103d4d13fSAlexei Starovoitov // SPDX-License-Identifier: GPL-2.0 203d4d13fSAlexei Starovoitov /* Copyright (c) 2020 Facebook */ 303d4d13fSAlexei Starovoitov #include <vmlinux.h> 403d4d13fSAlexei Starovoitov #include <bpf/bpf_core_read.h> 503d4d13fSAlexei Starovoitov #include <bpf/bpf_helpers.h> 603d4d13fSAlexei Starovoitov #include <bpf/bpf_tracing.h> 703d4d13fSAlexei Starovoitov 803d4d13fSAlexei Starovoitov #include "profiler.h" 9328bafc9SJiri Olsa #include "err.h" 107e3811cbSAlexei Starovoitov #include "bpf_experimental.h" 1152dbd67dSJose E. Marchesi #include "bpf_compiler.h" 12*a1297871SJiri Olsa #include "bpf_misc.h" 1303d4d13fSAlexei Starovoitov 1403d4d13fSAlexei Starovoitov #ifndef NULL 1503d4d13fSAlexei Starovoitov #define NULL 0 1603d4d13fSAlexei Starovoitov #endif 1703d4d13fSAlexei Starovoitov 1803d4d13fSAlexei Starovoitov #define O_WRONLY 00000001 1903d4d13fSAlexei Starovoitov #define O_RDWR 00000002 2003d4d13fSAlexei Starovoitov #define O_DIRECTORY 00200000 2103d4d13fSAlexei Starovoitov #define __O_TMPFILE 020000000 2203d4d13fSAlexei Starovoitov #define O_TMPFILE (__O_TMPFILE | O_DIRECTORY) 2303d4d13fSAlexei Starovoitov #define S_IFMT 00170000 2403d4d13fSAlexei Starovoitov #define S_IFSOCK 0140000 2503d4d13fSAlexei Starovoitov #define S_IFLNK 0120000 2603d4d13fSAlexei Starovoitov #define S_IFREG 0100000 2703d4d13fSAlexei Starovoitov #define S_IFBLK 0060000 2803d4d13fSAlexei Starovoitov #define S_IFDIR 0040000 2903d4d13fSAlexei Starovoitov #define S_IFCHR 0020000 3003d4d13fSAlexei Starovoitov #define S_IFIFO 0010000 3103d4d13fSAlexei Starovoitov #define S_ISUID 0004000 3203d4d13fSAlexei Starovoitov #define S_ISGID 0002000 3303d4d13fSAlexei Starovoitov #define S_ISVTX 0001000 3403d4d13fSAlexei Starovoitov #define S_ISLNK(m) (((m)&S_IFMT) == S_IFLNK) 3503d4d13fSAlexei Starovoitov #define S_ISDIR(m) (((m)&S_IFMT) == S_IFDIR) 3603d4d13fSAlexei Starovoitov #define S_ISCHR(m) (((m)&S_IFMT) == S_IFCHR) 3703d4d13fSAlexei Starovoitov #define S_ISBLK(m) (((m)&S_IFMT) == S_IFBLK) 3803d4d13fSAlexei Starovoitov #define S_ISFIFO(m) (((m)&S_IFMT) == S_IFIFO) 3903d4d13fSAlexei Starovoitov #define S_ISSOCK(m) (((m)&S_IFMT) == S_IFSOCK) 4003d4d13fSAlexei Starovoitov 4103d4d13fSAlexei Starovoitov #define KILL_DATA_ARRAY_SIZE 8 4203d4d13fSAlexei Starovoitov 4303d4d13fSAlexei Starovoitov struct var_kill_data_arr_t { 4403d4d13fSAlexei Starovoitov struct var_kill_data_t array[KILL_DATA_ARRAY_SIZE]; 4503d4d13fSAlexei Starovoitov }; 4603d4d13fSAlexei Starovoitov 4703d4d13fSAlexei Starovoitov union any_profiler_data_t { 4803d4d13fSAlexei Starovoitov struct var_exec_data_t var_exec; 4903d4d13fSAlexei Starovoitov struct var_kill_data_t var_kill; 5003d4d13fSAlexei Starovoitov struct var_sysctl_data_t var_sysctl; 5103d4d13fSAlexei Starovoitov struct var_filemod_data_t var_filemod; 5203d4d13fSAlexei Starovoitov struct var_fork_data_t var_fork; 5303d4d13fSAlexei Starovoitov struct var_kill_data_arr_t var_kill_data_arr; 5403d4d13fSAlexei Starovoitov }; 5503d4d13fSAlexei Starovoitov 5603d4d13fSAlexei Starovoitov volatile struct profiler_config_struct bpf_config = {}; 5703d4d13fSAlexei Starovoitov 5803d4d13fSAlexei Starovoitov #define FETCH_CGROUPS_FROM_BPF (bpf_config.fetch_cgroups_from_bpf) 5903d4d13fSAlexei Starovoitov #define CGROUP_FS_INODE (bpf_config.cgroup_fs_inode) 6003d4d13fSAlexei Starovoitov #define CGROUP_LOGIN_SESSION_INODE \ 6103d4d13fSAlexei Starovoitov (bpf_config.cgroup_login_session_inode) 6203d4d13fSAlexei Starovoitov #define KILL_SIGNALS (bpf_config.kill_signals_mask) 6303d4d13fSAlexei Starovoitov #define STALE_INFO (bpf_config.stale_info_secs) 6403d4d13fSAlexei Starovoitov #define INODE_FILTER (bpf_config.inode_filter) 6503d4d13fSAlexei Starovoitov #define READ_ENVIRON_FROM_EXEC (bpf_config.read_environ_from_exec) 6603d4d13fSAlexei Starovoitov #define ENABLE_CGROUP_V1_RESOLVER (bpf_config.enable_cgroup_v1_resolver) 6703d4d13fSAlexei Starovoitov 6803d4d13fSAlexei Starovoitov struct kernfs_iattrs___52 { 6903d4d13fSAlexei Starovoitov struct iattr ia_iattr; 7003d4d13fSAlexei Starovoitov }; 7103d4d13fSAlexei Starovoitov 7203d4d13fSAlexei Starovoitov struct kernfs_node___52 { 7303d4d13fSAlexei Starovoitov union /* kernfs_node_id */ { 7403d4d13fSAlexei Starovoitov struct { 7503d4d13fSAlexei Starovoitov u32 ino; 7603d4d13fSAlexei Starovoitov u32 generation; 7703d4d13fSAlexei Starovoitov }; 7803d4d13fSAlexei Starovoitov u64 id; 7903d4d13fSAlexei Starovoitov } id; 8003d4d13fSAlexei Starovoitov }; 8103d4d13fSAlexei Starovoitov 8203d4d13fSAlexei Starovoitov struct { 8303d4d13fSAlexei Starovoitov __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); 8403d4d13fSAlexei Starovoitov __uint(max_entries, 1); 8503d4d13fSAlexei Starovoitov __type(key, u32); 8603d4d13fSAlexei Starovoitov __type(value, union any_profiler_data_t); 8703d4d13fSAlexei Starovoitov } data_heap SEC(".maps"); 8803d4d13fSAlexei Starovoitov 8903d4d13fSAlexei Starovoitov struct { 9003d4d13fSAlexei Starovoitov __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY); 9103d4d13fSAlexei Starovoitov __uint(key_size, sizeof(int)); 9203d4d13fSAlexei Starovoitov __uint(value_size, sizeof(int)); 9303d4d13fSAlexei Starovoitov } events SEC(".maps"); 9403d4d13fSAlexei Starovoitov 9503d4d13fSAlexei Starovoitov struct { 9603d4d13fSAlexei Starovoitov __uint(type, BPF_MAP_TYPE_HASH); 9703d4d13fSAlexei Starovoitov __uint(max_entries, KILL_DATA_ARRAY_SIZE); 9803d4d13fSAlexei Starovoitov __type(key, u32); 9903d4d13fSAlexei Starovoitov __type(value, struct var_kill_data_arr_t); 10003d4d13fSAlexei Starovoitov } var_tpid_to_data SEC(".maps"); 10103d4d13fSAlexei Starovoitov 10203d4d13fSAlexei Starovoitov struct { 10303d4d13fSAlexei Starovoitov __uint(type, BPF_MAP_TYPE_PERCPU_ARRAY); 10403d4d13fSAlexei Starovoitov __uint(max_entries, profiler_bpf_max_function_id); 10503d4d13fSAlexei Starovoitov __type(key, u32); 10603d4d13fSAlexei Starovoitov __type(value, struct bpf_func_stats_data); 10703d4d13fSAlexei Starovoitov } bpf_func_stats SEC(".maps"); 10803d4d13fSAlexei Starovoitov 10903d4d13fSAlexei Starovoitov struct { 11003d4d13fSAlexei Starovoitov __uint(type, BPF_MAP_TYPE_HASH); 11103d4d13fSAlexei Starovoitov __type(key, u32); 11203d4d13fSAlexei Starovoitov __type(value, bool); 11303d4d13fSAlexei Starovoitov __uint(max_entries, 16); 11403d4d13fSAlexei Starovoitov } allowed_devices SEC(".maps"); 11503d4d13fSAlexei Starovoitov 11603d4d13fSAlexei Starovoitov struct { 11703d4d13fSAlexei Starovoitov __uint(type, BPF_MAP_TYPE_HASH); 11803d4d13fSAlexei Starovoitov __type(key, u64); 11903d4d13fSAlexei Starovoitov __type(value, bool); 12003d4d13fSAlexei Starovoitov __uint(max_entries, 1024); 12103d4d13fSAlexei Starovoitov } allowed_file_inodes SEC(".maps"); 12203d4d13fSAlexei Starovoitov 12303d4d13fSAlexei Starovoitov struct { 12403d4d13fSAlexei Starovoitov __uint(type, BPF_MAP_TYPE_HASH); 12503d4d13fSAlexei Starovoitov __type(key, u64); 12603d4d13fSAlexei Starovoitov __type(value, bool); 12703d4d13fSAlexei Starovoitov __uint(max_entries, 1024); 12803d4d13fSAlexei Starovoitov } allowed_directory_inodes SEC(".maps"); 12903d4d13fSAlexei Starovoitov 13003d4d13fSAlexei Starovoitov struct { 13103d4d13fSAlexei Starovoitov __uint(type, BPF_MAP_TYPE_HASH); 13203d4d13fSAlexei Starovoitov __type(key, u32); 13303d4d13fSAlexei Starovoitov __type(value, bool); 13403d4d13fSAlexei Starovoitov __uint(max_entries, 16); 13503d4d13fSAlexei Starovoitov } disallowed_exec_inodes SEC(".maps"); 13603d4d13fSAlexei Starovoitov 13703d4d13fSAlexei Starovoitov static INLINE bool IS_ERR(const void* ptr) 13803d4d13fSAlexei Starovoitov { 13903d4d13fSAlexei Starovoitov return IS_ERR_VALUE((unsigned long)ptr); 14003d4d13fSAlexei Starovoitov } 14103d4d13fSAlexei Starovoitov 14203d4d13fSAlexei Starovoitov static INLINE u32 get_userspace_pid() 14303d4d13fSAlexei Starovoitov { 14403d4d13fSAlexei Starovoitov return bpf_get_current_pid_tgid() >> 32; 14503d4d13fSAlexei Starovoitov } 14603d4d13fSAlexei Starovoitov 14703d4d13fSAlexei Starovoitov static INLINE bool is_init_process(u32 tgid) 14803d4d13fSAlexei Starovoitov { 14903d4d13fSAlexei Starovoitov return tgid == 1 || tgid == 0; 15003d4d13fSAlexei Starovoitov } 15103d4d13fSAlexei Starovoitov 15203d4d13fSAlexei Starovoitov static INLINE unsigned long 15303d4d13fSAlexei Starovoitov probe_read_lim(void* dst, void* src, unsigned long len, unsigned long max) 15403d4d13fSAlexei Starovoitov { 15503d4d13fSAlexei Starovoitov len = len < max ? len : max; 15603d4d13fSAlexei Starovoitov if (len > 1) { 1571b5e3853SIlya Leoshkevich if (bpf_probe_read_kernel(dst, len, src)) 15803d4d13fSAlexei Starovoitov return 0; 15903d4d13fSAlexei Starovoitov } else if (len == 1) { 1601b5e3853SIlya Leoshkevich if (bpf_probe_read_kernel(dst, 1, src)) 16103d4d13fSAlexei Starovoitov return 0; 16203d4d13fSAlexei Starovoitov } 16303d4d13fSAlexei Starovoitov return len; 16403d4d13fSAlexei Starovoitov } 16503d4d13fSAlexei Starovoitov 16603d4d13fSAlexei Starovoitov static INLINE int get_var_spid_index(struct var_kill_data_arr_t* arr_struct, 16703d4d13fSAlexei Starovoitov int spid) 16803d4d13fSAlexei Starovoitov { 16903d4d13fSAlexei Starovoitov #ifdef UNROLL 17052dbd67dSJose E. Marchesi __pragma_loop_unroll 17103d4d13fSAlexei Starovoitov #endif 17203d4d13fSAlexei Starovoitov for (int i = 0; i < ARRAY_SIZE(arr_struct->array); i++) 17303d4d13fSAlexei Starovoitov if (arr_struct->array[i].meta.pid == spid) 17403d4d13fSAlexei Starovoitov return i; 17503d4d13fSAlexei Starovoitov return -1; 17603d4d13fSAlexei Starovoitov } 17703d4d13fSAlexei Starovoitov 17803d4d13fSAlexei Starovoitov static INLINE void populate_ancestors(struct task_struct* task, 17903d4d13fSAlexei Starovoitov struct ancestors_data_t* ancestors_data) 18003d4d13fSAlexei Starovoitov { 18103d4d13fSAlexei Starovoitov struct task_struct* parent = task; 18203d4d13fSAlexei Starovoitov u32 num_ancestors, ppid; 18303d4d13fSAlexei Starovoitov 18403d4d13fSAlexei Starovoitov ancestors_data->num_ancestors = 0; 18503d4d13fSAlexei Starovoitov #ifdef UNROLL 18652dbd67dSJose E. Marchesi __pragma_loop_unroll 18703d4d13fSAlexei Starovoitov #endif 18803d4d13fSAlexei Starovoitov for (num_ancestors = 0; num_ancestors < MAX_ANCESTORS; num_ancestors++) { 18903d4d13fSAlexei Starovoitov parent = BPF_CORE_READ(parent, real_parent); 19003d4d13fSAlexei Starovoitov if (parent == NULL) 19103d4d13fSAlexei Starovoitov break; 19203d4d13fSAlexei Starovoitov ppid = BPF_CORE_READ(parent, tgid); 19303d4d13fSAlexei Starovoitov if (is_init_process(ppid)) 19403d4d13fSAlexei Starovoitov break; 19503d4d13fSAlexei Starovoitov ancestors_data->ancestor_pids[num_ancestors] = ppid; 19603d4d13fSAlexei Starovoitov ancestors_data->ancestor_exec_ids[num_ancestors] = 19703d4d13fSAlexei Starovoitov BPF_CORE_READ(parent, self_exec_id); 19803d4d13fSAlexei Starovoitov ancestors_data->ancestor_start_times[num_ancestors] = 19903d4d13fSAlexei Starovoitov BPF_CORE_READ(parent, start_time); 20003d4d13fSAlexei Starovoitov ancestors_data->num_ancestors = num_ancestors; 20103d4d13fSAlexei Starovoitov } 20203d4d13fSAlexei Starovoitov } 20303d4d13fSAlexei Starovoitov 20403d4d13fSAlexei Starovoitov static INLINE void* read_full_cgroup_path(struct kernfs_node* cgroup_node, 20503d4d13fSAlexei Starovoitov struct kernfs_node* cgroup_root_node, 20603d4d13fSAlexei Starovoitov void* payload, 20703d4d13fSAlexei Starovoitov int* root_pos) 20803d4d13fSAlexei Starovoitov { 20903d4d13fSAlexei Starovoitov void* payload_start = payload; 21003d4d13fSAlexei Starovoitov size_t filepart_length; 21103d4d13fSAlexei Starovoitov 21203d4d13fSAlexei Starovoitov #ifdef UNROLL 21352dbd67dSJose E. Marchesi __pragma_loop_unroll 21403d4d13fSAlexei Starovoitov #endif 21503d4d13fSAlexei Starovoitov for (int i = 0; i < MAX_CGROUPS_PATH_DEPTH; i++) { 21603d4d13fSAlexei Starovoitov filepart_length = 2171b5e3853SIlya Leoshkevich bpf_probe_read_kernel_str(payload, MAX_PATH, 2181b5e3853SIlya Leoshkevich BPF_CORE_READ(cgroup_node, name)); 21903d4d13fSAlexei Starovoitov if (!cgroup_node) 22003d4d13fSAlexei Starovoitov return payload; 22103d4d13fSAlexei Starovoitov if (cgroup_node == cgroup_root_node) 22203d4d13fSAlexei Starovoitov *root_pos = payload - payload_start; 2237e3811cbSAlexei Starovoitov if (bpf_cmp_likely(filepart_length, <=, MAX_PATH)) { 22403d4d13fSAlexei Starovoitov payload += filepart_length; 22503d4d13fSAlexei Starovoitov } 22603d4d13fSAlexei Starovoitov cgroup_node = BPF_CORE_READ(cgroup_node, parent); 22703d4d13fSAlexei Starovoitov } 22803d4d13fSAlexei Starovoitov return payload; 22903d4d13fSAlexei Starovoitov } 23003d4d13fSAlexei Starovoitov 23103d4d13fSAlexei Starovoitov static ino_t get_inode_from_kernfs(struct kernfs_node* node) 23203d4d13fSAlexei Starovoitov { 23303d4d13fSAlexei Starovoitov struct kernfs_node___52* node52 = (void*)node; 23403d4d13fSAlexei Starovoitov 23503d4d13fSAlexei Starovoitov if (bpf_core_field_exists(node52->id.ino)) { 23603d4d13fSAlexei Starovoitov barrier_var(node52); 23703d4d13fSAlexei Starovoitov return BPF_CORE_READ(node52, id.ino); 23803d4d13fSAlexei Starovoitov } else { 23903d4d13fSAlexei Starovoitov barrier_var(node); 24003d4d13fSAlexei Starovoitov return (u64)BPF_CORE_READ(node, id); 24103d4d13fSAlexei Starovoitov } 24203d4d13fSAlexei Starovoitov } 24303d4d13fSAlexei Starovoitov 24447254777SAndrii Nakryiko extern bool CONFIG_CGROUP_PIDS __kconfig __weak; 24547254777SAndrii Nakryiko enum cgroup_subsys_id___local { 24647254777SAndrii Nakryiko pids_cgrp_id___local = 123, /* value doesn't matter */ 24747254777SAndrii Nakryiko }; 24803d4d13fSAlexei Starovoitov 24903d4d13fSAlexei Starovoitov static INLINE void* populate_cgroup_info(struct cgroup_data_t* cgroup_data, 25003d4d13fSAlexei Starovoitov struct task_struct* task, 25103d4d13fSAlexei Starovoitov void* payload) 25203d4d13fSAlexei Starovoitov { 25303d4d13fSAlexei Starovoitov struct kernfs_node* root_kernfs = 25403d4d13fSAlexei Starovoitov BPF_CORE_READ(task, nsproxy, cgroup_ns, root_cset, dfl_cgrp, kn); 25503d4d13fSAlexei Starovoitov struct kernfs_node* proc_kernfs = BPF_CORE_READ(task, cgroups, dfl_cgrp, kn); 25603d4d13fSAlexei Starovoitov 257fb355812SAndrei Matei #if __has_builtin(__builtin_preserve_enum_value) 25847254777SAndrii Nakryiko if (ENABLE_CGROUP_V1_RESOLVER && CONFIG_CGROUP_PIDS) { 25947254777SAndrii Nakryiko int cgrp_id = bpf_core_enum_value(enum cgroup_subsys_id___local, 26047254777SAndrii Nakryiko pids_cgrp_id___local); 26103d4d13fSAlexei Starovoitov #ifdef UNROLL 26252dbd67dSJose E. Marchesi __pragma_loop_unroll 26303d4d13fSAlexei Starovoitov #endif 26403d4d13fSAlexei Starovoitov for (int i = 0; i < CGROUP_SUBSYS_COUNT; i++) { 26503d4d13fSAlexei Starovoitov struct cgroup_subsys_state* subsys = 26603d4d13fSAlexei Starovoitov BPF_CORE_READ(task, cgroups, subsys[i]); 26703d4d13fSAlexei Starovoitov if (subsys != NULL) { 26803d4d13fSAlexei Starovoitov int subsys_id = BPF_CORE_READ(subsys, ss, id); 26947254777SAndrii Nakryiko if (subsys_id == cgrp_id) { 27003d4d13fSAlexei Starovoitov proc_kernfs = BPF_CORE_READ(subsys, cgroup, kn); 27103d4d13fSAlexei Starovoitov root_kernfs = BPF_CORE_READ(subsys, ss, root, kf_root, kn); 27203d4d13fSAlexei Starovoitov break; 27303d4d13fSAlexei Starovoitov } 27403d4d13fSAlexei Starovoitov } 27503d4d13fSAlexei Starovoitov } 27603d4d13fSAlexei Starovoitov } 277fb355812SAndrei Matei #endif 27803d4d13fSAlexei Starovoitov 27903d4d13fSAlexei Starovoitov cgroup_data->cgroup_root_inode = get_inode_from_kernfs(root_kernfs); 28003d4d13fSAlexei Starovoitov cgroup_data->cgroup_proc_inode = get_inode_from_kernfs(proc_kernfs); 28103d4d13fSAlexei Starovoitov 28203d4d13fSAlexei Starovoitov if (bpf_core_field_exists(root_kernfs->iattr->ia_mtime)) { 28303d4d13fSAlexei Starovoitov cgroup_data->cgroup_root_mtime = 28403d4d13fSAlexei Starovoitov BPF_CORE_READ(root_kernfs, iattr, ia_mtime.tv_nsec); 28503d4d13fSAlexei Starovoitov cgroup_data->cgroup_proc_mtime = 28603d4d13fSAlexei Starovoitov BPF_CORE_READ(proc_kernfs, iattr, ia_mtime.tv_nsec); 28703d4d13fSAlexei Starovoitov } else { 28803d4d13fSAlexei Starovoitov struct kernfs_iattrs___52* root_iattr = 28903d4d13fSAlexei Starovoitov (struct kernfs_iattrs___52*)BPF_CORE_READ(root_kernfs, iattr); 29003d4d13fSAlexei Starovoitov cgroup_data->cgroup_root_mtime = 29103d4d13fSAlexei Starovoitov BPF_CORE_READ(root_iattr, ia_iattr.ia_mtime.tv_nsec); 29203d4d13fSAlexei Starovoitov 29303d4d13fSAlexei Starovoitov struct kernfs_iattrs___52* proc_iattr = 29403d4d13fSAlexei Starovoitov (struct kernfs_iattrs___52*)BPF_CORE_READ(proc_kernfs, iattr); 29503d4d13fSAlexei Starovoitov cgroup_data->cgroup_proc_mtime = 29603d4d13fSAlexei Starovoitov BPF_CORE_READ(proc_iattr, ia_iattr.ia_mtime.tv_nsec); 29703d4d13fSAlexei Starovoitov } 29803d4d13fSAlexei Starovoitov 29903d4d13fSAlexei Starovoitov cgroup_data->cgroup_root_length = 0; 30003d4d13fSAlexei Starovoitov cgroup_data->cgroup_proc_length = 0; 30103d4d13fSAlexei Starovoitov cgroup_data->cgroup_full_length = 0; 30203d4d13fSAlexei Starovoitov 30303d4d13fSAlexei Starovoitov size_t cgroup_root_length = 3041b5e3853SIlya Leoshkevich bpf_probe_read_kernel_str(payload, MAX_PATH, 3051b5e3853SIlya Leoshkevich BPF_CORE_READ(root_kernfs, name)); 3067e3811cbSAlexei Starovoitov if (bpf_cmp_likely(cgroup_root_length, <=, MAX_PATH)) { 30703d4d13fSAlexei Starovoitov cgroup_data->cgroup_root_length = cgroup_root_length; 30803d4d13fSAlexei Starovoitov payload += cgroup_root_length; 30903d4d13fSAlexei Starovoitov } 31003d4d13fSAlexei Starovoitov 31103d4d13fSAlexei Starovoitov size_t cgroup_proc_length = 3121b5e3853SIlya Leoshkevich bpf_probe_read_kernel_str(payload, MAX_PATH, 3131b5e3853SIlya Leoshkevich BPF_CORE_READ(proc_kernfs, name)); 3147e3811cbSAlexei Starovoitov if (bpf_cmp_likely(cgroup_proc_length, <=, MAX_PATH)) { 31503d4d13fSAlexei Starovoitov cgroup_data->cgroup_proc_length = cgroup_proc_length; 31603d4d13fSAlexei Starovoitov payload += cgroup_proc_length; 31703d4d13fSAlexei Starovoitov } 31803d4d13fSAlexei Starovoitov 31903d4d13fSAlexei Starovoitov if (FETCH_CGROUPS_FROM_BPF) { 32003d4d13fSAlexei Starovoitov cgroup_data->cgroup_full_path_root_pos = -1; 32103d4d13fSAlexei Starovoitov void* payload_end_pos = read_full_cgroup_path(proc_kernfs, root_kernfs, payload, 32203d4d13fSAlexei Starovoitov &cgroup_data->cgroup_full_path_root_pos); 32303d4d13fSAlexei Starovoitov cgroup_data->cgroup_full_length = payload_end_pos - payload; 32403d4d13fSAlexei Starovoitov payload = payload_end_pos; 32503d4d13fSAlexei Starovoitov } 32603d4d13fSAlexei Starovoitov 32703d4d13fSAlexei Starovoitov return (void*)payload; 32803d4d13fSAlexei Starovoitov } 32903d4d13fSAlexei Starovoitov 33003d4d13fSAlexei Starovoitov static INLINE void* populate_var_metadata(struct var_metadata_t* metadata, 33103d4d13fSAlexei Starovoitov struct task_struct* task, 33203d4d13fSAlexei Starovoitov u32 pid, void* payload) 33303d4d13fSAlexei Starovoitov { 33403d4d13fSAlexei Starovoitov u64 uid_gid = bpf_get_current_uid_gid(); 33503d4d13fSAlexei Starovoitov 33603d4d13fSAlexei Starovoitov metadata->uid = (u32)uid_gid; 33703d4d13fSAlexei Starovoitov metadata->gid = uid_gid >> 32; 33803d4d13fSAlexei Starovoitov metadata->pid = pid; 33903d4d13fSAlexei Starovoitov metadata->exec_id = BPF_CORE_READ(task, self_exec_id); 34003d4d13fSAlexei Starovoitov metadata->start_time = BPF_CORE_READ(task, start_time); 34103d4d13fSAlexei Starovoitov metadata->comm_length = 0; 34203d4d13fSAlexei Starovoitov 34303d4d13fSAlexei Starovoitov size_t comm_length = bpf_core_read_str(payload, TASK_COMM_LEN, &task->comm); 3447e3811cbSAlexei Starovoitov if (bpf_cmp_likely(comm_length, <=, TASK_COMM_LEN)) { 34503d4d13fSAlexei Starovoitov metadata->comm_length = comm_length; 34603d4d13fSAlexei Starovoitov payload += comm_length; 34703d4d13fSAlexei Starovoitov } 34803d4d13fSAlexei Starovoitov 34903d4d13fSAlexei Starovoitov return (void*)payload; 35003d4d13fSAlexei Starovoitov } 35103d4d13fSAlexei Starovoitov 35203d4d13fSAlexei Starovoitov static INLINE struct var_kill_data_t* 35303d4d13fSAlexei Starovoitov get_var_kill_data(struct pt_regs* ctx, int spid, int tpid, int sig) 35403d4d13fSAlexei Starovoitov { 35503d4d13fSAlexei Starovoitov int zero = 0; 35603d4d13fSAlexei Starovoitov struct var_kill_data_t* kill_data = bpf_map_lookup_elem(&data_heap, &zero); 35703d4d13fSAlexei Starovoitov 35803d4d13fSAlexei Starovoitov if (kill_data == NULL) 35903d4d13fSAlexei Starovoitov return NULL; 36003d4d13fSAlexei Starovoitov struct task_struct* task = (struct task_struct*)bpf_get_current_task(); 36103d4d13fSAlexei Starovoitov 36203d4d13fSAlexei Starovoitov void* payload = populate_var_metadata(&kill_data->meta, task, spid, kill_data->payload); 36303d4d13fSAlexei Starovoitov payload = populate_cgroup_info(&kill_data->cgroup_data, task, payload); 36403d4d13fSAlexei Starovoitov size_t payload_length = payload - (void*)kill_data->payload; 36503d4d13fSAlexei Starovoitov kill_data->payload_length = payload_length; 36603d4d13fSAlexei Starovoitov populate_ancestors(task, &kill_data->ancestors_info); 36703d4d13fSAlexei Starovoitov kill_data->meta.type = KILL_EVENT; 36803d4d13fSAlexei Starovoitov kill_data->kill_target_pid = tpid; 36903d4d13fSAlexei Starovoitov kill_data->kill_sig = sig; 37003d4d13fSAlexei Starovoitov kill_data->kill_count = 1; 37103d4d13fSAlexei Starovoitov kill_data->last_kill_time = bpf_ktime_get_ns(); 37203d4d13fSAlexei Starovoitov return kill_data; 37303d4d13fSAlexei Starovoitov } 37403d4d13fSAlexei Starovoitov 37503d4d13fSAlexei Starovoitov static INLINE int trace_var_sys_kill(void* ctx, int tpid, int sig) 37603d4d13fSAlexei Starovoitov { 37703d4d13fSAlexei Starovoitov if ((KILL_SIGNALS & (1ULL << sig)) == 0) 37803d4d13fSAlexei Starovoitov return 0; 37903d4d13fSAlexei Starovoitov 38003d4d13fSAlexei Starovoitov u32 spid = get_userspace_pid(); 38103d4d13fSAlexei Starovoitov struct var_kill_data_arr_t* arr_struct = bpf_map_lookup_elem(&var_tpid_to_data, &tpid); 38203d4d13fSAlexei Starovoitov 38303d4d13fSAlexei Starovoitov if (arr_struct == NULL) { 38403d4d13fSAlexei Starovoitov struct var_kill_data_t* kill_data = get_var_kill_data(ctx, spid, tpid, sig); 38503d4d13fSAlexei Starovoitov int zero = 0; 38603d4d13fSAlexei Starovoitov 38703d4d13fSAlexei Starovoitov if (kill_data == NULL) 38803d4d13fSAlexei Starovoitov return 0; 38903d4d13fSAlexei Starovoitov arr_struct = bpf_map_lookup_elem(&data_heap, &zero); 39003d4d13fSAlexei Starovoitov if (arr_struct == NULL) 39103d4d13fSAlexei Starovoitov return 0; 3921b5e3853SIlya Leoshkevich bpf_probe_read_kernel(&arr_struct->array[0], 3931b5e3853SIlya Leoshkevich sizeof(arr_struct->array[0]), kill_data); 39403d4d13fSAlexei Starovoitov } else { 39503d4d13fSAlexei Starovoitov int index = get_var_spid_index(arr_struct, spid); 39603d4d13fSAlexei Starovoitov 39703d4d13fSAlexei Starovoitov if (index == -1) { 39803d4d13fSAlexei Starovoitov struct var_kill_data_t* kill_data = 39903d4d13fSAlexei Starovoitov get_var_kill_data(ctx, spid, tpid, sig); 40003d4d13fSAlexei Starovoitov if (kill_data == NULL) 40103d4d13fSAlexei Starovoitov return 0; 40203d4d13fSAlexei Starovoitov #ifdef UNROLL 40352dbd67dSJose E. Marchesi __pragma_loop_unroll 40403d4d13fSAlexei Starovoitov #endif 40503d4d13fSAlexei Starovoitov for (int i = 0; i < ARRAY_SIZE(arr_struct->array); i++) 40603d4d13fSAlexei Starovoitov if (arr_struct->array[i].meta.pid == 0) { 4071b5e3853SIlya Leoshkevich bpf_probe_read_kernel(&arr_struct->array[i], 4081b5e3853SIlya Leoshkevich sizeof(arr_struct->array[i]), 4091b5e3853SIlya Leoshkevich kill_data); 41003d4d13fSAlexei Starovoitov bpf_map_update_elem(&var_tpid_to_data, &tpid, 41103d4d13fSAlexei Starovoitov arr_struct, 0); 41203d4d13fSAlexei Starovoitov 41303d4d13fSAlexei Starovoitov return 0; 41403d4d13fSAlexei Starovoitov } 41503d4d13fSAlexei Starovoitov return 0; 41603d4d13fSAlexei Starovoitov } 41703d4d13fSAlexei Starovoitov 41803d4d13fSAlexei Starovoitov struct var_kill_data_t* kill_data = &arr_struct->array[index]; 41903d4d13fSAlexei Starovoitov 42003d4d13fSAlexei Starovoitov u64 delta_sec = 42103d4d13fSAlexei Starovoitov (bpf_ktime_get_ns() - kill_data->last_kill_time) / 1000000000; 42203d4d13fSAlexei Starovoitov 42303d4d13fSAlexei Starovoitov if (delta_sec < STALE_INFO) { 42403d4d13fSAlexei Starovoitov kill_data->kill_count++; 42503d4d13fSAlexei Starovoitov kill_data->last_kill_time = bpf_ktime_get_ns(); 4261b5e3853SIlya Leoshkevich bpf_probe_read_kernel(&arr_struct->array[index], 42703d4d13fSAlexei Starovoitov sizeof(arr_struct->array[index]), 42803d4d13fSAlexei Starovoitov kill_data); 42903d4d13fSAlexei Starovoitov } else { 43003d4d13fSAlexei Starovoitov struct var_kill_data_t* kill_data = 43103d4d13fSAlexei Starovoitov get_var_kill_data(ctx, spid, tpid, sig); 43203d4d13fSAlexei Starovoitov if (kill_data == NULL) 43303d4d13fSAlexei Starovoitov return 0; 4341b5e3853SIlya Leoshkevich bpf_probe_read_kernel(&arr_struct->array[index], 43503d4d13fSAlexei Starovoitov sizeof(arr_struct->array[index]), 43603d4d13fSAlexei Starovoitov kill_data); 43703d4d13fSAlexei Starovoitov } 43803d4d13fSAlexei Starovoitov } 43903d4d13fSAlexei Starovoitov bpf_map_update_elem(&var_tpid_to_data, &tpid, arr_struct, 0); 44003d4d13fSAlexei Starovoitov return 0; 44103d4d13fSAlexei Starovoitov } 44203d4d13fSAlexei Starovoitov 44303d4d13fSAlexei Starovoitov static INLINE void bpf_stats_enter(struct bpf_func_stats_ctx* bpf_stat_ctx, 44403d4d13fSAlexei Starovoitov enum bpf_function_id func_id) 44503d4d13fSAlexei Starovoitov { 44603d4d13fSAlexei Starovoitov int func_id_key = func_id; 44703d4d13fSAlexei Starovoitov 44803d4d13fSAlexei Starovoitov bpf_stat_ctx->start_time_ns = bpf_ktime_get_ns(); 44903d4d13fSAlexei Starovoitov bpf_stat_ctx->bpf_func_stats_data_val = 45003d4d13fSAlexei Starovoitov bpf_map_lookup_elem(&bpf_func_stats, &func_id_key); 45103d4d13fSAlexei Starovoitov if (bpf_stat_ctx->bpf_func_stats_data_val) 45203d4d13fSAlexei Starovoitov bpf_stat_ctx->bpf_func_stats_data_val->num_executions++; 45303d4d13fSAlexei Starovoitov } 45403d4d13fSAlexei Starovoitov 45503d4d13fSAlexei Starovoitov static INLINE void bpf_stats_exit(struct bpf_func_stats_ctx* bpf_stat_ctx) 45603d4d13fSAlexei Starovoitov { 45703d4d13fSAlexei Starovoitov if (bpf_stat_ctx->bpf_func_stats_data_val) 45803d4d13fSAlexei Starovoitov bpf_stat_ctx->bpf_func_stats_data_val->time_elapsed_ns += 45903d4d13fSAlexei Starovoitov bpf_ktime_get_ns() - bpf_stat_ctx->start_time_ns; 46003d4d13fSAlexei Starovoitov } 46103d4d13fSAlexei Starovoitov 46203d4d13fSAlexei Starovoitov static INLINE void 46303d4d13fSAlexei Starovoitov bpf_stats_pre_submit_var_perf_event(struct bpf_func_stats_ctx* bpf_stat_ctx, 46403d4d13fSAlexei Starovoitov struct var_metadata_t* meta) 46503d4d13fSAlexei Starovoitov { 46603d4d13fSAlexei Starovoitov if (bpf_stat_ctx->bpf_func_stats_data_val) { 46703d4d13fSAlexei Starovoitov bpf_stat_ctx->bpf_func_stats_data_val->num_perf_events++; 46803d4d13fSAlexei Starovoitov meta->bpf_stats_num_perf_events = 46903d4d13fSAlexei Starovoitov bpf_stat_ctx->bpf_func_stats_data_val->num_perf_events; 47003d4d13fSAlexei Starovoitov } 47103d4d13fSAlexei Starovoitov meta->bpf_stats_start_ktime_ns = bpf_stat_ctx->start_time_ns; 47203d4d13fSAlexei Starovoitov meta->cpu_id = bpf_get_smp_processor_id(); 47303d4d13fSAlexei Starovoitov } 47403d4d13fSAlexei Starovoitov 47503d4d13fSAlexei Starovoitov static INLINE size_t 47603d4d13fSAlexei Starovoitov read_absolute_file_path_from_dentry(struct dentry* filp_dentry, void* payload) 47703d4d13fSAlexei Starovoitov { 47803d4d13fSAlexei Starovoitov size_t length = 0; 47903d4d13fSAlexei Starovoitov size_t filepart_length; 48003d4d13fSAlexei Starovoitov struct dentry* parent_dentry; 48103d4d13fSAlexei Starovoitov 48203d4d13fSAlexei Starovoitov #ifdef UNROLL 48352dbd67dSJose E. Marchesi __pragma_loop_unroll 48403d4d13fSAlexei Starovoitov #endif 48503d4d13fSAlexei Starovoitov for (int i = 0; i < MAX_PATH_DEPTH; i++) { 4861b5e3853SIlya Leoshkevich filepart_length = 4871b5e3853SIlya Leoshkevich bpf_probe_read_kernel_str(payload, MAX_PATH, 48803d4d13fSAlexei Starovoitov BPF_CORE_READ(filp_dentry, d_name.name)); 4897e3811cbSAlexei Starovoitov bpf_nop_mov(filepart_length); 4907e3811cbSAlexei Starovoitov if (bpf_cmp_unlikely(filepart_length, >, MAX_PATH)) 49103d4d13fSAlexei Starovoitov break; 49203d4d13fSAlexei Starovoitov payload += filepart_length; 49303d4d13fSAlexei Starovoitov length += filepart_length; 49403d4d13fSAlexei Starovoitov 49503d4d13fSAlexei Starovoitov parent_dentry = BPF_CORE_READ(filp_dentry, d_parent); 49603d4d13fSAlexei Starovoitov if (filp_dentry == parent_dentry) 49703d4d13fSAlexei Starovoitov break; 49803d4d13fSAlexei Starovoitov filp_dentry = parent_dentry; 49903d4d13fSAlexei Starovoitov } 50003d4d13fSAlexei Starovoitov 50103d4d13fSAlexei Starovoitov return length; 50203d4d13fSAlexei Starovoitov } 50303d4d13fSAlexei Starovoitov 50403d4d13fSAlexei Starovoitov static INLINE bool 50503d4d13fSAlexei Starovoitov is_ancestor_in_allowed_inodes(struct dentry* filp_dentry) 50603d4d13fSAlexei Starovoitov { 50703d4d13fSAlexei Starovoitov struct dentry* parent_dentry; 50803d4d13fSAlexei Starovoitov #ifdef UNROLL 50952dbd67dSJose E. Marchesi __pragma_loop_unroll 51003d4d13fSAlexei Starovoitov #endif 51103d4d13fSAlexei Starovoitov for (int i = 0; i < MAX_PATH_DEPTH; i++) { 51203d4d13fSAlexei Starovoitov u64 dir_ino = BPF_CORE_READ(filp_dentry, d_inode, i_ino); 51303d4d13fSAlexei Starovoitov bool* allowed_dir = bpf_map_lookup_elem(&allowed_directory_inodes, &dir_ino); 51403d4d13fSAlexei Starovoitov 51503d4d13fSAlexei Starovoitov if (allowed_dir != NULL) 51603d4d13fSAlexei Starovoitov return true; 51703d4d13fSAlexei Starovoitov parent_dentry = BPF_CORE_READ(filp_dentry, d_parent); 51803d4d13fSAlexei Starovoitov if (filp_dentry == parent_dentry) 51903d4d13fSAlexei Starovoitov break; 52003d4d13fSAlexei Starovoitov filp_dentry = parent_dentry; 52103d4d13fSAlexei Starovoitov } 52203d4d13fSAlexei Starovoitov return false; 52303d4d13fSAlexei Starovoitov } 52403d4d13fSAlexei Starovoitov 52503d4d13fSAlexei Starovoitov static INLINE bool is_dentry_allowed_for_filemod(struct dentry* file_dentry, 52603d4d13fSAlexei Starovoitov u32* device_id, 52703d4d13fSAlexei Starovoitov u64* file_ino) 52803d4d13fSAlexei Starovoitov { 52903d4d13fSAlexei Starovoitov u32 dev_id = BPF_CORE_READ(file_dentry, d_sb, s_dev); 53003d4d13fSAlexei Starovoitov *device_id = dev_id; 53103d4d13fSAlexei Starovoitov bool* allowed_device = bpf_map_lookup_elem(&allowed_devices, &dev_id); 53203d4d13fSAlexei Starovoitov 53303d4d13fSAlexei Starovoitov if (allowed_device == NULL) 53403d4d13fSAlexei Starovoitov return false; 53503d4d13fSAlexei Starovoitov 53603d4d13fSAlexei Starovoitov u64 ino = BPF_CORE_READ(file_dentry, d_inode, i_ino); 53703d4d13fSAlexei Starovoitov *file_ino = ino; 53803d4d13fSAlexei Starovoitov bool* allowed_file = bpf_map_lookup_elem(&allowed_file_inodes, &ino); 53903d4d13fSAlexei Starovoitov 54003d4d13fSAlexei Starovoitov if (allowed_file == NULL) 54103d4d13fSAlexei Starovoitov if (!is_ancestor_in_allowed_inodes(BPF_CORE_READ(file_dentry, d_parent))) 54203d4d13fSAlexei Starovoitov return false; 54303d4d13fSAlexei Starovoitov return true; 54403d4d13fSAlexei Starovoitov } 54503d4d13fSAlexei Starovoitov 54603d4d13fSAlexei Starovoitov SEC("kprobe/proc_sys_write") 54703d4d13fSAlexei Starovoitov ssize_t BPF_KPROBE(kprobe__proc_sys_write, 54803d4d13fSAlexei Starovoitov struct file* filp, const char* buf, 54903d4d13fSAlexei Starovoitov size_t count, loff_t* ppos) 55003d4d13fSAlexei Starovoitov { 55103d4d13fSAlexei Starovoitov struct bpf_func_stats_ctx stats_ctx; 55203d4d13fSAlexei Starovoitov bpf_stats_enter(&stats_ctx, profiler_bpf_proc_sys_write); 55303d4d13fSAlexei Starovoitov 55403d4d13fSAlexei Starovoitov u32 pid = get_userspace_pid(); 55503d4d13fSAlexei Starovoitov int zero = 0; 55603d4d13fSAlexei Starovoitov struct var_sysctl_data_t* sysctl_data = 55703d4d13fSAlexei Starovoitov bpf_map_lookup_elem(&data_heap, &zero); 55803d4d13fSAlexei Starovoitov if (!sysctl_data) 55903d4d13fSAlexei Starovoitov goto out; 56003d4d13fSAlexei Starovoitov 56103d4d13fSAlexei Starovoitov struct task_struct* task = (struct task_struct*)bpf_get_current_task(); 56203d4d13fSAlexei Starovoitov sysctl_data->meta.type = SYSCTL_EVENT; 56303d4d13fSAlexei Starovoitov void* payload = populate_var_metadata(&sysctl_data->meta, task, pid, sysctl_data->payload); 56403d4d13fSAlexei Starovoitov payload = populate_cgroup_info(&sysctl_data->cgroup_data, task, payload); 56503d4d13fSAlexei Starovoitov 56603d4d13fSAlexei Starovoitov populate_ancestors(task, &sysctl_data->ancestors_info); 56703d4d13fSAlexei Starovoitov 56803d4d13fSAlexei Starovoitov sysctl_data->sysctl_val_length = 0; 56903d4d13fSAlexei Starovoitov sysctl_data->sysctl_path_length = 0; 57003d4d13fSAlexei Starovoitov 5711b5e3853SIlya Leoshkevich size_t sysctl_val_length = bpf_probe_read_kernel_str(payload, 5721b5e3853SIlya Leoshkevich CTL_MAXNAME, buf); 5737e3811cbSAlexei Starovoitov if (bpf_cmp_likely(sysctl_val_length, <=, CTL_MAXNAME)) { 57403d4d13fSAlexei Starovoitov sysctl_data->sysctl_val_length = sysctl_val_length; 57503d4d13fSAlexei Starovoitov payload += sysctl_val_length; 57603d4d13fSAlexei Starovoitov } 57703d4d13fSAlexei Starovoitov 5781b5e3853SIlya Leoshkevich size_t sysctl_path_length = 5791b5e3853SIlya Leoshkevich bpf_probe_read_kernel_str(payload, MAX_PATH, 5801b5e3853SIlya Leoshkevich BPF_CORE_READ(filp, f_path.dentry, 5811b5e3853SIlya Leoshkevich d_name.name)); 5827e3811cbSAlexei Starovoitov if (bpf_cmp_likely(sysctl_path_length, <=, MAX_PATH)) { 58303d4d13fSAlexei Starovoitov sysctl_data->sysctl_path_length = sysctl_path_length; 58403d4d13fSAlexei Starovoitov payload += sysctl_path_length; 58503d4d13fSAlexei Starovoitov } 58603d4d13fSAlexei Starovoitov 58703d4d13fSAlexei Starovoitov bpf_stats_pre_submit_var_perf_event(&stats_ctx, &sysctl_data->meta); 58803d4d13fSAlexei Starovoitov unsigned long data_len = payload - (void*)sysctl_data; 58903d4d13fSAlexei Starovoitov data_len = data_len > sizeof(struct var_sysctl_data_t) 59003d4d13fSAlexei Starovoitov ? sizeof(struct var_sysctl_data_t) 59103d4d13fSAlexei Starovoitov : data_len; 59203d4d13fSAlexei Starovoitov bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, sysctl_data, data_len); 59303d4d13fSAlexei Starovoitov out: 59403d4d13fSAlexei Starovoitov bpf_stats_exit(&stats_ctx); 59503d4d13fSAlexei Starovoitov return 0; 59603d4d13fSAlexei Starovoitov } 59703d4d13fSAlexei Starovoitov 59803d4d13fSAlexei Starovoitov SEC("tracepoint/syscalls/sys_enter_kill") 599ba8ea723SArtem Savkov int tracepoint__syscalls__sys_enter_kill(struct syscall_trace_enter* ctx) 60003d4d13fSAlexei Starovoitov { 60103d4d13fSAlexei Starovoitov struct bpf_func_stats_ctx stats_ctx; 60203d4d13fSAlexei Starovoitov 60303d4d13fSAlexei Starovoitov bpf_stats_enter(&stats_ctx, profiler_bpf_sys_enter_kill); 60403d4d13fSAlexei Starovoitov int pid = ctx->args[0]; 60503d4d13fSAlexei Starovoitov int sig = ctx->args[1]; 60603d4d13fSAlexei Starovoitov int ret = trace_var_sys_kill(ctx, pid, sig); 60703d4d13fSAlexei Starovoitov bpf_stats_exit(&stats_ctx); 60803d4d13fSAlexei Starovoitov return ret; 60903d4d13fSAlexei Starovoitov }; 61003d4d13fSAlexei Starovoitov 61103d4d13fSAlexei Starovoitov SEC("raw_tracepoint/sched_process_exit") 61203d4d13fSAlexei Starovoitov int raw_tracepoint__sched_process_exit(void* ctx) 61303d4d13fSAlexei Starovoitov { 61403d4d13fSAlexei Starovoitov int zero = 0; 61503d4d13fSAlexei Starovoitov struct bpf_func_stats_ctx stats_ctx; 61603d4d13fSAlexei Starovoitov bpf_stats_enter(&stats_ctx, profiler_bpf_sched_process_exit); 61703d4d13fSAlexei Starovoitov 61803d4d13fSAlexei Starovoitov u32 tpid = get_userspace_pid(); 61903d4d13fSAlexei Starovoitov 62003d4d13fSAlexei Starovoitov struct var_kill_data_arr_t* arr_struct = bpf_map_lookup_elem(&var_tpid_to_data, &tpid); 62103d4d13fSAlexei Starovoitov struct var_kill_data_t* kill_data = bpf_map_lookup_elem(&data_heap, &zero); 62203d4d13fSAlexei Starovoitov 62303d4d13fSAlexei Starovoitov if (arr_struct == NULL || kill_data == NULL) 62403d4d13fSAlexei Starovoitov goto out; 62503d4d13fSAlexei Starovoitov 62603d4d13fSAlexei Starovoitov struct task_struct* task = (struct task_struct*)bpf_get_current_task(); 62703d4d13fSAlexei Starovoitov struct kernfs_node* proc_kernfs = BPF_CORE_READ(task, cgroups, dfl_cgrp, kn); 62803d4d13fSAlexei Starovoitov 62903d4d13fSAlexei Starovoitov #ifdef UNROLL 63052dbd67dSJose E. Marchesi __pragma_loop_unroll 63103d4d13fSAlexei Starovoitov #endif 63203d4d13fSAlexei Starovoitov for (int i = 0; i < ARRAY_SIZE(arr_struct->array); i++) { 63303d4d13fSAlexei Starovoitov struct var_kill_data_t* past_kill_data = &arr_struct->array[i]; 63403d4d13fSAlexei Starovoitov 635495d2d81SAlexei Starovoitov if (past_kill_data != NULL && past_kill_data->kill_target_pid == (pid_t)tpid) { 6361b5e3853SIlya Leoshkevich bpf_probe_read_kernel(kill_data, sizeof(*past_kill_data), 6371b5e3853SIlya Leoshkevich past_kill_data); 63803d4d13fSAlexei Starovoitov void* payload = kill_data->payload; 63903d4d13fSAlexei Starovoitov size_t offset = kill_data->payload_length; 64003d4d13fSAlexei Starovoitov if (offset >= MAX_METADATA_PAYLOAD_LEN + MAX_CGROUP_PAYLOAD_LEN) 64103d4d13fSAlexei Starovoitov return 0; 64203d4d13fSAlexei Starovoitov payload += offset; 64303d4d13fSAlexei Starovoitov 64403d4d13fSAlexei Starovoitov kill_data->kill_target_name_length = 0; 64503d4d13fSAlexei Starovoitov kill_data->kill_target_cgroup_proc_length = 0; 64603d4d13fSAlexei Starovoitov 64703d4d13fSAlexei Starovoitov size_t comm_length = bpf_core_read_str(payload, TASK_COMM_LEN, &task->comm); 6487e3811cbSAlexei Starovoitov if (bpf_cmp_likely(comm_length, <=, TASK_COMM_LEN)) { 64903d4d13fSAlexei Starovoitov kill_data->kill_target_name_length = comm_length; 65003d4d13fSAlexei Starovoitov payload += comm_length; 65103d4d13fSAlexei Starovoitov } 65203d4d13fSAlexei Starovoitov 6531b5e3853SIlya Leoshkevich size_t cgroup_proc_length = 6541b5e3853SIlya Leoshkevich bpf_probe_read_kernel_str(payload, 6551b5e3853SIlya Leoshkevich KILL_TARGET_LEN, 65603d4d13fSAlexei Starovoitov BPF_CORE_READ(proc_kernfs, name)); 6577e3811cbSAlexei Starovoitov if (bpf_cmp_likely(cgroup_proc_length, <=, KILL_TARGET_LEN)) { 65803d4d13fSAlexei Starovoitov kill_data->kill_target_cgroup_proc_length = cgroup_proc_length; 65903d4d13fSAlexei Starovoitov payload += cgroup_proc_length; 66003d4d13fSAlexei Starovoitov } 66103d4d13fSAlexei Starovoitov 66203d4d13fSAlexei Starovoitov bpf_stats_pre_submit_var_perf_event(&stats_ctx, &kill_data->meta); 66303d4d13fSAlexei Starovoitov unsigned long data_len = (void*)payload - (void*)kill_data; 66403d4d13fSAlexei Starovoitov data_len = data_len > sizeof(struct var_kill_data_t) 66503d4d13fSAlexei Starovoitov ? sizeof(struct var_kill_data_t) 66603d4d13fSAlexei Starovoitov : data_len; 66703d4d13fSAlexei Starovoitov bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, kill_data, data_len); 66803d4d13fSAlexei Starovoitov } 66903d4d13fSAlexei Starovoitov } 67003d4d13fSAlexei Starovoitov bpf_map_delete_elem(&var_tpid_to_data, &tpid); 67103d4d13fSAlexei Starovoitov out: 67203d4d13fSAlexei Starovoitov bpf_stats_exit(&stats_ctx); 67303d4d13fSAlexei Starovoitov return 0; 67403d4d13fSAlexei Starovoitov } 67503d4d13fSAlexei Starovoitov 67603d4d13fSAlexei Starovoitov SEC("raw_tracepoint/sched_process_exec") 67703d4d13fSAlexei Starovoitov int raw_tracepoint__sched_process_exec(struct bpf_raw_tracepoint_args* ctx) 67803d4d13fSAlexei Starovoitov { 67903d4d13fSAlexei Starovoitov struct bpf_func_stats_ctx stats_ctx; 68003d4d13fSAlexei Starovoitov bpf_stats_enter(&stats_ctx, profiler_bpf_sched_process_exec); 68103d4d13fSAlexei Starovoitov 68203d4d13fSAlexei Starovoitov struct linux_binprm* bprm = (struct linux_binprm*)ctx->args[2]; 68303d4d13fSAlexei Starovoitov u64 inode = BPF_CORE_READ(bprm, file, f_inode, i_ino); 68403d4d13fSAlexei Starovoitov 68503d4d13fSAlexei Starovoitov bool* should_filter_binprm = bpf_map_lookup_elem(&disallowed_exec_inodes, &inode); 68603d4d13fSAlexei Starovoitov if (should_filter_binprm != NULL) 68703d4d13fSAlexei Starovoitov goto out; 68803d4d13fSAlexei Starovoitov 68903d4d13fSAlexei Starovoitov int zero = 0; 69003d4d13fSAlexei Starovoitov struct var_exec_data_t* proc_exec_data = bpf_map_lookup_elem(&data_heap, &zero); 69103d4d13fSAlexei Starovoitov if (!proc_exec_data) 69203d4d13fSAlexei Starovoitov goto out; 69303d4d13fSAlexei Starovoitov 69403d4d13fSAlexei Starovoitov if (INODE_FILTER && inode != INODE_FILTER) 69503d4d13fSAlexei Starovoitov return 0; 69603d4d13fSAlexei Starovoitov 69703d4d13fSAlexei Starovoitov u32 pid = get_userspace_pid(); 69803d4d13fSAlexei Starovoitov struct task_struct* task = (struct task_struct*)bpf_get_current_task(); 69903d4d13fSAlexei Starovoitov 70003d4d13fSAlexei Starovoitov proc_exec_data->meta.type = EXEC_EVENT; 70103d4d13fSAlexei Starovoitov proc_exec_data->bin_path_length = 0; 70203d4d13fSAlexei Starovoitov proc_exec_data->cmdline_length = 0; 70303d4d13fSAlexei Starovoitov proc_exec_data->environment_length = 0; 70403d4d13fSAlexei Starovoitov void* payload = populate_var_metadata(&proc_exec_data->meta, task, pid, 70503d4d13fSAlexei Starovoitov proc_exec_data->payload); 70603d4d13fSAlexei Starovoitov payload = populate_cgroup_info(&proc_exec_data->cgroup_data, task, payload); 70703d4d13fSAlexei Starovoitov 70803d4d13fSAlexei Starovoitov struct task_struct* parent_task = BPF_CORE_READ(task, real_parent); 70903d4d13fSAlexei Starovoitov proc_exec_data->parent_pid = BPF_CORE_READ(parent_task, tgid); 71003d4d13fSAlexei Starovoitov proc_exec_data->parent_uid = BPF_CORE_READ(parent_task, real_cred, uid.val); 71103d4d13fSAlexei Starovoitov proc_exec_data->parent_exec_id = BPF_CORE_READ(parent_task, self_exec_id); 71203d4d13fSAlexei Starovoitov proc_exec_data->parent_start_time = BPF_CORE_READ(parent_task, start_time); 71303d4d13fSAlexei Starovoitov 71403d4d13fSAlexei Starovoitov const char* filename = BPF_CORE_READ(bprm, filename); 7151b5e3853SIlya Leoshkevich size_t bin_path_length = 7161b5e3853SIlya Leoshkevich bpf_probe_read_kernel_str(payload, MAX_FILENAME_LEN, filename); 7177e3811cbSAlexei Starovoitov if (bpf_cmp_likely(bin_path_length, <=, MAX_FILENAME_LEN)) { 71803d4d13fSAlexei Starovoitov proc_exec_data->bin_path_length = bin_path_length; 71903d4d13fSAlexei Starovoitov payload += bin_path_length; 72003d4d13fSAlexei Starovoitov } 72103d4d13fSAlexei Starovoitov 72203d4d13fSAlexei Starovoitov void* arg_start = (void*)BPF_CORE_READ(task, mm, arg_start); 72303d4d13fSAlexei Starovoitov void* arg_end = (void*)BPF_CORE_READ(task, mm, arg_end); 72403d4d13fSAlexei Starovoitov unsigned int cmdline_length = probe_read_lim(payload, arg_start, 72503d4d13fSAlexei Starovoitov arg_end - arg_start, MAX_ARGS_LEN); 72603d4d13fSAlexei Starovoitov 7277e3811cbSAlexei Starovoitov if (bpf_cmp_likely(cmdline_length, <=, MAX_ARGS_LEN)) { 72803d4d13fSAlexei Starovoitov proc_exec_data->cmdline_length = cmdline_length; 72903d4d13fSAlexei Starovoitov payload += cmdline_length; 73003d4d13fSAlexei Starovoitov } 73103d4d13fSAlexei Starovoitov 73203d4d13fSAlexei Starovoitov if (READ_ENVIRON_FROM_EXEC) { 73303d4d13fSAlexei Starovoitov void* env_start = (void*)BPF_CORE_READ(task, mm, env_start); 73403d4d13fSAlexei Starovoitov void* env_end = (void*)BPF_CORE_READ(task, mm, env_end); 73503d4d13fSAlexei Starovoitov unsigned long env_len = probe_read_lim(payload, env_start, 73603d4d13fSAlexei Starovoitov env_end - env_start, MAX_ENVIRON_LEN); 73703d4d13fSAlexei Starovoitov if (cmdline_length <= MAX_ENVIRON_LEN) { 73803d4d13fSAlexei Starovoitov proc_exec_data->environment_length = env_len; 73903d4d13fSAlexei Starovoitov payload += env_len; 74003d4d13fSAlexei Starovoitov } 74103d4d13fSAlexei Starovoitov } 74203d4d13fSAlexei Starovoitov 74303d4d13fSAlexei Starovoitov bpf_stats_pre_submit_var_perf_event(&stats_ctx, &proc_exec_data->meta); 74403d4d13fSAlexei Starovoitov unsigned long data_len = payload - (void*)proc_exec_data; 74503d4d13fSAlexei Starovoitov data_len = data_len > sizeof(struct var_exec_data_t) 74603d4d13fSAlexei Starovoitov ? sizeof(struct var_exec_data_t) 74703d4d13fSAlexei Starovoitov : data_len; 74803d4d13fSAlexei Starovoitov bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, proc_exec_data, data_len); 74903d4d13fSAlexei Starovoitov out: 75003d4d13fSAlexei Starovoitov bpf_stats_exit(&stats_ctx); 75103d4d13fSAlexei Starovoitov return 0; 75203d4d13fSAlexei Starovoitov } 75303d4d13fSAlexei Starovoitov 75403d4d13fSAlexei Starovoitov SEC("kretprobe/do_filp_open") 75503d4d13fSAlexei Starovoitov int kprobe_ret__do_filp_open(struct pt_regs* ctx) 75603d4d13fSAlexei Starovoitov { 75703d4d13fSAlexei Starovoitov struct bpf_func_stats_ctx stats_ctx; 75803d4d13fSAlexei Starovoitov bpf_stats_enter(&stats_ctx, profiler_bpf_do_filp_open_ret); 75903d4d13fSAlexei Starovoitov 76003d4d13fSAlexei Starovoitov struct file* filp = (struct file*)PT_REGS_RC_CORE(ctx); 76103d4d13fSAlexei Starovoitov 76203d4d13fSAlexei Starovoitov if (filp == NULL || IS_ERR(filp)) 76303d4d13fSAlexei Starovoitov goto out; 76403d4d13fSAlexei Starovoitov unsigned int flags = BPF_CORE_READ(filp, f_flags); 76503d4d13fSAlexei Starovoitov if ((flags & (O_RDWR | O_WRONLY)) == 0) 76603d4d13fSAlexei Starovoitov goto out; 76703d4d13fSAlexei Starovoitov if ((flags & O_TMPFILE) > 0) 76803d4d13fSAlexei Starovoitov goto out; 76903d4d13fSAlexei Starovoitov struct inode* file_inode = BPF_CORE_READ(filp, f_inode); 77003d4d13fSAlexei Starovoitov umode_t mode = BPF_CORE_READ(file_inode, i_mode); 77103d4d13fSAlexei Starovoitov if (S_ISDIR(mode) || S_ISCHR(mode) || S_ISBLK(mode) || S_ISFIFO(mode) || 77203d4d13fSAlexei Starovoitov S_ISSOCK(mode)) 77303d4d13fSAlexei Starovoitov goto out; 77403d4d13fSAlexei Starovoitov 77503d4d13fSAlexei Starovoitov struct dentry* filp_dentry = BPF_CORE_READ(filp, f_path.dentry); 77603d4d13fSAlexei Starovoitov u32 device_id = 0; 77703d4d13fSAlexei Starovoitov u64 file_ino = 0; 77803d4d13fSAlexei Starovoitov if (!is_dentry_allowed_for_filemod(filp_dentry, &device_id, &file_ino)) 77903d4d13fSAlexei Starovoitov goto out; 78003d4d13fSAlexei Starovoitov 78103d4d13fSAlexei Starovoitov int zero = 0; 78203d4d13fSAlexei Starovoitov struct var_filemod_data_t* filemod_data = bpf_map_lookup_elem(&data_heap, &zero); 78303d4d13fSAlexei Starovoitov if (!filemod_data) 78403d4d13fSAlexei Starovoitov goto out; 78503d4d13fSAlexei Starovoitov 78603d4d13fSAlexei Starovoitov u32 pid = get_userspace_pid(); 78703d4d13fSAlexei Starovoitov struct task_struct* task = (struct task_struct*)bpf_get_current_task(); 78803d4d13fSAlexei Starovoitov 78903d4d13fSAlexei Starovoitov filemod_data->meta.type = FILEMOD_EVENT; 79003d4d13fSAlexei Starovoitov filemod_data->fmod_type = FMOD_OPEN; 79103d4d13fSAlexei Starovoitov filemod_data->dst_flags = flags; 79203d4d13fSAlexei Starovoitov filemod_data->src_inode = 0; 79303d4d13fSAlexei Starovoitov filemod_data->dst_inode = file_ino; 79403d4d13fSAlexei Starovoitov filemod_data->src_device_id = 0; 79503d4d13fSAlexei Starovoitov filemod_data->dst_device_id = device_id; 79603d4d13fSAlexei Starovoitov filemod_data->src_filepath_length = 0; 79703d4d13fSAlexei Starovoitov filemod_data->dst_filepath_length = 0; 79803d4d13fSAlexei Starovoitov 79903d4d13fSAlexei Starovoitov void* payload = populate_var_metadata(&filemod_data->meta, task, pid, 80003d4d13fSAlexei Starovoitov filemod_data->payload); 80103d4d13fSAlexei Starovoitov payload = populate_cgroup_info(&filemod_data->cgroup_data, task, payload); 80203d4d13fSAlexei Starovoitov 80303d4d13fSAlexei Starovoitov size_t len = read_absolute_file_path_from_dentry(filp_dentry, payload); 8047e3811cbSAlexei Starovoitov if (bpf_cmp_likely(len, <=, MAX_FILEPATH_LENGTH)) { 80503d4d13fSAlexei Starovoitov payload += len; 80603d4d13fSAlexei Starovoitov filemod_data->dst_filepath_length = len; 80703d4d13fSAlexei Starovoitov } 80803d4d13fSAlexei Starovoitov bpf_stats_pre_submit_var_perf_event(&stats_ctx, &filemod_data->meta); 80903d4d13fSAlexei Starovoitov unsigned long data_len = payload - (void*)filemod_data; 81003d4d13fSAlexei Starovoitov data_len = data_len > sizeof(*filemod_data) ? sizeof(*filemod_data) : data_len; 81103d4d13fSAlexei Starovoitov bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, filemod_data, data_len); 81203d4d13fSAlexei Starovoitov out: 81303d4d13fSAlexei Starovoitov bpf_stats_exit(&stats_ctx); 81403d4d13fSAlexei Starovoitov return 0; 81503d4d13fSAlexei Starovoitov } 81603d4d13fSAlexei Starovoitov 81703d4d13fSAlexei Starovoitov SEC("kprobe/vfs_link") 81803d4d13fSAlexei Starovoitov int BPF_KPROBE(kprobe__vfs_link, 819abf08576SChristian Brauner struct dentry* old_dentry, struct mnt_idmap *idmap, 820e299bcd4SNikolay Borisov struct inode* dir, struct dentry* new_dentry, 821e299bcd4SNikolay Borisov struct inode** delegated_inode) 82203d4d13fSAlexei Starovoitov { 82303d4d13fSAlexei Starovoitov struct bpf_func_stats_ctx stats_ctx; 82403d4d13fSAlexei Starovoitov bpf_stats_enter(&stats_ctx, profiler_bpf_vfs_link); 82503d4d13fSAlexei Starovoitov 82603d4d13fSAlexei Starovoitov u32 src_device_id = 0; 82703d4d13fSAlexei Starovoitov u64 src_file_ino = 0; 82803d4d13fSAlexei Starovoitov u32 dst_device_id = 0; 82903d4d13fSAlexei Starovoitov u64 dst_file_ino = 0; 83003d4d13fSAlexei Starovoitov if (!is_dentry_allowed_for_filemod(old_dentry, &src_device_id, &src_file_ino) && 83103d4d13fSAlexei Starovoitov !is_dentry_allowed_for_filemod(new_dentry, &dst_device_id, &dst_file_ino)) 83203d4d13fSAlexei Starovoitov goto out; 83303d4d13fSAlexei Starovoitov 83403d4d13fSAlexei Starovoitov int zero = 0; 83503d4d13fSAlexei Starovoitov struct var_filemod_data_t* filemod_data = bpf_map_lookup_elem(&data_heap, &zero); 83603d4d13fSAlexei Starovoitov if (!filemod_data) 83703d4d13fSAlexei Starovoitov goto out; 83803d4d13fSAlexei Starovoitov 83903d4d13fSAlexei Starovoitov u32 pid = get_userspace_pid(); 84003d4d13fSAlexei Starovoitov struct task_struct* task = (struct task_struct*)bpf_get_current_task(); 84103d4d13fSAlexei Starovoitov 84203d4d13fSAlexei Starovoitov filemod_data->meta.type = FILEMOD_EVENT; 84303d4d13fSAlexei Starovoitov filemod_data->fmod_type = FMOD_LINK; 84403d4d13fSAlexei Starovoitov filemod_data->dst_flags = 0; 84503d4d13fSAlexei Starovoitov filemod_data->src_inode = src_file_ino; 84603d4d13fSAlexei Starovoitov filemod_data->dst_inode = dst_file_ino; 84703d4d13fSAlexei Starovoitov filemod_data->src_device_id = src_device_id; 84803d4d13fSAlexei Starovoitov filemod_data->dst_device_id = dst_device_id; 84903d4d13fSAlexei Starovoitov filemod_data->src_filepath_length = 0; 85003d4d13fSAlexei Starovoitov filemod_data->dst_filepath_length = 0; 85103d4d13fSAlexei Starovoitov 85203d4d13fSAlexei Starovoitov void* payload = populate_var_metadata(&filemod_data->meta, task, pid, 85303d4d13fSAlexei Starovoitov filemod_data->payload); 85403d4d13fSAlexei Starovoitov payload = populate_cgroup_info(&filemod_data->cgroup_data, task, payload); 85503d4d13fSAlexei Starovoitov 85603d4d13fSAlexei Starovoitov size_t len = read_absolute_file_path_from_dentry(old_dentry, payload); 8577e3811cbSAlexei Starovoitov if (bpf_cmp_likely(len, <=, MAX_FILEPATH_LENGTH)) { 85803d4d13fSAlexei Starovoitov payload += len; 85903d4d13fSAlexei Starovoitov filemod_data->src_filepath_length = len; 86003d4d13fSAlexei Starovoitov } 86103d4d13fSAlexei Starovoitov 86203d4d13fSAlexei Starovoitov len = read_absolute_file_path_from_dentry(new_dentry, payload); 8637e3811cbSAlexei Starovoitov if (bpf_cmp_likely(len, <=, MAX_FILEPATH_LENGTH)) { 86403d4d13fSAlexei Starovoitov payload += len; 86503d4d13fSAlexei Starovoitov filemod_data->dst_filepath_length = len; 86603d4d13fSAlexei Starovoitov } 86703d4d13fSAlexei Starovoitov 86803d4d13fSAlexei Starovoitov bpf_stats_pre_submit_var_perf_event(&stats_ctx, &filemod_data->meta); 86903d4d13fSAlexei Starovoitov unsigned long data_len = payload - (void*)filemod_data; 87003d4d13fSAlexei Starovoitov data_len = data_len > sizeof(*filemod_data) ? sizeof(*filemod_data) : data_len; 87103d4d13fSAlexei Starovoitov bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, filemod_data, data_len); 87203d4d13fSAlexei Starovoitov out: 87303d4d13fSAlexei Starovoitov bpf_stats_exit(&stats_ctx); 87403d4d13fSAlexei Starovoitov return 0; 87503d4d13fSAlexei Starovoitov } 87603d4d13fSAlexei Starovoitov 87703d4d13fSAlexei Starovoitov SEC("kprobe/vfs_symlink") 87803d4d13fSAlexei Starovoitov int BPF_KPROBE(kprobe__vfs_symlink, struct inode* dir, struct dentry* dentry, 87903d4d13fSAlexei Starovoitov const char* oldname) 88003d4d13fSAlexei Starovoitov { 88103d4d13fSAlexei Starovoitov struct bpf_func_stats_ctx stats_ctx; 88203d4d13fSAlexei Starovoitov bpf_stats_enter(&stats_ctx, profiler_bpf_vfs_symlink); 88303d4d13fSAlexei Starovoitov 88403d4d13fSAlexei Starovoitov u32 dst_device_id = 0; 88503d4d13fSAlexei Starovoitov u64 dst_file_ino = 0; 88603d4d13fSAlexei Starovoitov if (!is_dentry_allowed_for_filemod(dentry, &dst_device_id, &dst_file_ino)) 88703d4d13fSAlexei Starovoitov goto out; 88803d4d13fSAlexei Starovoitov 88903d4d13fSAlexei Starovoitov int zero = 0; 89003d4d13fSAlexei Starovoitov struct var_filemod_data_t* filemod_data = bpf_map_lookup_elem(&data_heap, &zero); 89103d4d13fSAlexei Starovoitov if (!filemod_data) 89203d4d13fSAlexei Starovoitov goto out; 89303d4d13fSAlexei Starovoitov 89403d4d13fSAlexei Starovoitov u32 pid = get_userspace_pid(); 89503d4d13fSAlexei Starovoitov struct task_struct* task = (struct task_struct*)bpf_get_current_task(); 89603d4d13fSAlexei Starovoitov 89703d4d13fSAlexei Starovoitov filemod_data->meta.type = FILEMOD_EVENT; 89803d4d13fSAlexei Starovoitov filemod_data->fmod_type = FMOD_SYMLINK; 89903d4d13fSAlexei Starovoitov filemod_data->dst_flags = 0; 90003d4d13fSAlexei Starovoitov filemod_data->src_inode = 0; 90103d4d13fSAlexei Starovoitov filemod_data->dst_inode = dst_file_ino; 90203d4d13fSAlexei Starovoitov filemod_data->src_device_id = 0; 90303d4d13fSAlexei Starovoitov filemod_data->dst_device_id = dst_device_id; 90403d4d13fSAlexei Starovoitov filemod_data->src_filepath_length = 0; 90503d4d13fSAlexei Starovoitov filemod_data->dst_filepath_length = 0; 90603d4d13fSAlexei Starovoitov 90703d4d13fSAlexei Starovoitov void* payload = populate_var_metadata(&filemod_data->meta, task, pid, 90803d4d13fSAlexei Starovoitov filemod_data->payload); 90903d4d13fSAlexei Starovoitov payload = populate_cgroup_info(&filemod_data->cgroup_data, task, payload); 91003d4d13fSAlexei Starovoitov 9111b5e3853SIlya Leoshkevich size_t len = bpf_probe_read_kernel_str(payload, MAX_FILEPATH_LENGTH, 9121b5e3853SIlya Leoshkevich oldname); 9137e3811cbSAlexei Starovoitov if (bpf_cmp_likely(len, <=, MAX_FILEPATH_LENGTH)) { 91403d4d13fSAlexei Starovoitov payload += len; 91503d4d13fSAlexei Starovoitov filemod_data->src_filepath_length = len; 91603d4d13fSAlexei Starovoitov } 91703d4d13fSAlexei Starovoitov len = read_absolute_file_path_from_dentry(dentry, payload); 9187e3811cbSAlexei Starovoitov if (bpf_cmp_likely(len, <=, MAX_FILEPATH_LENGTH)) { 91903d4d13fSAlexei Starovoitov payload += len; 92003d4d13fSAlexei Starovoitov filemod_data->dst_filepath_length = len; 92103d4d13fSAlexei Starovoitov } 92203d4d13fSAlexei Starovoitov bpf_stats_pre_submit_var_perf_event(&stats_ctx, &filemod_data->meta); 92303d4d13fSAlexei Starovoitov unsigned long data_len = payload - (void*)filemod_data; 92403d4d13fSAlexei Starovoitov data_len = data_len > sizeof(*filemod_data) ? sizeof(*filemod_data) : data_len; 92503d4d13fSAlexei Starovoitov bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, filemod_data, data_len); 92603d4d13fSAlexei Starovoitov out: 92703d4d13fSAlexei Starovoitov bpf_stats_exit(&stats_ctx); 92803d4d13fSAlexei Starovoitov return 0; 92903d4d13fSAlexei Starovoitov } 93003d4d13fSAlexei Starovoitov 93103d4d13fSAlexei Starovoitov SEC("raw_tracepoint/sched_process_fork") 93203d4d13fSAlexei Starovoitov int raw_tracepoint__sched_process_fork(struct bpf_raw_tracepoint_args* ctx) 93303d4d13fSAlexei Starovoitov { 93403d4d13fSAlexei Starovoitov struct bpf_func_stats_ctx stats_ctx; 93503d4d13fSAlexei Starovoitov bpf_stats_enter(&stats_ctx, profiler_bpf_sched_process_fork); 93603d4d13fSAlexei Starovoitov 93703d4d13fSAlexei Starovoitov int zero = 0; 93803d4d13fSAlexei Starovoitov struct var_fork_data_t* fork_data = bpf_map_lookup_elem(&data_heap, &zero); 93903d4d13fSAlexei Starovoitov if (!fork_data) 94003d4d13fSAlexei Starovoitov goto out; 94103d4d13fSAlexei Starovoitov 94203d4d13fSAlexei Starovoitov struct task_struct* parent = (struct task_struct*)ctx->args[0]; 94303d4d13fSAlexei Starovoitov struct task_struct* child = (struct task_struct*)ctx->args[1]; 94403d4d13fSAlexei Starovoitov fork_data->meta.type = FORK_EVENT; 94503d4d13fSAlexei Starovoitov 94603d4d13fSAlexei Starovoitov void* payload = populate_var_metadata(&fork_data->meta, child, 94703d4d13fSAlexei Starovoitov BPF_CORE_READ(child, pid), fork_data->payload); 94803d4d13fSAlexei Starovoitov fork_data->parent_pid = BPF_CORE_READ(parent, pid); 94903d4d13fSAlexei Starovoitov fork_data->parent_exec_id = BPF_CORE_READ(parent, self_exec_id); 95003d4d13fSAlexei Starovoitov fork_data->parent_start_time = BPF_CORE_READ(parent, start_time); 95103d4d13fSAlexei Starovoitov bpf_stats_pre_submit_var_perf_event(&stats_ctx, &fork_data->meta); 95203d4d13fSAlexei Starovoitov 95303d4d13fSAlexei Starovoitov unsigned long data_len = payload - (void*)fork_data; 95403d4d13fSAlexei Starovoitov data_len = data_len > sizeof(*fork_data) ? sizeof(*fork_data) : data_len; 95503d4d13fSAlexei Starovoitov bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, fork_data, data_len); 95603d4d13fSAlexei Starovoitov out: 95703d4d13fSAlexei Starovoitov bpf_stats_exit(&stats_ctx); 95803d4d13fSAlexei Starovoitov return 0; 95903d4d13fSAlexei Starovoitov } 96003d4d13fSAlexei Starovoitov char _license[] SEC("license") = "GPL"; 961