this repo has no description
Initial commit
+181
+1
.ocamlformat
+1
.ocamlformat
···
1
+
version=0.27.0
+4
README.md
+4
README.md
+26
dune
+26
dune
···
1
+
(executable
2
+
(name opentrace)
3
+
(libraries unix libbpf libbpf_maps))
4
+
5
+
(rule
6
+
(mode
7
+
(promote (until-clean)))
8
+
(targets opentrace.bpf.o)
9
+
(deps arch opentrace.bpf.c)
10
+
(action
11
+
(system
12
+
"NIX_HARDENING_ENABLE=\"\" clang -g -O2 -target bpf -I/usr/include/%{architecture}-linux-gnu/ -c opentrace.bpf.c -D__TARGET_ARCH_%{read:arch}")))
13
+
14
+
(rule
15
+
(mode
16
+
(promote (until-clean)))
17
+
(targets vmlinux.h arch)
18
+
(action
19
+
(progn
20
+
(with-stdout-to
21
+
vmlinux.h
22
+
(run bpftool btf dump file /sys/kernel/btf/vmlinux format c))
23
+
(with-stdout-to
24
+
arch
25
+
(bash
26
+
"uname -m | sed 's/x86_64/x86/' | sed 's/arm.*/arm/' | sed 's/aarch64/arm64/' | sed 's/ppc64le/powerpc/' | sed 's/mips.*/mips/' | sed 's/riscv64/riscv/' | sed 's/loongarch64/loongarch/'")))))
+49
opentrace.bpf.c
+49
opentrace.bpf.c
···
1
+
#include "vmlinux.h"
2
+
#include <bpf/bpf_helpers.h>
3
+
4
+
char LICENSE[] SEC("license") = "Dual BSD/GPL";
5
+
6
+
const volatile int pid_target = 0;
7
+
8
+
struct {
9
+
__uint(type, BPF_MAP_TYPE_RINGBUF);
10
+
__uint(max_entries, 256 * 1024);
11
+
} rb SEC(".maps");
12
+
13
+
#define FILE_NAME_LEN 1024
14
+
15
+
// An open event
16
+
struct open_event
17
+
{
18
+
uint32_t e_pid;
19
+
int e_flags;
20
+
uint32_t e_mode;
21
+
char e_filename[FILE_NAME_LEN];
22
+
};
23
+
24
+
SEC("tracepoint/syscalls/sys_enter_openat")
25
+
int tracepoint__syscalls__sys_enter_openat(struct trace_event_raw_sys_enter* ctx)
26
+
{
27
+
u64 id = bpf_get_current_pid_tgid();
28
+
u32 pid = id >> 32;
29
+
30
+
char filename[FILE_NAME_LEN];
31
+
struct open_event *oet;
32
+
33
+
oet = bpf_ringbuf_reserve(&rb, sizeof(struct open_event), 0);
34
+
if (!oet)
35
+
return 0;
36
+
37
+
if (pid_target && pid_target != pid)
38
+
return false;
39
+
40
+
// Fill the open event
41
+
oet->e_pid = bpf_get_current_pid_tgid();
42
+
oet->e_flags = (int)ctx->args[2];
43
+
oet->e_mode = (__u32)ctx->args[3];
44
+
bpf_probe_read(oet->e_filename, sizeof(filename), (char *) ctx->args[1]);
45
+
46
+
bpf_ringbuf_submit(oet, 0);
47
+
return 0;
48
+
}
49
+
+65
opentrace.ml
+65
opentrace.ml
···
1
+
open Libbpf
2
+
open Libbpf_maps
3
+
4
+
let obj_path = "opentrace.bpf.o"
5
+
let program_names = [ "tracepoint__syscalls__sys_enter_openat" ]
6
+
7
+
module Open_event = struct
8
+
open Ctypes
9
+
10
+
type t
11
+
12
+
let t : t structure typ = Ctypes.structure "event"
13
+
let ( -: ) ty label = Ctypes.field t label ty
14
+
let pid = int -: "e_pid"
15
+
let flags = int -: "e_flags"
16
+
let mode = int -: "e_mode"
17
+
let filename = array 256 char -: "e_filename"
18
+
let () = seal t
19
+
20
+
let char_array_as_string a =
21
+
let len = CArray.length a in
22
+
let b = Buffer.create len in
23
+
try
24
+
for i = 0 to len - 1 do
25
+
let c = CArray.get a i in
26
+
if c = '\x00' then raise Exit else Buffer.add_char b c
27
+
done;
28
+
Buffer.contents b
29
+
with Exit -> Buffer.contents b
30
+
31
+
let get_pid s = getf s pid
32
+
let get_flags s = getf s flags
33
+
let get_mode s = getf s mode
34
+
let get_fname s = getf s filename |> char_array_as_string
35
+
end
36
+
37
+
let () =
38
+
let bpf_callback obj _links =
39
+
(* Set signal handlers *)
40
+
let exitting = ref true in
41
+
let sig_handler = Sys.Signal_handle (fun _ -> exitting := false) in
42
+
Sys.(set_signal sigint sig_handler);
43
+
Sys.(set_signal sigterm sig_handler);
44
+
45
+
(* Print header *)
46
+
Format.printf "pid,flags,mode,filename\n";
47
+
48
+
let map = Libbpf.bpf_object_find_map_by_name obj "rb" in
49
+
let callback : RingBuffer.callback =
50
+
fun _ data _ ->
51
+
let event = Ctypes.(!@(from_voidp Open_event.t data)) in
52
+
Format.printf "%i,%i,%i,\"%s\"\n%!" (Open_event.get_pid event)
53
+
(Open_event.get_flags event)
54
+
(Open_event.get_mode event)
55
+
(Open_event.get_fname event);
56
+
0
57
+
in
58
+
RingBuffer.init map ~callback @@ fun rb ->
59
+
while !exitting do
60
+
Unix.sleepf 1.0;
61
+
let _ : int = RingBuffer.poll rb ~timeout:1 in
62
+
()
63
+
done
64
+
in
65
+
with_bpf_object_open_load_link ~obj_path ~program_names bpf_callback
+29
opentrace.opam
+29
opentrace.opam
···
1
+
opam-version: "2.0"
2
+
synopsis: "Trace the opening of files"
3
+
description: "A linux tool using eBPF for tracing calls to open files"
4
+
maintainer: ["Patrick Ferris <patrick@sirref.org>"]
5
+
authors: ["Patrick Ferris <patrick@sirref.org>"]
6
+
license: "MIT"
7
+
homepage: "https://tangled.sh/@patrick.sirref.org/opentrace"
8
+
depends: [
9
+
"dune" {>= "3.17"}
10
+
"ocaml"
11
+
"libbpf"
12
+
"libbpg_map"
13
+
"odoc" {with-doc}
14
+
]
15
+
build: [
16
+
["dune" "subst"] {dev}
17
+
[
18
+
"dune"
19
+
"build"
20
+
"-p"
21
+
name
22
+
"-j"
23
+
jobs
24
+
"@install"
25
+
"@runtest" {with-test}
26
+
"@doc" {with-doc}
27
+
]
28
+
]
29
+
homepage: "https://tangled.sh/@patrick.sirref.org/opentrace"