1 // SPDX-License-Identifier: GPL-2.0 2 /* Copyright (c) 2020 Facebook */ 3 #pragma once 4 5 #define TASK_COMM_LEN 16 6 #define MAX_ANCESTORS 4 7 #define MAX_PATH 256 8 #define KILL_TARGET_LEN 64 9 #define CTL_MAXNAME 10 10 #define MAX_ARGS_LEN 4096 11 #define MAX_FILENAME_LEN 512 12 #define MAX_ENVIRON_LEN 8192 13 #define MAX_PATH_DEPTH 32 14 #define MAX_FILEPATH_LENGTH (MAX_PATH_DEPTH * MAX_PATH) 15 #define MAX_CGROUPS_PATH_DEPTH 8 16 17 #define MAX_METADATA_PAYLOAD_LEN TASK_COMM_LEN 18 19 #define MAX_CGROUP_PAYLOAD_LEN \ 20 (MAX_PATH * 2 + (MAX_PATH * MAX_CGROUPS_PATH_DEPTH)) 21 22 #define MAX_CAP_PAYLOAD_LEN (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN) 23 24 #define MAX_SYSCTL_PAYLOAD_LEN \ 25 (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + CTL_MAXNAME + MAX_PATH) 26 27 #define MAX_KILL_PAYLOAD_LEN \ 28 (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + TASK_COMM_LEN + \ 29 KILL_TARGET_LEN) 30 31 #define MAX_EXEC_PAYLOAD_LEN \ 32 (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + MAX_FILENAME_LEN + \ 33 MAX_ARGS_LEN + MAX_ENVIRON_LEN) 34 35 #define MAX_FILEMOD_PAYLOAD_LEN \ 36 (MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN + MAX_FILEPATH_LENGTH + \ 37 MAX_FILEPATH_LENGTH) 38 39 enum data_type { 40 INVALID_EVENT, 41 EXEC_EVENT, 42 FORK_EVENT, 43 KILL_EVENT, 44 SYSCTL_EVENT, 45 FILEMOD_EVENT, 46 MAX_DATA_TYPE_EVENT 47 }; 48 49 enum filemod_type { 50 FMOD_OPEN, 51 FMOD_LINK, 52 FMOD_SYMLINK, 53 }; 54 55 struct ancestors_data_t { 56 pid_t ancestor_pids[MAX_ANCESTORS]; 57 uint32_t ancestor_exec_ids[MAX_ANCESTORS]; 58 uint64_t ancestor_start_times[MAX_ANCESTORS]; 59 uint32_t num_ancestors; 60 }; 61 62 struct var_metadata_t { 63 enum data_type type; 64 pid_t pid; 65 uint32_t exec_id; 66 uid_t uid; 67 gid_t gid; 68 uint64_t start_time; 69 uint32_t cpu_id; 70 uint64_t bpf_stats_num_perf_events; 71 uint64_t bpf_stats_start_ktime_ns; 72 uint8_t comm_length; 73 }; 74 75 struct cgroup_data_t { 76 ino_t cgroup_root_inode; 77 ino_t cgroup_proc_inode; 78 uint64_t cgroup_root_mtime; 79 uint64_t cgroup_proc_mtime; 80 uint16_t cgroup_root_length; 81 uint16_t cgroup_proc_length; 82 uint16_t cgroup_full_length; 83 int cgroup_full_path_root_pos; 84 }; 85 86 struct var_sysctl_data_t { 87 struct var_metadata_t meta; 88 struct cgroup_data_t cgroup_data; 89 struct ancestors_data_t ancestors_info; 90 uint8_t sysctl_val_length; 91 uint16_t sysctl_path_length; 92 char payload[MAX_SYSCTL_PAYLOAD_LEN]; 93 }; 94 95 struct var_kill_data_t { 96 struct var_metadata_t meta; 97 struct cgroup_data_t cgroup_data; 98 struct ancestors_data_t ancestors_info; 99 pid_t kill_target_pid; 100 int kill_sig; 101 uint32_t kill_count; 102 uint64_t last_kill_time; 103 uint8_t kill_target_name_length; 104 uint8_t kill_target_cgroup_proc_length; 105 char payload[MAX_KILL_PAYLOAD_LEN]; 106 size_t payload_length; 107 }; 108 109 struct var_exec_data_t { 110 struct var_metadata_t meta; 111 struct cgroup_data_t cgroup_data; 112 pid_t parent_pid; 113 uint32_t parent_exec_id; 114 uid_t parent_uid; 115 uint64_t parent_start_time; 116 uint16_t bin_path_length; 117 uint16_t cmdline_length; 118 uint16_t environment_length; 119 char payload[MAX_EXEC_PAYLOAD_LEN]; 120 }; 121 122 struct var_fork_data_t { 123 struct var_metadata_t meta; 124 pid_t parent_pid; 125 uint32_t parent_exec_id; 126 uint64_t parent_start_time; 127 char payload[MAX_METADATA_PAYLOAD_LEN]; 128 }; 129 130 struct var_filemod_data_t { 131 struct var_metadata_t meta; 132 struct cgroup_data_t cgroup_data; 133 enum filemod_type fmod_type; 134 unsigned int dst_flags; 135 uint32_t src_device_id; 136 uint32_t dst_device_id; 137 ino_t src_inode; 138 ino_t dst_inode; 139 uint16_t src_filepath_length; 140 uint16_t dst_filepath_length; 141 char payload[MAX_FILEMOD_PAYLOAD_LEN]; 142 }; 143 144 struct profiler_config_struct { 145 bool fetch_cgroups_from_bpf; 146 ino_t cgroup_fs_inode; 147 ino_t cgroup_login_session_inode; 148 uint64_t kill_signals_mask; 149 ino_t inode_filter; 150 uint32_t stale_info_secs; 151 bool use_variable_buffers; 152 bool read_environ_from_exec; 153 bool enable_cgroup_v1_resolver; 154 }; 155 156 struct bpf_func_stats_data { 157 uint64_t time_elapsed_ns; 158 uint64_t num_executions; 159 uint64_t num_perf_events; 160 }; 161 162 struct bpf_func_stats_ctx { 163 uint64_t start_time_ns; 164 struct bpf_func_stats_data* bpf_func_stats_data_val; 165 }; 166 167 enum bpf_function_id { 168 profiler_bpf_proc_sys_write, 169 profiler_bpf_sched_process_exec, 170 profiler_bpf_sched_process_exit, 171 profiler_bpf_sys_enter_kill, 172 profiler_bpf_do_filp_open_ret, 173 profiler_bpf_sched_process_fork, 174 profiler_bpf_vfs_link, 175 profiler_bpf_vfs_symlink, 176 profiler_bpf_max_function_id 177 }; 178