can trace openat exit

2 files changed, 57 insertions, 41 deletions

diff --git a/main.bpf.c b/main.bpf.c
index df20264..475d2ee 100644
--- a/main.bpf.c
+++ b/main.bpf.c
@@ -1,6 +1,6 @@
 //+build ignore
 
-#include <vmlinux.h>
+#include "vmlinux.h"
 
 #include <bpf/bpf_helpers.h>
 
@@ -16,18 +16,27 @@ struct {
     __uint(max_entries, 1 << 24);
 } tester SEC(".maps");
 
+struct openat_event {
+    int fd;
+    u32 tid;
+    char filename[256];
+    char comm[16];
+};
+
 struct {
     __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
     __uint(key_size, sizeof(u32));
     __uint(value_size, sizeof(u32));
 } events SEC(".maps");
 
-SEC("kprobe/sys_mmap")
-int kprobe__sys_mmap(struct pt_regs *ctx)
-{
-    char *foo = "foo";
-    bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, foo, sizeof(char) * 3);
+SEC("tracepoint/syscalls/sys_exit_openat")
+int handle_openat(struct trace_event_raw_sys_exit *args) {
+    struct openat_event event = {};
+    event.fd = args->ret;
+    event.tid = bpf_get_current_pid_tgid();
+    bpf_get_current_comm(&event.comm, sizeof(event.comm));
 
+    bpf_perf_event_output(args, &events, BPF_F_CURRENT_CPU, &event, sizeof(event));
     return 0;
 }
 
diff --git a/main.go b/main.go
index df21bae..3faa0e8 100644
--- a/main.go
+++ b/main.go
@@ -3,17 +3,29 @@ package main
 import "C"
 
 import (
+	"bytes"
+	"encoding/binary"
+	"fmt"
 	"os"
 	"runtime"
-	"time"
-	"unsafe"
-
-	"fmt"
-	"syscall"
 
 	bpf "github.com/aquasecurity/libbpfgo"
 )
 
+type openatEvent struct {
+	FD       int32
+	TID      uint32
+	Filename [256]byte
+	Comm     [16]byte
+}
+
+func (e openatEvent) String() string {
+	filename := e.Filename[:]
+	comm := e.Comm[:]
+	return fmt.Sprintf("tid:%v fd:%v filename:%s, comm:%s",
+		e.TID, e.FD, string(filename), string(comm))
+}
+
 func resizeMap(module *bpf.Module, name string, size uint32) error {
 	m, err := module.GetMap("events")
 	if err != nil {
@@ -44,11 +56,22 @@ func main() {
 		os.Exit(-1)
 	}
 
-	bpfModule.BPFLoadObject()
-	prog, err := bpfModule.GetProgram("kprobe__sys_mmap")
+	err = bpfModule.BPFLoadObject()
 	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(-1)
+		fmt.Fprintf(os.Stderr, "Failed to load BPF object: %v\n", err)
+		return
+	}
+
+	// Attach to tracepoint
+	prog, err := bpfModule.GetProgram("handle_openat")
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to get BPF program: %v\n", err)
+		os.Exit(1)
+	}
+	_, err = prog.AttachTracepoint("syscalls", "sys_exit_openat")
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to attach to sys_exit_openat tracepoint: %v\n", err)
+		return
 	}
 
 	testerMap, err := bpfModule.GetMap("tester")
@@ -67,25 +90,6 @@ func main() {
 		os.Exit(-1)
 	}
 
-	key1 := uint32(1)
-	value1 := struct{ x int }{50}
-	key1Unsafe := unsafe.Pointer(&key1)
-	value1Unsafe := unsafe.Pointer(&value1)
-	testerMap.Update(key1Unsafe, value1Unsafe)
-
-	key2 := int64(42069420)
-	value2 := []byte{'a', 'b', 'c'}
-	key2Unsafe := unsafe.Pointer(&key2)
-	value2Unsafe := unsafe.Pointer(&value2[0])
-	testerMap.Update(key2Unsafe, value2Unsafe)
-
-	funcName := fmt.Sprintf("__%s_sys_mmap", ksymArch())
-	_, err = prog.AttachKprobe(funcName)
-	if err != nil {
-		fmt.Fprintln(os.Stderr, err)
-		os.Exit(-1)
-	}
-
 	eventsChannel := make(chan []byte)
 	lostChannel := make(chan uint64)
 	pb, err := bpfModule.InitPerfBuf("events", eventsChannel, lostChannel, 1)
@@ -96,14 +100,17 @@ func main() {
 
 	pb.Poll(300)
 
-	go func() {
-		time.Sleep(time.Second)
-		syscall.Mmap(999, 999, 999, 1, 1)
-		syscall.Mmap(999, 999, 999, 1, 1)
-	}()
-
 	ev := <-eventsChannel
-	fmt.Println("Received ", string(ev))
+	var e openatEvent
+	if err := binary.Read(bytes.NewReader(ev), binary.LittleEndian, &e); err != nil {
+		fmt.Fprintln(os.Stderr, err)
+		os.Exit(-1)
+
+	}
+
+	fmt.Println("Bytes ", ev)
+	fmt.Println("Struct ", e)
+	fmt.Println("Human ", e.String())
 
 	pb.Stop()
 	pb.Close()