カーネルモジュールとeBPFアプリを書いてみた

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# 2つためした
$ cat /etc/issue
Ubuntu 16.04.7 LTS \n \l
$ uname -a
Linux ubuntu-xenial 4.4.0-194-generic #226-Ubuntu SMP Wed Oct 21 10:19:36 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

$ cat /etc/issue
Ubuntu 18.04.5 LTS \n \l
$ uname -a
Linux test-k3s 4.15.0-124-generic #127-Ubuntu SMP Fri Nov 6 10:54:43 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

# カーネルモジュール開発環境の準備で紹介されていたpkg
$ apt-get install \
  gawk wget git diffstat unzip texinfo \
  gcc-multilib chrpath socat xterm lzop kmod libsdl1.2-dev \
  build-essential flex libelf-dev libncurses5-dev

# カーネルビルドに必要なもの
$ apt-get install \
  build-essential bc bison flex libssl-dev \
  libelf-dev libssl-dev libncurses5-dev

1
2
3
4
5

sudo cat /proc/kallsyms | less
....
0000000000004800 A unsafe_stack_register_backup
0000000000004840 A cpu_debug_store
....

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

static ssize_t trace_etn_write(struct file *filp, const char __user *buf, 
                               size_t count, loff_t *f_pos)
{
	/* Always end with a call to jprobe_return(). */
	jprobe_return();
	return 0;
}

static struct jprobe jprobe_instance = {
	.entry			= trace_etn_write,
	.kp = {
		.symbol_name	= "etn_write",
	},
};

static int __init jprobe_init(void)
{
	int ret;

	ret = register_jprobe(&jprobe_instance);
	if (ret < 0) {
		return -1;
	}
	return 0;
}

static void __exit jprobe_exit(void)
{
	unregister_jprobe(&jprobe_instance);
}

module_init(jprobe_init)
module_exit(jprobe_exit)

1
2
3
4

$ sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 4052245BD4284CDD
$ echo "deb https://repo.iovisor.org/apt/$(lsb_release -cs) $(lsb_release -cs) main" | sudo tee /etc/apt/sources.list.d/iovisor.list
$ sudo apt-get update
$ sudo apt-get install python3-bcc bcc-tools libbcc-examples linux-headers-$(uname -r)

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

from bcc import BPF
import time

bpf_code = """
int trace_clone(void *ctx) {
   bpf_trace_printk("Hello: clone(2)\\n");
   return 0;
}
int trace_fork(void *ctx) {
    bpf_trace_printk("Hello: fork(2)\\n");
    return 0;
 }
int trace_openat(void *ctx) {
   bpf_trace_printk("Hello: openat(2)\\n");
   return 0;
}
int trace_open(void *ctx) {
   bpf_trace_printk("Hello: open(2)\\n");
   return 0;
}
int trace_close(void *ctx) {
   bpf_trace_printk("Hello: close(2)\\n");
   return 0;
}
"""

bpf = BPF(text=bpf_code)
for name in ["close", "open", "openat", "clone", "fork"]:
    syscall_name = bpf.get_syscall_fnname(name)
    print(syscall_name)
    bpf.attach_kprobe(event = syscall_name, fn_name = "trace_{}".format(name))
    bpf.attach_kretprobe(event = syscall_name, fn_name = "trace_{}".format(name))
bpf.trace_print()