diff options
| -rw-r--r-- | internal/c/generated/tracepoints.c | 2118 | ||||
| -rw-r--r-- | internal/c/generated/tracepoints.raku | 203 | ||||
| -rw-r--r-- | internal/c/ioriotng.bpf.c | 3 | ||||
| -rw-r--r-- | internal/c/tracepoints/open.c | 71 | ||||
| -rw-r--r-- | internal/c/types.h | 1 | ||||
| -rw-r--r-- | internal/eventloop.go | 2 | ||||
| -rw-r--r-- | internal/generated/tracepoints/tracepoints.go | 252 | ||||
| -rw-r--r-- | internal/generated/types/types.go | 263 |
8 files changed, 1966 insertions, 947 deletions
diff --git a/internal/c/generated/tracepoints.c b/internal/c/generated/tracepoints.c index 8ba2028..e1cb7d6 100644 --- a/internal/c/generated/tracepoints.c +++ b/internal/c/generated/tracepoints.c @@ -1,114 +1,177 @@ // Code generated - don't change manually! -#define SYS_EXIT_CACHESTAT 527 -#define SYS_ENTER_CACHESTAT 528 -#define SYS_EXIT_CLOSE_RANGE 700 -#define SYS_ENTER_CLOSE_RANGE 701 -#define SYS_EXIT_CLOSE 702 -#define SYS_ENTER_CLOSE 703 -#define SYS_EXIT_CREAT 704 -#define SYS_ENTER_CREAT 705 -#define SYS_EXIT_FCHOWN 712 -#define SYS_ENTER_FCHOWN 713 -#define SYS_EXIT_FCHMOD 726 -#define SYS_ENTER_FCHMOD 727 -#define SYS_EXIT_FCHDIR 730 -#define SYS_ENTER_FCHDIR 731 -#define SYS_EXIT_FTRUNCATE 742 -#define SYS_ENTER_FTRUNCATE 743 -#define SYS_EXIT_COPY_FILE_RANGE 746 -#define SYS_ENTER_COPY_FILE_RANGE 747 -#define SYS_EXIT_PWRITE64 762 -#define SYS_ENTER_PWRITE64 763 -#define SYS_EXIT_PREAD64 764 -#define SYS_ENTER_PREAD64 765 -#define SYS_EXIT_WRITE 766 -#define SYS_ENTER_WRITE 767 -#define SYS_EXIT_READ 768 -#define SYS_ENTER_READ 769 -#define SYS_EXIT_LSEEK 770 -#define SYS_ENTER_LSEEK 771 -#define SYS_EXIT_READLINKAT 776 -#define SYS_ENTER_READLINKAT 777 -#define SYS_EXIT_NEWFSTAT 778 -#define SYS_ENTER_NEWFSTAT 779 -#define SYS_EXIT_RENAME 794 -#define SYS_ENTER_RENAME 795 -#define SYS_EXIT_RENAMEAT 796 -#define SYS_ENTER_RENAMEAT 797 -#define SYS_EXIT_RENAMEAT2 798 -#define SYS_ENTER_RENAMEAT2 799 -#define SYS_EXIT_LINK 800 -#define SYS_ENTER_LINK 801 -#define SYS_EXIT_LINKAT 802 -#define SYS_ENTER_LINKAT 803 -#define SYS_EXIT_SYMLINK 804 -#define SYS_ENTER_SYMLINK 805 -#define SYS_EXIT_SYMLINKAT 806 -#define SYS_ENTER_SYMLINKAT 807 -#define SYS_EXIT_UNLINK 808 -#define SYS_ENTER_UNLINK 809 -#define SYS_EXIT_UNLINKAT 810 -#define SYS_ENTER_UNLINKAT 811 -#define SYS_EXIT_RMDIR 812 -#define SYS_ENTER_RMDIR 813 -#define SYS_EXIT_MKDIR 814 -#define SYS_ENTER_MKDIR 815 -#define SYS_EXIT_MKDIRAT 816 -#define SYS_ENTER_MKDIRAT 817 -#define SYS_EXIT_FCNTL 822 -#define SYS_ENTER_FCNTL 823 -#define SYS_EXIT_IOCTL 824 -#define SYS_ENTER_IOCTL 825 -#define SYS_EXIT_GETDENTS64 826 -#define SYS_ENTER_GETDENTS64 827 -#define SYS_EXIT_GETDENTS 828 -#define SYS_ENTER_GETDENTS 829 -#define SYS_EXIT_LREMOVEXATTR 862 -#define SYS_ENTER_LREMOVEXATTR 863 -#define SYS_EXIT_REMOVEXATTR 864 -#define SYS_ENTER_REMOVEXATTR 865 -#define SYS_EXIT_LLISTXATTR 868 -#define SYS_ENTER_LLISTXATTR 869 -#define SYS_EXIT_LISTXATTR 870 -#define SYS_ENTER_LISTXATTR 871 -#define SYS_EXIT_LGETXATTR 874 -#define SYS_ENTER_LGETXATTR 875 -#define SYS_EXIT_GETXATTR 876 -#define SYS_ENTER_GETXATTR 877 -#define SYS_EXIT_LSETXATTR 880 -#define SYS_ENTER_LSETXATTR 881 -#define SYS_EXIT_SETXATTR 882 -#define SYS_ENTER_SETXATTR 883 -#define SYS_EXIT_SYNC_FILE_RANGE 922 -#define SYS_ENTER_SYNC_FILE_RANGE 923 -#define SYS_EXIT_FDATASYNC 924 -#define SYS_ENTER_FDATASYNC 925 -#define SYS_EXIT_FSYNC 926 -#define SYS_ENTER_FSYNC 927 -#define SYS_EXIT_FSTATFS 944 -#define SYS_ENTER_FSTATFS 945 -#define SYS_EXIT_STATFS 946 -#define SYS_ENTER_STATFS 947 -#define SYS_EXIT_INOTIFY_RM_WATCH 954 -#define SYS_ENTER_INOTIFY_RM_WATCH 955 -#define SYS_EXIT_INOTIFY_ADD_WATCH 956 -#define SYS_ENTER_INOTIFY_ADD_WATCH 957 -#define SYS_EXIT_FANOTIFY_MARK 962 -#define SYS_ENTER_FANOTIFY_MARK 963 -#define SYS_EXIT_FLOCK 1020 -#define SYS_ENTER_FLOCK 1021 -#define SYS_EXIT_QUOTACTL_FD 1051 -#define SYS_ENTER_QUOTACTL_FD 1052 -#define SYS_EXIT_MQ_UNLINK 1321 -#define SYS_ENTER_MQ_UNLINK 1322 -#define SYS_EXIT_IO_URING_REGISTER 1377 -#define SYS_ENTER_IO_URING_REGISTER 1378 -#define SYS_EXIT_IO_URING_ENTER 1381 #define SYS_ENTER_IO_URING_ENTER 1382 +#define SYS_EXIT_IO_URING_ENTER 1381 +#define SYS_ENTER_IO_URING_REGISTER 1378 +#define SYS_EXIT_IO_URING_REGISTER 1377 +#define SYS_ENTER_QUOTACTL_FD 1052 +#define SYS_EXIT_QUOTACTL_FD 1051 +#define SYS_ENTER_FLOCK 1021 +#define SYS_EXIT_FLOCK 1020 +#define SYS_ENTER_FANOTIFY_MARK 963 +#define SYS_EXIT_FANOTIFY_MARK 962 +#define SYS_ENTER_INOTIFY_ADD_WATCH 957 +#define SYS_EXIT_INOTIFY_ADD_WATCH 956 +#define SYS_ENTER_STATFS 947 +#define SYS_EXIT_STATFS 946 +#define SYS_ENTER_FSTATFS 945 +#define SYS_EXIT_FSTATFS 944 +#define SYS_ENTER_UTIMENSAT 939 +#define SYS_EXIT_UTIMENSAT 938 +#define SYS_ENTER_FUTIMESAT 937 +#define SYS_EXIT_FUTIMESAT 936 +#define SYS_ENTER_FSYNC 927 +#define SYS_EXIT_FSYNC 926 +#define SYS_ENTER_FDATASYNC 925 +#define SYS_EXIT_FDATASYNC 924 +#define SYS_ENTER_SETXATTR 883 +#define SYS_EXIT_SETXATTR 882 +#define SYS_ENTER_LSETXATTR 881 +#define SYS_EXIT_LSETXATTR 880 +#define SYS_ENTER_GETXATTR 877 +#define SYS_EXIT_GETXATTR 876 +#define SYS_ENTER_LGETXATTR 875 +#define SYS_EXIT_LGETXATTR 874 +#define SYS_ENTER_LISTXATTR 871 +#define SYS_EXIT_LISTXATTR 870 +#define SYS_ENTER_LLISTXATTR 869 +#define SYS_EXIT_LLISTXATTR 868 +#define SYS_ENTER_REMOVEXATTR 865 +#define SYS_EXIT_REMOVEXATTR 864 +#define SYS_ENTER_LREMOVEXATTR 863 +#define SYS_EXIT_LREMOVEXATTR 862 +#define SYS_ENTER_OPEN_TREE 857 +#define SYS_EXIT_OPEN_TREE 856 +#define SYS_ENTER_GETDENTS 829 +#define SYS_EXIT_GETDENTS 828 +#define SYS_ENTER_GETDENTS64 827 +#define SYS_EXIT_GETDENTS64 826 +#define SYS_ENTER_IOCTL 825 +#define SYS_EXIT_IOCTL 824 +#define SYS_ENTER_FCNTL 823 +#define SYS_EXIT_FCNTL 822 +#define SYS_ENTER_MKNODAT 821 +#define SYS_EXIT_MKNODAT 820 +#define SYS_ENTER_MKNOD 819 +#define SYS_EXIT_MKNOD 818 +#define SYS_ENTER_MKDIRAT 817 +#define SYS_EXIT_MKDIRAT 816 +#define SYS_ENTER_MKDIR 815 +#define SYS_EXIT_MKDIR 814 +#define SYS_ENTER_RMDIR 813 +#define SYS_EXIT_RMDIR 812 +#define SYS_ENTER_UNLINKAT 811 +#define SYS_EXIT_UNLINKAT 810 +#define SYS_ENTER_UNLINK 809 +#define SYS_EXIT_UNLINK 808 +#define SYS_ENTER_SYMLINKAT 807 +#define SYS_EXIT_SYMLINKAT 806 +#define SYS_ENTER_SYMLINK 805 +#define SYS_EXIT_SYMLINK 804 +#define SYS_ENTER_LINKAT 803 +#define SYS_EXIT_LINKAT 802 +#define SYS_ENTER_LINK 801 +#define SYS_EXIT_LINK 800 +#define SYS_ENTER_RENAMEAT2 799 +#define SYS_EXIT_RENAMEAT2 798 +#define SYS_ENTER_RENAMEAT 797 +#define SYS_EXIT_RENAMEAT 796 +#define SYS_ENTER_RENAME 795 +#define SYS_EXIT_RENAME 794 +#define SYS_ENTER_EXECVE 789 +#define SYS_EXIT_EXECVE 788 +#define SYS_ENTER_EXECVEAT 787 +#define SYS_EXIT_EXECVEAT 786 +#define SYS_ENTER_NEWSTAT 785 +#define SYS_EXIT_NEWSTAT 784 +#define SYS_ENTER_NEWLSTAT 783 +#define SYS_EXIT_NEWLSTAT 782 +#define SYS_ENTER_NEWFSTATAT 781 +#define SYS_EXIT_NEWFSTATAT 780 +#define SYS_ENTER_NEWFSTAT 779 +#define SYS_EXIT_NEWFSTAT 778 +#define SYS_ENTER_READLINKAT 777 +#define SYS_EXIT_READLINKAT 776 +#define SYS_ENTER_STATX 773 +#define SYS_EXIT_STATX 772 +#define SYS_ENTER_LSEEK 771 +#define SYS_EXIT_LSEEK 770 +#define SYS_ENTER_READ 769 +#define SYS_EXIT_READ 768 +#define SYS_ENTER_WRITE 767 +#define SYS_EXIT_WRITE 766 +#define SYS_ENTER_PREAD64 765 +#define SYS_EXIT_PREAD64 764 +#define SYS_ENTER_PWRITE64 763 +#define SYS_EXIT_PWRITE64 762 +#define SYS_ENTER_FTRUNCATE 743 +#define SYS_EXIT_FTRUNCATE 742 +#define SYS_ENTER_FACCESSAT 739 +#define SYS_EXIT_FACCESSAT 738 +#define SYS_ENTER_FACCESSAT2 737 +#define SYS_EXIT_FACCESSAT2 736 +#define SYS_ENTER_ACCESS 735 +#define SYS_EXIT_ACCESS 734 +#define SYS_ENTER_CHDIR 733 +#define SYS_EXIT_CHDIR 732 +#define SYS_ENTER_FCHDIR 731 +#define SYS_EXIT_FCHDIR 730 +#define SYS_ENTER_CHROOT 729 +#define SYS_EXIT_CHROOT 728 +#define SYS_ENTER_FCHMOD 727 +#define SYS_EXIT_FCHMOD 726 +#define SYS_ENTER_FCHMODAT2 725 +#define SYS_EXIT_FCHMODAT2 724 +#define SYS_ENTER_FCHMODAT 723 +#define SYS_EXIT_FCHMODAT 722 +#define SYS_ENTER_CHMOD 721 +#define SYS_EXIT_CHMOD 720 +#define SYS_ENTER_FCHOWNAT 719 +#define SYS_EXIT_FCHOWNAT 718 +#define SYS_ENTER_CHOWN 717 +#define SYS_EXIT_CHOWN 716 +#define SYS_ENTER_LCHOWN 715 +#define SYS_EXIT_LCHOWN 714 +#define SYS_ENTER_FCHOWN 713 +#define SYS_EXIT_FCHOWN 712 +#define SYS_ENTER_OPEN 711 +#define SYS_EXIT_OPEN 710 +#define SYS_ENTER_OPENAT 709 +#define SYS_EXIT_OPENAT 708 +#define SYS_ENTER_OPENAT2 707 +#define SYS_EXIT_OPENAT2 706 +#define SYS_ENTER_CREAT 705 +#define SYS_EXIT_CREAT 704 +#define SYS_ENTER_CLOSE 703 +#define SYS_EXIT_CLOSE 702 +#define SYS_ENTER_CLOSE_RANGE 701 +#define SYS_EXIT_CLOSE_RANGE 700 +#define SYS_ENTER_CACHESTAT 528 +#define SYS_EXIT_CACHESTAT 527 -SEC("tracepoint/syscalls/sys_exit_cachestat") -int handle_sys_exit_cachestat(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_enter_io_uring_enter") +int handle_sys_enter_io_uring_enter(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_FD_EVENT; + ev->trace_id = SYS_ENTER_IO_URING_ENTER; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + ev->fd = (__s32)ctx->args[0]; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_io_uring_enter") +int handle_sys_exit_io_uring_enter(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -118,18 +181,18 @@ int handle_sys_exit_cachestat(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_CACHESTAT; + ev->trace_id = SYS_EXIT_IO_URING_ENTER; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->ret = ctx->ret; + ev->ret = ctx->ret; bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_enter_cachestat") -int handle_sys_enter_cachestat(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_io_uring_register") +int handle_sys_enter_io_uring_register(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -139,7 +202,7 @@ int handle_sys_enter_cachestat(struct trace_event_raw_sys_enter *ctx) { return 0; ev->event_type = ENTER_FD_EVENT; - ev->trace_id = SYS_ENTER_CACHESTAT; + ev->trace_id = SYS_ENTER_IO_URING_REGISTER; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; @@ -149,8 +212,8 @@ int handle_sys_enter_cachestat(struct trace_event_raw_sys_enter *ctx) { return 0; } -SEC("tracepoint/syscalls/sys_exit_close_range") -int handle_sys_exit_close_range(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_exit_io_uring_register") +int handle_sys_exit_io_uring_register(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -160,18 +223,18 @@ int handle_sys_exit_close_range(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_CLOSE_RANGE; + ev->trace_id = SYS_EXIT_IO_URING_REGISTER; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->ret = ctx->ret; + ev->ret = ctx->ret; bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_enter_close_range") -int handle_sys_enter_close_range(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_quotactl_fd") +int handle_sys_enter_quotactl_fd(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -181,7 +244,7 @@ int handle_sys_enter_close_range(struct trace_event_raw_sys_enter *ctx) { return 0; ev->event_type = ENTER_FD_EVENT; - ev->trace_id = SYS_ENTER_CLOSE_RANGE; + ev->trace_id = SYS_ENTER_QUOTACTL_FD; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; @@ -191,8 +254,8 @@ int handle_sys_enter_close_range(struct trace_event_raw_sys_enter *ctx) { return 0; } -SEC("tracepoint/syscalls/sys_exit_close") -int handle_sys_exit_close(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_exit_quotactl_fd") +int handle_sys_exit_quotactl_fd(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -202,18 +265,18 @@ int handle_sys_exit_close(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_CLOSE; + ev->trace_id = SYS_EXIT_QUOTACTL_FD; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->ret = ctx->ret; + ev->ret = ctx->ret; bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_enter_close") -int handle_sys_enter_close(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_flock") +int handle_sys_enter_flock(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -223,7 +286,7 @@ int handle_sys_enter_close(struct trace_event_raw_sys_enter *ctx) { return 0; ev->event_type = ENTER_FD_EVENT; - ev->trace_id = SYS_ENTER_CLOSE; + ev->trace_id = SYS_ENTER_FLOCK; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; @@ -233,8 +296,8 @@ int handle_sys_enter_close(struct trace_event_raw_sys_enter *ctx) { return 0; } -SEC("tracepoint/syscalls/sys_exit_creat") -int handle_sys_exit_creat(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_exit_flock") +int handle_sys_exit_flock(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -244,18 +307,18 @@ int handle_sys_exit_creat(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_CREAT; + ev->trace_id = SYS_EXIT_FLOCK; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->ret = ctx->ret; + ev->ret = ctx->ret; bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_enter_creat") -int handle_sys_enter_creat(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_fanotify_mark") +int handle_sys_enter_fanotify_mark(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -265,7 +328,93 @@ int handle_sys_enter_creat(struct trace_event_raw_sys_enter *ctx) { return 0; ev->event_type = ENTER_PATH_EVENT; - ev->trace_id = SYS_ENTER_CREAT; + ev->trace_id = SYS_ENTER_FANOTIFY_MARK; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname)); + bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[4]); + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_fanotify_mark") +int handle_sys_exit_fanotify_mark(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_FANOTIFY_MARK; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_enter_inotify_add_watch") +int handle_sys_enter_inotify_add_watch(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_PATH_EVENT; + ev->trace_id = SYS_ENTER_INOTIFY_ADD_WATCH; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname)); + bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[1]); + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_inotify_add_watch") +int handle_sys_exit_inotify_add_watch(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_INOTIFY_ADD_WATCH; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_enter_statfs") +int handle_sys_enter_statfs(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_PATH_EVENT; + ev->trace_id = SYS_ENTER_STATFS; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; @@ -276,8 +425,8 @@ int handle_sys_enter_creat(struct trace_event_raw_sys_enter *ctx) { return 0; } -SEC("tracepoint/syscalls/sys_exit_fchown") -int handle_sys_exit_fchown(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_exit_statfs") +int handle_sys_exit_statfs(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -287,18 +436,18 @@ int handle_sys_exit_fchown(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_FCHOWN; + ev->trace_id = SYS_EXIT_STATFS; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->ret = ctx->ret; + ev->ret = ctx->ret; bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_enter_fchown") -int handle_sys_enter_fchown(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_fstatfs") +int handle_sys_enter_fstatfs(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -308,7 +457,7 @@ int handle_sys_enter_fchown(struct trace_event_raw_sys_enter *ctx) { return 0; ev->event_type = ENTER_FD_EVENT; - ev->trace_id = SYS_ENTER_FCHOWN; + ev->trace_id = SYS_ENTER_FSTATFS; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; @@ -318,8 +467,8 @@ int handle_sys_enter_fchown(struct trace_event_raw_sys_enter *ctx) { return 0; } -SEC("tracepoint/syscalls/sys_exit_fchmod") -int handle_sys_exit_fchmod(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_exit_fstatfs") +int handle_sys_exit_fstatfs(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -329,39 +478,41 @@ int handle_sys_exit_fchmod(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_FCHMOD; + ev->trace_id = SYS_EXIT_FSTATFS; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->ret = ctx->ret; + ev->ret = ctx->ret; bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_enter_fchmod") -int handle_sys_enter_fchmod(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_utimensat") +int handle_sys_enter_utimensat(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; - struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0); + struct open_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct open_event), 0); if (!ev) return 0; - ev->event_type = ENTER_FD_EVENT; - ev->trace_id = SYS_ENTER_FCHMOD; + ev->event_type = ENTER_OPEN_EVENT; + ev->trace_id = SYS_ENTER_UTIMENSAT; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->fd = (__s32)ctx->args[0]; + __builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm)); + bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[1]); + bpf_get_current_comm(&ev->comm, sizeof(ev->comm)); bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_exit_fchdir") -int handle_sys_exit_fchdir(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_exit_utimensat") +int handle_sys_exit_utimensat(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -371,18 +522,62 @@ int handle_sys_exit_fchdir(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_FCHDIR; + ev->trace_id = SYS_EXIT_UTIMENSAT; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->ret = ctx->ret; + ev->ret = ctx->ret; bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_enter_fchdir") -int handle_sys_enter_fchdir(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_futimesat") +int handle_sys_enter_futimesat(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct open_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct open_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_OPEN_EVENT; + ev->trace_id = SYS_ENTER_FUTIMESAT; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + __builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm)); + bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[1]); + bpf_get_current_comm(&ev->comm, sizeof(ev->comm)); + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_futimesat") +int handle_sys_exit_futimesat(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_FUTIMESAT; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_enter_fsync") +int handle_sys_enter_fsync(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -392,7 +587,7 @@ int handle_sys_enter_fchdir(struct trace_event_raw_sys_enter *ctx) { return 0; ev->event_type = ENTER_FD_EVENT; - ev->trace_id = SYS_ENTER_FCHDIR; + ev->trace_id = SYS_ENTER_FSYNC; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; @@ -402,8 +597,8 @@ int handle_sys_enter_fchdir(struct trace_event_raw_sys_enter *ctx) { return 0; } -SEC("tracepoint/syscalls/sys_exit_ftruncate") -int handle_sys_exit_ftruncate(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_exit_fsync") +int handle_sys_exit_fsync(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -413,18 +608,18 @@ int handle_sys_exit_ftruncate(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_FTRUNCATE; + ev->trace_id = SYS_EXIT_FSYNC; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->ret = ctx->ret; + ev->ret = ctx->ret; bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_enter_ftruncate") -int handle_sys_enter_ftruncate(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_fdatasync") +int handle_sys_enter_fdatasync(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -434,7 +629,7 @@ int handle_sys_enter_ftruncate(struct trace_event_raw_sys_enter *ctx) { return 0; ev->event_type = ENTER_FD_EVENT; - ev->trace_id = SYS_ENTER_FTRUNCATE; + ev->trace_id = SYS_ENTER_FDATASYNC; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; @@ -444,8 +639,8 @@ int handle_sys_enter_ftruncate(struct trace_event_raw_sys_enter *ctx) { return 0; } -SEC("tracepoint/syscalls/sys_exit_copy_file_range") -int handle_sys_exit_copy_file_range(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_exit_fdatasync") +int handle_sys_exit_fdatasync(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -455,39 +650,40 @@ int handle_sys_exit_copy_file_range(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_COPY_FILE_RANGE; + ev->trace_id = SYS_EXIT_FDATASYNC; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->ret = ctx->ret; + ev->ret = ctx->ret; bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_enter_copy_file_range") -int handle_sys_enter_copy_file_range(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_setxattr") +int handle_sys_enter_setxattr(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; - struct null_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct null_event), 0); + struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0); if (!ev) return 0; - ev->event_type = ENTER_NULL_EVENT; - ev->trace_id = SYS_ENTER_COPY_FILE_RANGE; + ev->event_type = ENTER_PATH_EVENT; + ev->trace_id = SYS_ENTER_SETXATTR; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - + __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname)); + bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]); bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_exit_pwrite64") -int handle_sys_exit_pwrite64(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_exit_setxattr") +int handle_sys_exit_setxattr(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -497,39 +693,40 @@ int handle_sys_exit_pwrite64(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_PWRITE64; + ev->trace_id = SYS_EXIT_SETXATTR; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->ret = ctx->ret; + ev->ret = ctx->ret; bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_enter_pwrite64") -int handle_sys_enter_pwrite64(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_lsetxattr") +int handle_sys_enter_lsetxattr(struct trace_event_raw_sys_enter *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; - struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0); + struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0); if (!ev) return 0; - ev->event_type = ENTER_FD_EVENT; - ev->trace_id = SYS_ENTER_PWRITE64; + ev->event_type = ENTER_PATH_EVENT; + ev->trace_id = SYS_ENTER_LSETXATTR; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->fd = (__s32)ctx->args[0]; + __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname)); + bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]); bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_exit_pread64") -int handle_sys_exit_pread64(struct trace_event_raw_sys_exit *ctx) { +SEC("tracepoint/syscalls/sys_exit_lsetxattr") +int handle_sys_exit_lsetxattr(struct trace_event_raw_sys_exit *ctx) { __u32 pid, tid; if (filter(&pid, &tid)) return 0; @@ -539,18 +736,320 @@ int handle_sys_exit_pread64(struct trace_event_raw_sys_exit *ctx) { return 0; ev->event_type = EXIT_RET_EVENT; - ev->trace_id = SYS_EXIT_PREAD64; + ev->trace_id = SYS_EXIT_LSETXATTR; ev->pid = pid; ev->tid = tid; ev->time = bpf_ktime_get_ns() / 1000; - ev->ret = ctx->ret; + ev->ret = ctx->ret; bpf_ringbuf_submit(ev, 0); return 0; } -SEC("tracepoint/syscalls/sys_enter_pread64") -int handle_sys_enter_pread64(struct trace_event_raw_sys_enter *ctx) { +SEC("tracepoint/syscalls/sys_enter_getxattr") +int handle_sys_enter_getxattr(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_PATH_EVENT; + ev->trace_id = SYS_ENTER_GETXATTR; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname)); + bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]); + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_getxattr") +int handle_sys_exit_getxattr(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_GETXATTR; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_enter_lgetxattr") +int handle_sys_enter_lgetxattr(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_PATH_EVENT; + ev->trace_id = SYS_ENTER_LGETXATTR; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname)); + bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]); + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_lgetxattr") +int handle_sys_exit_lgetxattr(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_LGETXATTR; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_enter_listxattr") +int handle_sys_enter_listxattr(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_PATH_EVENT; + ev->trace_id = SYS_ENTER_LISTXATTR; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname)); + bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]); + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_listxattr") +int handle_sys_exit_listxattr(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct ret_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct ret_event), 0); + if (!ev) + return 0; + + ev->event_type = EXIT_RET_EVENT; + ev->trace_id = SYS_EXIT_LISTXATTR; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + ev->ret = ctx->ret; + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_enter_llistxattr") +int handle_sys_enter_llistxattr(struct trace_event_raw_sys_enter *ctx) { + __u32 pid, tid; + if (filter(&pid, &tid)) + return 0; + + struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0); + if (!ev) + return 0; + + ev->event_type = ENTER_PATH_EVENT; + ev->trace_id = SYS_ENTER_LLISTXATTR; + ev->pid = pid; + ev->tid = tid; + ev->time = bpf_ktime_get_ns() / 1000; + __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname)); + bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]); + + bpf_ringbuf_submit(ev, 0); + return 0; +} + +SEC("tracepoint/syscalls/sys_exit_llistxattr") +int handle_sys_exit_llistxattr(struct trace_event_raw_sys_exit *ctx) { + __u32 pid, tid; + if (filter |