add bcc trace open ex

DavadDi · DavadDi · commit 1de3a54a5be9 · 2021-06-02T17:30:58.000+08:00
diff --git a/ebpf_bcc_trace_open_ex/open.py b/ebpf_bcc_trace_open_ex/open.py
@@ -0,0 +1,24 @@
+#!/usr/bin/python
+from bcc import BPF
+
+prog = """
+#include <linux/sched.h>
+
+int trace_syscall_open(struct pt_regs *ctx, const char __user *filename, int flags) {
+    u32 pid = bpf_get_current_pid_tgid() >> 32;
+    u32 uid = bpf_get_current_uid_gid();
+    
+    char comm[TASK_COMM_LEN];
+    bpf_get_current_comm(&comm, sizeof(comm));
+    
+    bpf_trace_printk("%d [%s]\\n", pid, filename);
+    return 0;
+}
+"""
+
+b = BPF(text=prog)
+b.attach_kprobe(event=b.get_syscall_fnname("open"), fn_name="trace_syscall_open")
+try:
+    b.trace_print()
+except KeyboardInterrupt:
+    exit()
diff --git a/ebpf_bcc_trace_open_ex/open_perf_output.py b/ebpf_bcc_trace_open_ex/open_perf_output.py
@@ -0,0 +1,48 @@
+#!/usr/bin/python
+from bcc import BPF
+
+prog = """
+#include <uapi/linux/limits.h> // for  NAME_MAX
+
+// 1 define struct
+struct event_data_t {
+    u32 pid;
+    char fname[NAME_MAX];  // max of filename
+};
+
+// 2. declare BPF_PERF_OUTPUT define 
+BPF_PERF_OUTPUT(open_events);
+
+int trace_syscall_open(struct pt_regs *ctx, const char __user *filename, int flags) {
+    u32 pid = bpf_get_current_pid_tgid() >> 32;
+  
+    // 3.1 define event data and fill data
+    struct event_data_t evt = {};
+  
+    evt.pid = pid;
+    bpf_probe_read(&evt.fname, sizeof(evt.fname), (void *)filename);
+
+    // bpf_trace_printk("%d [%s]\\n", pid, filename); =>
+    
+    // 3.2 submit the event
+    open_events.perf_submit(ctx, &evt, sizeof(evt));
+
+    return 0;
+}
+"""
+
+b = BPF(text=prog)
+b.attach_kprobe(event=b.get_syscall_fnname("open"), fn_name="trace_syscall_open")
+
+# process event
+def print_event(cpu, data, size):
+  event = b["open_events"].event(data)
+  print("Rcv Event %d, %s"%(event.pid, event.fname))
+  
+# loop with callback to print_event
+b["open_events"].open_perf_buffer(print_event)
+while True:
+    try:
+        b.perf_buffer_poll()
+    except KeyboardInterrupt:
+        exit()
diff --git a/ebpf_bcc_trace_open_ex/open_pid.py b/ebpf_bcc_trace_open_ex/open_pid.py
@@ -0,0 +1,46 @@
+#!/usr/bin/python
+from bcc import BPF
+import argparse  # +add
+
+prog = """
+#include <linux/sched.h>
+
+int trace_syscall_open(struct pt_regs *ctx, const char __user *filename, int flags) {
+    u32 pid = bpf_get_current_pid_tgid() >> 32;
+    u32 uid = bpf_get_current_uid_gid();
+
+    PID_FILTER  // + add PID FILTER
+    char comm[TASK_COMM_LEN];
+    bpf_get_current_comm(&comm, sizeof(comm));
+
+    bpf_trace_printk("%d [%s]\\n", pid, filename);
+    return 0;
+}
+"""
+
+examples = """examples:
+    ./open_pid -p 181    # only trace PID 181
+"""
+
+parser = argparse.ArgumentParser(
+    description="Trace open() syscalls",
+    formatter_class=argparse.RawDescriptionHelpFormatter,
+    epilog=examples)
+
+parser.add_argument("-p", "--pid",
+    help="trace this PID only")
+
+args = parser.parse_args()
+
+if args.pid:
+    prog = prog.replace('PID_FILTER',
+        'if (pid != %s) { return 0; }' % args.pid)
+else:
+    prog = prog.replace('PID_TID_FILTER', '')
+    
+b = BPF(text=prog)
+b.attach_kprobe(event=b.get_syscall_fnname("open"), fn_name="trace_syscall_open")
+try:
+    b.trace_print()
+except KeyboardInterrupt:
+    exit()
