEN 16
|
||||
#define TOTAL_MAX_ARGS 60
|
||||
#define DEFAULT_MAXARGS 20
|
||||
#define FULL_MAX_ARGS_ARR (TOTAL_MAX_ARGS * ARGSIZE)
|
||||
#define INVALID_UID ((uid_t)-1)
|
||||
#define LAST_ARG (FULL_MAX_ARGS_ARR - ARGSIZE)
|
||||
|
||||
struct event {
|
||||
int pid;
|
||||
Reference in New Issue
Block a user