add debugfs.TracepointsWithF

2 files changed, 61 insertions, 0 deletions

diff --git a/internal/debugfs/debugfs.go b/internal/debugfs/debugfs.go
new file mode 100644
index 0000000..80ac436
--- /dev/null
+++ b/internal/debugfs/debugfs.go
@@ -0,0 +1,57 @@
+package debugfs
+
+import (
+	"bufio"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// Return tracepoints with 'unsigned int fd', which are I/O tracepoints on FDs
+func TracepointsWithFd() ([]string, error) {
+	return tracepointsWith("unsigned int fd")
+}
+
+func tracepointsWith(field string) ([]string, error) {
+	var tracepoints []string
+
+	matches, err := filepath.Glob("/sys/kernel/debug/tracing/events/syscalls/*/format")
+	if err != nil {
+		return tracepoints, err
+	}
+	if len(matches) == 0 {
+		return tracepoints, fmt.Errorf("Unable to gather tracepoints with FDs")
+	}
+
+	for _, formatPath := range matches {
+		has, err := hasField(formatPath, field)
+		if err != nil {
+			return tracepoints, err
+		}
+		if !has {
+			continue
+		}
+		tracepoints = append(tracepoints, filepath.Base(filepath.Dir(formatPath)))
+	}
+
+	return tracepoints, nil
+}
+
+func hasField(formatPath, field string) (bool, error) {
+	file, err := os.Open(formatPath)
+	if err != nil {
+		return false, err
+	}
+	defer file.Close()
+
+	scanner := bufio.NewScanner(file)
+	for scanner.Scan() {
+		line := scanner.Text()
+		if strings.Contains(line, fmt.Sprintf("field:%s;", field)) {
+			return true, nil
+		}
+	}
+
+	return false, nil
+}
diff --git a/main.go b/main.go
index 5fbcc6c..c21b831 100644
--- a/main.go
+++ b/main.go
@@ -11,6 +11,7 @@ import (
 	"runtime"
 	"sync"
 
+	"ioriotng/internal/debugfs"
 	"ioriotng/internal/tracepoints"
 
 	bpf "github.com/aquasecurity/libbpfgo"
@@ -63,6 +64,9 @@ func resizeMap(module *bpf.Module, name string, size uint32) error {
 }
 
 func main() {
+	// To consider for implementation!
+	log.Println("Tracepoints with FD", debugfs.TracepointsWithFd())
+
 	bpfModule, err := bpf.NewModuleFromFile("main.bpf.o")
 	if err != nil {
 		log.Fatal(err)