github.com/castai/kvisor@v1.7.1-0.20240516114728-b3572a2607b5/pkg/ebpftracer/probes.go (about) 1 package ebpftracer 2 3 import ( 4 "strings" 5 6 "github.com/cilium/ebpf" 7 "github.com/cilium/ebpf/link" 8 ) 9 10 type probeType uint8 11 12 const ( 13 kProbe = iota // github.com/iovisor/bcc/blob/master/docs/reference_guide.md#1-kp 14 kretProbe // github.com/iovisor/bcc/blob/master/docs/reference_guide.md#1-kp 15 tracepoint // github.com/iovisor/bcc/blob/master/docs/reference_guide.md#3-tracep 16 rawTracepoint // github.com/iovisor/bcc/blob/master/docs/reference_guide.md#7-raw-tracep 17 ) 18 19 type probe interface { 20 attach() error 21 detach() error 22 String() string 23 } 24 25 func newTraceProbe(probeType probeType, eventName string, program *ebpf.Program) probe { 26 return &traceProbe{ 27 eventName: eventName, 28 probeType: probeType, 29 program: program, 30 } 31 } 32 33 type traceProbe struct { 34 eventName string 35 program *ebpf.Program 36 probeType probeType 37 38 probeLink link.Link 39 } 40 41 func (p *traceProbe) String() string { 42 return p.program.String() 43 } 44 45 func (p *traceProbe) attach() error { 46 if p.probeLink != nil { 47 return nil 48 } 49 50 var probeLink link.Link 51 var err error 52 switch p.probeType { 53 case kProbe: 54 probeLink, err = link.Kprobe(p.eventName, p.program, nil) 55 case kretProbe: 56 probeLink, err = link.Kretprobe(p.eventName, p.program, nil) 57 case tracepoint: 58 tp := strings.Split(p.eventName, ":") 59 tpClass := tp[0] 60 tpEvent := tp[1] 61 probeLink, err = link.Tracepoint(tpClass, tpEvent, p.program, nil) 62 case rawTracepoint: 63 tpEvent := strings.Split(p.eventName, ":")[1] 64 probeLink, err = link.AttachRawTracepoint(link.RawTracepointOptions{ 65 Name: tpEvent, 66 Program: p.program, 67 }) 68 } 69 if err != nil { 70 return err 71 } 72 p.probeLink = probeLink 73 return nil 74 } 75 76 func (p *traceProbe) detach() error { 77 if p.probeLink == nil { 78 return nil 79 } 80 if err := p.probeLink.Close(); err != nil { 81 return err 82 } 83 p.probeLink = nil 84 return nil 85 } 86 87 func newCgroupProbe(probeType ebpf.AttachType, cgroupPath string, program *ebpf.Program) probe { 88 return &cgroupProbe{ 89 cgroupPath: cgroupPath, 90 probeType: probeType, 91 program: program, 92 } 93 } 94 95 type cgroupProbe struct { 96 cgroupPath string 97 program *ebpf.Program 98 probeType ebpf.AttachType 99 100 probeLink link.Link 101 } 102 103 func (p *cgroupProbe) String() string { 104 return p.program.String() 105 } 106 107 func (p *cgroupProbe) attach() error { 108 if p.probeLink != nil { 109 return nil 110 } 111 112 probeLink, err := link.AttachCgroup(link.CgroupOptions{ 113 Path: p.cgroupPath, 114 Attach: p.probeType, 115 Program: p.program, 116 }) 117 if err != nil { 118 return err 119 } 120 p.probeLink = probeLink 121 return nil 122 } 123 124 func (p *cgroupProbe) detach() error { 125 if p.probeLink == nil { 126 return nil 127 } 128 if err := p.probeLink.Close(); err != nil { 129 return err 130 } 131 p.probeLink = nil 132 return nil 133 } 134 135 type handle int32 136 137 const ( 138 ProbeSysEnter handle = iota 139 ProbeSysExit 140 ProbeSyscallEnter__Internal 141 ProbeSyscallExit__Internal 142 ProbeSchedProcessFork 143 ProbeSchedProcessExec 144 ProbeSchedProcessExit 145 ProbeSchedProcessFree 146 ProbeSchedSwitch 147 ProbeDoExit 148 ProbeCapCapable 149 ProbeVfsWrite 150 ProbeVfsWriteRet 151 ProbeVfsWriteV 152 ProbeVfsWriteVRet 153 ProbeSecurityMmapAddr 154 ProbeSecurityMmapFile 155 ProbeSecurityFileMProtect 156 ProbeCommitCreds 157 ProbeSwitchTaskNS 158 ProbeKernelWrite 159 ProbeKernelWriteRet 160 ProbeVfsWriteMagic 161 ProbeVfsWriteMagicRet 162 ProbeVfsWriteVMagic 163 ProbeVfsWriteVMagicRet 164 ProbeKernelWriteMagic 165 ProbeKernelWriteMagicRet 166 ProbeCgroupAttachTask 167 ProbeCgroupMkdir 168 ProbeCgroupRmdir 169 ProbeSecurityBPRMCheck 170 ProbeSecurityFileOpen 171 ProbeSecurityInodeUnlink 172 ProbeSecurityInodeMknod 173 ProbeSecurityInodeSymlink 174 ProbeSecuritySocketCreate 175 ProbeSecuritySocketListen 176 ProbeSecuritySocketConnect 177 ProbeSecuritySocketAccept 178 ProbeSecuritySocketBind 179 ProbeSecuritySocketSetsockopt 180 ProbeSecuritySbMount 181 ProbeSecurityBPF 182 ProbeSecurityBPFMap 183 ProbeSecurityKernelReadFile 184 ProbeSecurityKernelPostReadFile 185 ProbeDoSplice 186 ProbeDoSpliceRet 187 ProbeProcCreate 188 ProbeRegisterKprobe 189 ProbeRegisterKprobeRet 190 ProbeCallUsermodeHelper 191 ProbeDebugfsCreateFile 192 ProbeDebugfsCreateDir 193 ProbeDeviceAdd 194 ProbeRegisterChrdev 195 ProbeRegisterChrdevRet 196 ProbeDoInitModule 197 ProbeDoInitModuleRet 198 ProbeLoadElfPhdrs 199 ProbeFilldir64 200 ProbeSecurityFilePermission 201 ProbeTaskRename 202 ProbePrintSyscallTable 203 ProbePrintNetSeqOps 204 ProbeSecurityInodeRename 205 ProbeDoSigaction 206 ProbeSecurityBpfProg 207 ProbeSecurityFileIoctl 208 ProbeCheckHelperCall 209 ProbeCheckMapFuncCompatibility 210 ProbeKallsymsLookupName 211 ProbeKallsymsLookupNameRet 212 ProbeSockAllocFile 213 ProbeSockAllocFileRet 214 ProbeSecuritySkClone 215 ProbeSecuritySocketRecvmsg 216 ProbeSecuritySocketSendmsg 217 ProbeCgroupBPFRunFilterSKB 218 ProbeCgroupSKBIngress 219 ProbeCgroupSKBEgress 220 ProbeDoMmap 221 ProbeDoMmapRet 222 ProbePrintMemDump 223 ProbeVfsRead 224 ProbeVfsReadRet 225 ProbeVfsReadV 226 ProbeVfsReadVRet 227 ProbeVfsUtimes 228 ProbeUtimesCommon 229 ProbeDoTruncate 230 ProbeFileUpdateTime 231 ProbeFileUpdateTimeRet 232 ProbeFileModified 233 ProbeFileModifiedRet 234 ProbeFdInstall 235 ProbeFilpClose 236 ProbeInotifyFindInode 237 ProbeInotifyFindInodeRet 238 ProbeBpfCheck 239 ProbeExecBinprm 240 ProbeExecBinprmRet 241 ProbeHiddenKernelModuleSeeker 242 ProbeTpProbeRegPrioMayExist 243 ProbeHiddenKernelModuleVerifier 244 ProbeModuleLoad 245 ProbeModuleFree 246 ProbeLayoutAndAllocate 247 ProbeInetSockSetState 248 ProbeOomMarkVictim 249 ProbeTtyOpen 250 251 // Signal probes 252 SignalCgroupMkdir 253 SignalCgroupRmdir 254 SignalSchedProcessFork 255 SignalSchedProcessExec 256 SignalSchedProcessExit 257 ) 258 259 func newProbes(objs *tracerObjects, cgroupPath string) map[handle]probe { 260 //binaryPath := "/proc/self/exe" 261 return map[handle]probe{ 262 ProbeSysEnter: newTraceProbe(rawTracepoint, "raw_syscalls:sys_enter", objs.TraceSysEnter), 263 ProbeSyscallEnter__Internal: newTraceProbe(rawTracepoint, "raw_syscalls:sys_enter", objs.TracepointRawSyscallsSysEnter), 264 ProbeSysExit: newTraceProbe(rawTracepoint, "raw_syscalls:sys_exit", objs.TraceSysExit), 265 ProbeSyscallExit__Internal: newTraceProbe(rawTracepoint, "raw_syscalls:sys_exit", objs.TracepointRawSyscallsSysExit), 266 ProbeSchedProcessFork: newTraceProbe(rawTracepoint, "sched:sched_process_fork", objs.TracepointSchedSchedProcessFork), 267 ProbeSchedProcessExec: newTraceProbe(rawTracepoint, "sched:sched_process_exec", objs.TracepointSchedSchedProcessExec), 268 ProbeSchedProcessExit: newTraceProbe(rawTracepoint, "sched:sched_process_exit", objs.TracepointSchedSchedProcessExit), 269 ProbeSchedProcessFree: newTraceProbe(rawTracepoint, "sched:sched_process_free", objs.TracepointSchedSchedProcessFree), 270 ProbeSchedSwitch: newTraceProbe(rawTracepoint, "sched:sched_switch", objs.TracepointSchedSchedSwitch), 271 ProbeDoExit: newTraceProbe(kProbe, "do_exit", objs.TraceDoExit), 272 ProbeCapCapable: newTraceProbe(kProbe, "cap_capable", objs.TraceCapCapable), 273 ProbeVfsWrite: newTraceProbe(kProbe, "vfs_write", objs.TraceVfsWrite), 274 ProbeVfsWriteRet: newTraceProbe(kretProbe, "vfs_write", objs.TraceRetVfsWrite), 275 ProbeVfsWriteV: newTraceProbe(kProbe, "vfs_writev", objs.TraceVfsWritev), 276 ProbeVfsWriteVRet: newTraceProbe(kretProbe, "vfs_writev", objs.TraceVfsWritev), 277 ProbeKernelWrite: newTraceProbe(kProbe, "__kernel_write", objs.TraceKernelWrite), 278 ProbeKernelWriteRet: newTraceProbe(kretProbe, "__kernel_write", objs.TraceRetKernelWrite), 279 ProbeVfsWriteMagic: newTraceProbe(kProbe, "vfs_write", objs.VfsWriteMagicEnter), 280 ProbeVfsWriteMagicRet: newTraceProbe(kretProbe, "vfs_write", objs.VfsWriteMagicReturn), 281 ProbeVfsWriteVMagic: newTraceProbe(kProbe, "vfs_writev", objs.VfsWritevMagicEnter), 282 ProbeVfsWriteVMagicRet: newTraceProbe(kretProbe, "vfs_writev", objs.VfsWriteMagicReturn), 283 ProbeKernelWriteMagic: newTraceProbe(kProbe, "__kernel_write", objs.KernelWriteMagicEnter), 284 ProbeKernelWriteMagicRet: newTraceProbe(kretProbe, "__kernel_write", objs.KernelWriteMagicReturn), 285 ProbeCgroupAttachTask: newTraceProbe(rawTracepoint, "cgroup:cgroup_attach_task", objs.TracepointCgroupCgroupAttachTask), 286 ProbeCgroupMkdir: newTraceProbe(rawTracepoint, "cgroup:cgroup_mkdir", objs.TracepointCgroupCgroupMkdir), 287 ProbeCgroupRmdir: newTraceProbe(rawTracepoint, "cgroup:cgroup_rmdir", objs.TracepointCgroupCgroupRmdir), 288 ProbeSecurityBPRMCheck: newTraceProbe(kProbe, "security_bprm_check", objs.TraceSecurityBprmCheck), 289 ProbeSecurityFileOpen: newTraceProbe(kProbe, "security_file_open", objs.TraceSecurityFileOpen), 290 //ProbeSecurityFilePermission: newTraceProbe(kProbe, "security_file_permission", objs.TraceSecurityFilePermission), 291 ProbeSecuritySocketCreate: newTraceProbe(kProbe, "security_socket_create", objs.TraceSecuritySocketCreate), 292 ProbeSecuritySocketListen: newTraceProbe(kProbe, "security_socket_listen", objs.TraceSecuritySocketListen), 293 ProbeSecuritySocketConnect: newTraceProbe(kProbe, "security_socket_connect", objs.TraceSecuritySocketConnect), 294 ProbeSecuritySocketAccept: newTraceProbe(kProbe, "security_socket_accept", objs.TraceSecuritySocketAccept), 295 //ProbeSecuritySocketBind: NewTraceProbe(kProbe, "security_socket_bind", "trace_security_socket_bind"), 296 //ProbeSecuritySocketSetsockopt: NewTraceProbe(kProbe, "security_socket_setsockopt", "trace_security_socket_setsockopt"), 297 //ProbeSecuritySbMount: NewTraceProbe(kProbe, "security_sb_mount", "trace_security_sb_mount"), 298 //ProbeSecurityBPF: NewTraceProbe(kProbe, "security_bpf", "trace_security_bpf"), 299 //ProbeSecurityBPFMap: NewTraceProbe(kProbe, "security_bpf_map", "trace_security_bpf_map"), 300 //ProbeSecurityKernelReadFile: NewTraceProbe(kProbe, "security_kernel_read_file", "trace_security_kernel_read_file"), 301 //ProbeSecurityKernelPostReadFile: NewTraceProbe(kProbe, "security_kernel_post_read_file", "trace_security_kernel_post_read_file"), 302 //ProbeSecurityInodeMknod: NewTraceProbe(kProbe, "security_inode_mknod", "trace_security_inode_mknod"), 303 //ProbeSecurityInodeSymlink: NewTraceProbe(kProbe, "security_inode_symlink", "trace_security_inode_symlink"), 304 //ProbeSecurityInodeUnlink: NewTraceProbe(kProbe, "security_inode_unlink", "trace_security_inode_unlink"), 305 //ProbeSecurityMmapAddr: NewTraceProbe(kProbe, "security_mmap_addr", "trace_mmap_alert"), 306 //ProbeSecurityMmapFile: NewTraceProbe(kProbe, "security_mmap_file", "trace_security_mmap_file"), 307 //ProbeDoSplice: NewTraceProbe(kProbe, "do_splice", "trace_do_splice"), 308 //ProbeDoSpliceRet: NewTraceProbe(kretProbe, "do_splice", "trace_ret_do_splice"), 309 //ProbeProcCreate: NewTraceProbe(kProbe, "proc_create", "trace_proc_create"), 310 //ProbeSecurityFileMProtect: NewTraceProbe(kProbe, "security_file_mprotect", "trace_security_file_mprotect"), 311 //ProbeCommitCreds: NewTraceProbe(kProbe, "commit_creds", "trace_commit_creds"), 312 //ProbeSwitchTaskNS: NewTraceProbe(kProbe, "switch_task_namespaces", "trace_switch_task_namespaces"), 313 //ProbeRegisterKprobe: NewTraceProbe(kProbe, "register_kprobe", "trace_register_kprobe"), 314 //ProbeRegisterKprobeRet: NewTraceProbe(kretProbe, "register_kprobe", "trace_ret_register_kprobe"), 315 //ProbeCallUsermodeHelper: NewTraceProbe(kProbe, "call_usermodehelper", "trace_call_usermodehelper"), 316 //ProbeDebugfsCreateFile: NewTraceProbe(kProbe, "debugfs_create_file", "trace_debugfs_create_file"), 317 //ProbeDebugfsCreateDir: NewTraceProbe(kProbe, "debugfs_create_dir", "trace_debugfs_create_dir"), 318 //ProbeDeviceAdd: NewTraceProbe(kProbe, "device_add", "trace_device_add"), 319 //ProbeRegisterChrdev: NewTraceProbe(kProbe, "__register_chrdev", "trace___register_chrdev"), 320 //ProbeRegisterChrdevRet: NewTraceProbe(kretProbe, "__register_chrdev", "trace_ret__register_chrdev"), 321 //ProbeDoInitModule: NewTraceProbe(kProbe, "do_init_module", "trace_do_init_module"), 322 //ProbeDoInitModuleRet: NewTraceProbe(kretProbe, "do_init_module", "trace_ret_do_init_module"), 323 ProbeLoadElfPhdrs: newTraceProbe(kProbe, "load_elf_phdrs", objs.TraceLoadElfPhdrs), 324 //ProbeFilldir64: NewTraceProbe(kProbe, "filldir64", "trace_filldir64"), 325 //ProbeTaskRename: NewTraceProbe(rawTracepoint, "task:task_rename", "tracepoint__task__task_rename"), 326 //ProbePrintSyscallTable: NewUprobe("print_syscall_table", "uprobe_syscall_trigger", binaryPath, "github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).triggerSyscallsIntegrityCheckCall"), 327 //ProbeHiddenKernelModuleSeeker: NewUprobe("hidden_kernel_module", "uprobe_lkm_seeker", binaryPath, "github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).triggerKernelModuleSeeker"), 328 //ProbeHiddenKernelModuleVerifier: NewUprobe("hidden_kernel_module", "uprobe_lkm_seeker_submitter", binaryPath, "github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).triggerKernelModuleSubmitter"), 329 //ProbePrintNetSeqOps: NewUprobe("print_net_seq_ops", "uprobe_seq_ops_trigger", binaryPath, "github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).triggerSeqOpsIntegrityCheckCall"), 330 //ProbePrintMemDump: NewUprobe("print_mem_dump", "uprobe_mem_dump_trigger", binaryPath, "github.com/aquasecurity/tracee/pkg/ebpf.(*Tracee).triggerMemDumpCall"), 331 //ProbeSecurityInodeRename: NewTraceProbe(kProbe, "security_inode_rename", "trace_security_inode_rename"), 332 //ProbeDoSigaction: NewTraceProbe(kProbe, "do_sigaction", "trace_do_sigaction"), 333 //ProbeSecurityBpfProg: NewTraceProbe(kProbe, "security_bpf_prog", "trace_security_bpf_prog"), 334 //ProbeSecurityFileIoctl: NewTraceProbe(kProbe, "security_file_ioctl", "trace_security_file_ioctl"), 335 //ProbeCheckHelperCall: NewTraceProbe(kProbe, "check_helper_call", "trace_check_helper_call"), 336 //ProbeCheckMapFuncCompatibility: NewTraceProbe(kProbe, "check_map_func_compatibility", "trace_check_map_func_compatibility"), 337 //ProbeKallsymsLookupName: NewTraceProbe(kProbe, "kallsyms_lookup_name", "trace_kallsyms_lookup_name"), 338 //ProbeKallsymsLookupNameRet: NewTraceProbe(kretProbe, "kallsyms_lookup_name", "trace_ret_kallsyms_lookup_name"), 339 ProbeSockAllocFile: newTraceProbe(kProbe, "sock_alloc_file", objs.TraceSockAllocFile), 340 ProbeSockAllocFileRet: newTraceProbe(kretProbe, "sock_alloc_file", objs.TraceRetSockAllocFile), 341 ProbeSecuritySkClone: newTraceProbe(kProbe, "security_sk_clone", objs.TraceSecuritySkClone), 342 ProbeSecuritySocketSendmsg: newTraceProbe(kProbe, "security_socket_sendmsg", objs.TraceSecuritySocketSendmsg), 343 ProbeSecuritySocketRecvmsg: newTraceProbe(kProbe, "security_socket_recvmsg", objs.TraceSecuritySocketRecvmsg), 344 ProbeCgroupBPFRunFilterSKB: newTraceProbe(kProbe, "__cgroup_bpf_run_filter_skb", objs.CgroupBpfRunFilterSkb), 345 ProbeCgroupSKBIngress: newCgroupProbe(ebpf.AttachCGroupInetIngress, cgroupPath, objs.CgroupSkbIngress), 346 ProbeCgroupSKBEgress: newCgroupProbe(ebpf.AttachCGroupInetEgress, cgroupPath, objs.CgroupSkbEgress), 347 //ProbeDoMmap: NewTraceProbe(kProbe, "do_mmap", "trace_do_mmap"), 348 //ProbeDoMmapRet: NewTraceProbe(kretProbe, "do_mmap", "trace_ret_do_mmap"), 349 //ProbeVfsRead: NewTraceProbe(kProbe, "vfs_read", "trace_vfs_read"), 350 //ProbeVfsReadRet: NewTraceProbe(kretProbe, "vfs_read", "trace_ret_vfs_read"), 351 //ProbeVfsReadV: NewTraceProbe(kProbe, "vfs_readv", "trace_vfs_readv"), 352 //ProbeVfsReadVRet: NewTraceProbe(kretProbe, "vfs_readv", "trace_ret_vfs_readv"), 353 //ProbeVfsUtimes: NewTraceProbe(kProbe, "vfs_utimes", "trace_vfs_utimes"), 354 //ProbeUtimesCommon: NewTraceProbe(kProbe, "utimes_common", "trace_utimes_common"), 355 //ProbeDoTruncate: NewTraceProbe(kProbe, "do_truncate", "trace_do_truncate"), 356 ProbeFileUpdateTime: newTraceProbe(kProbe, "file_update_time", objs.TraceFileUpdateTime), 357 ProbeFileUpdateTimeRet: newTraceProbe(kretProbe, "file_update_time", objs.TraceRetFileUpdateTime), 358 ProbeFileModified: newTraceProbe(kProbe, "file_modified", objs.TraceFileModified), 359 ProbeFileModifiedRet: newTraceProbe(kretProbe, "file_modified", objs.TraceRetFileUpdateTime), 360 ProbeFdInstall: newTraceProbe(kProbe, "fd_install", objs.TraceFdInstall), 361 ProbeFilpClose: newTraceProbe(kProbe, "filp_close", objs.TraceFilpClose), 362 //ProbeInotifyFindInode: NewTraceProbe(kProbe, "inotify_find_inode", "trace_inotify_find_inode"), 363 //ProbeInotifyFindInodeRet: NewTraceProbe(kretProbe, "inotify_find_inode", "trace_ret_inotify_find_inode"), 364 //ProbeBpfCheck: NewTraceProbe(kProbe, "bpf_check", "trace_bpf_check"), 365 //ProbeExecBinprm: NewTraceProbe(kProbe, "exec_binprm", "trace_exec_binprm"), 366 //ProbeExecBinprmRet: NewTraceProbe(kretProbe, "exec_binprm", "trace_ret_exec_binprm"), 367 //ProbeTpProbeRegPrioMayExist: NewTraceProbe(kProbe, "tracepoint_probe_register_prio_may_exist", "trace_tracepoint_probe_register_prio_may_exist"), 368 //ProbeModuleLoad: NewTraceProbe(rawTracepoint, "module:module_load", "tracepoint__module__module_load"), 369 //ProbeModuleFree: NewTraceProbe(rawTracepoint, "module:module_free", "tracepoint__module__module_free"), 370 //ProbeLayoutAndAllocate: NewTraceProbe(kretProbe, "layout_and_allocate", "trace_ret_layout_and_allocate"), 371 ProbeInetSockSetState: newTraceProbe(rawTracepoint, "sock:inet_sock_set_state", objs.TraceInetSockSetState), 372 ProbeOomMarkVictim: newTraceProbe(rawTracepoint, "oom:mark_victim", objs.OomMarkVictim), 373 ProbeTtyOpen: newTraceProbe(kProbe, "tty_open", objs.TtyOpen), 374 375 // Signal probes 376 SignalCgroupMkdir: newTraceProbe(rawTracepoint, "cgroup:cgroup_mkdir", objs.CgroupMkdirSignal), 377 SignalCgroupRmdir: newTraceProbe(rawTracepoint, "cgroup:cgroup_rmdir", objs.CgroupRmdirSignal), 378 } 379 }