Skip to content

Commit f1c556d

Browse files
Rtoaxdkruces
Rtoax
authored and
dkruces
committed
libbpf-tools/mountsnoop: Support fsopen,fsconfig,fsmount,move_mount syscalls
Do the same thing of bcc commit 60ebaf4 ("tools/mountsnoop: Support fsopen(2), fsmount(2), fsconfig(2), move_mount(2)") $ sudo ./mountsnoop COMM PID TID MNT_NS CALL fsmount 431216 431216 4026531841 fsopen("ext4", 0x0) = 5 fsmount 431216 431216 4026531841 fsconfig(5, "FSCONFIG_SET_FLAG", "rw", "", 0) = 0 fsmount 431216 431216 4026531841 fsconfig(5, "FSCONFIG_SET_STRING", "source", "/dev/loop0", 0) = 0 fsmount 431216 431216 4026531841 fsconfig(5, "FSCONFIG_CMD_CREATE", "", "", 0) = 0 fsmount 431216 431216 4026531841 fsmount(5, "0x0", "MOUNT_ATTR_RDONLY") = 6 fsmount 431216 431216 4026531841 move_mount(6, "", AT_FDCWD, "./tmp-dir/", "") = 0 fsmount 431216 431216 4026531841 umount("./tmp-dir/", 0x0) = 0 In the above test, the C program is more complicated, so I will not show it here, but a test example is given in the link [1]. [1] https://github.com/torvalds/linux/blob/master/samples/vfs/test-fsmount.c Signed-off-by: Rong Tao <[email protected]>
1 parent e4b2263 commit f1c556d

File tree

3 files changed

+463
-54
lines changed

3 files changed

+463
-54
lines changed

‎libbpf-tools/mountsnoop.bpf.c‎

Lines changed: 146 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,7 @@ struct {
1919
__type(value, struct arg);
2020
} args SEC(".maps");
2121

22-
static int probe_entry(const char *src, const char *dest, const char *fs,
23-
__u64 flags, const char *data, enum op op)
22+
static int probe_entry(union sys_arg *sys_arg, enum op op)
2423
{
2524
__u64 pid_tgid = bpf_get_current_pid_tgid();
2625
__u32 pid = pid_tgid >> 32;
@@ -35,18 +34,19 @@ static int probe_entry(const char *src, const char *dest, const char *fs,
3534

3635
switch (op) {
3736
case MOUNT:
38-
arg.mount.flags = flags;
39-
arg.mount.src = src;
40-
arg.mount.dest = dest;
41-
arg.mount.fs = fs;
42-
arg.mount.data= data;
43-
break;
4437
case UMOUNT:
45-
arg.umount.flags = flags;
46-
arg.umount.dest = dest;
38+
case FSOPEN:
39+
case FSCONFIG:
40+
case FSMOUNT:
41+
case MOVE_MOUNT:
42+
__builtin_memcpy(&arg.sys, sys_arg, sizeof(*sys_arg));
4743
break;
44+
default:
45+
goto skip;
4846
}
47+
4948
bpf_map_update_elem(&args, &tid, &arg, BPF_ANY);
49+
skip:
5050
return 0;
5151
};
5252

@@ -78,15 +78,57 @@ static int probe_exit(void *ctx, int ret)
7878

7979
switch (argp->op) {
8080
case MOUNT:
81-
eventp->mount.flags = argp->mount.flags;
82-
bpf_probe_read_user_str(eventp->mount.src, sizeof(eventp->mount.src), argp->mount.src);
83-
bpf_probe_read_user_str(eventp->mount.dest, sizeof(eventp->mount.dest), argp->mount.dest);
84-
bpf_probe_read_user_str(eventp->mount.fs, sizeof(eventp->mount.fs), argp->mount.fs);
85-
bpf_probe_read_user_str(eventp->mount.data, sizeof(eventp->mount.data), argp->mount.data);
81+
eventp->mount.flags = argp->sys.mount.flags;
82+
bpf_probe_read_user_str(eventp->mount.src,
83+
sizeof(eventp->mount.src),
84+
argp->sys.mount.src);
85+
bpf_probe_read_user_str(eventp->mount.dest,
86+
sizeof(eventp->mount.dest),
87+
argp->sys.mount.dest);
88+
bpf_probe_read_user_str(eventp->mount.fs,
89+
sizeof(eventp->mount.fs),
90+
argp->sys.mount.fs);
91+
bpf_probe_read_user_str(eventp->mount.data,
92+
sizeof(eventp->mount.data),
93+
argp->sys.mount.data);
8694
break;
8795
case UMOUNT:
88-
eventp->umount.flags = argp->umount.flags;
89-
bpf_probe_read_user_str(eventp->umount.dest, sizeof(eventp->umount.dest), argp->umount.dest);
96+
eventp->umount.flags = argp->sys.umount.flags;
97+
bpf_probe_read_user_str(eventp->umount.dest,
98+
sizeof(eventp->umount.dest),
99+
argp->sys.umount.dest);
100+
break;
101+
case FSOPEN:
102+
eventp->fsopen.flags = argp->sys.fsopen.flags;
103+
bpf_probe_read_user_str(eventp->fsopen.fs,
104+
sizeof(eventp->fsopen.fs),
105+
argp->sys.fsopen.fs);
106+
break;
107+
case FSCONFIG:
108+
eventp->fsconfig.fd = argp->sys.fsconfig.fd;
109+
eventp->fsconfig.cmd = argp->sys.fsconfig.cmd;
110+
bpf_probe_read_user_str(eventp->fsconfig.key,
111+
sizeof(eventp->fsconfig.key),
112+
argp->sys.fsconfig.key);
113+
bpf_probe_read_user_str(eventp->fsconfig.value,
114+
sizeof(eventp->fsconfig.value),
115+
argp->sys.fsconfig.value);
116+
eventp->fsconfig.aux = argp->sys.fsconfig.aux;
117+
break;
118+
case FSMOUNT:
119+
eventp->fsmount.fs_fd = argp->sys.fsmount.fs_fd;
120+
eventp->fsmount.flags = argp->sys.fsmount.flags;
121+
eventp->fsmount.attr_flags = argp->sys.fsmount.attr_flags;
122+
break;
123+
case MOVE_MOUNT:
124+
eventp->move_mount.from_dfd = argp->sys.move_mount.from_dfd;
125+
bpf_probe_read_user_str(eventp->move_mount.from_pathname,
126+
sizeof(eventp->move_mount.from_pathname),
127+
argp->sys.move_mount.from_pathname);
128+
eventp->move_mount.to_dfd = argp->sys.move_mount.to_dfd;
129+
bpf_probe_read_user_str(eventp->move_mount.to_pathname,
130+
sizeof(eventp->move_mount.to_pathname),
131+
argp->sys.move_mount.to_pathname);
90132
break;
91133
}
92134

@@ -100,13 +142,15 @@ static int probe_exit(void *ctx, int ret)
100142
SEC("tracepoint/syscalls/sys_enter_mount")
101143
int mount_entry(struct syscall_trace_enter *ctx)
102144
{
103-
const char *src = (const char *)ctx->args[0];
104-
const char *dest = (const char *)ctx->args[1];
105-
const char *fs = (const char *)ctx->args[2];
106-
__u64 flags = (__u64)ctx->args[3];
107-
const char *data = (const char *)ctx->args[4];
145+
union sys_arg arg = {};
108146

109-
return probe_entry(src, dest, fs, flags, data, MOUNT);
147+
arg.mount.src = (const char *)ctx->args[0];
148+
arg.mount.dest = (const char *)ctx->args[1];
149+
arg.mount.fs = (const char *)ctx->args[2];
150+
arg.mount.flags = (__u64)ctx->args[3];
151+
arg.mount.data = (const char *)ctx->args[4];
152+
153+
return probe_entry(&arg, MOUNT);
110154
}
111155

112156
SEC("tracepoint/syscalls/sys_exit_mount")
@@ -118,10 +162,12 @@ int mount_exit(struct syscall_trace_exit *ctx)
118162
SEC("tracepoint/syscalls/sys_enter_umount")
119163
int umount_entry(struct syscall_trace_enter *ctx)
120164
{
121-
const char *dest = (const char *)ctx->args[0];
122-
__u64 flags = (__u64)ctx->args[1];
165+
union sys_arg arg = {};
166+
167+
arg.umount.dest = (const char *)ctx->args[0];
168+
arg.umount.flags = (__u64)ctx->args[1];
123169

124-
return probe_entry(NULL, dest, NULL, flags, NULL, UMOUNT);
170+
return probe_entry(&arg, UMOUNT);
125171
}
126172

127173
SEC("tracepoint/syscalls/sys_exit_umount")
@@ -130,4 +176,78 @@ int umount_exit(struct syscall_trace_exit *ctx)
130176
return probe_exit(ctx, (int)ctx->ret);
131177
}
132178

179+
SEC("tracepoint/syscalls/sys_enter_fsopen")
180+
int fsopen_entry(struct syscall_trace_enter *ctx)
181+
{
182+
union sys_arg arg = {};
183+
184+
arg.fsopen.fs = (const char *)ctx->args[0];
185+
arg.fsopen.flags = (__u32)ctx->args[1];
186+
187+
return probe_entry(&arg, FSOPEN);
188+
}
189+
190+
SEC("tracepoint/syscalls/sys_exit_fsopen")
191+
int fsopen_exit(struct syscall_trace_exit *ctx)
192+
{
193+
return probe_exit(ctx, (int)ctx->ret);
194+
}
195+
196+
SEC("tracepoint/syscalls/sys_enter_fsconfig")
197+
int fsconfig_entry(struct syscall_trace_enter *ctx)
198+
{
199+
union sys_arg arg = {};
200+
201+
arg.fsconfig.fd = (int)ctx->args[0];
202+
arg.fsconfig.cmd = (int)ctx->args[1];
203+
arg.fsconfig.key = (const char *)ctx->args[2];
204+
arg.fsconfig.value = (const char *)ctx->args[3];
205+
arg.fsconfig.aux = (int)ctx->args[4];
206+
207+
return probe_entry(&arg, FSCONFIG);
208+
}
209+
210+
SEC("tracepoint/syscalls/sys_exit_fsconfig")
211+
int fsconfig_exit(struct syscall_trace_exit *ctx)
212+
{
213+
return probe_exit(ctx, (int)ctx->ret);
214+
}
215+
216+
SEC("tracepoint/syscalls/sys_enter_fsmount")
217+
int fsmount_entry(struct syscall_trace_enter *ctx)
218+
{
219+
union sys_arg arg = {};
220+
221+
arg.fsmount.fs_fd = (__u32)ctx->args[0];
222+
arg.fsmount.flags = (__u32)ctx->args[1];
223+
arg.fsmount.attr_flags = (__u32)ctx->args[2];
224+
225+
return probe_entry(&arg, FSMOUNT);
226+
}
227+
228+
SEC("tracepoint/syscalls/sys_exit_fsmount")
229+
int fsmount_exit(struct syscall_trace_exit *ctx)
230+
{
231+
return probe_exit(ctx, (int)ctx->ret);
232+
}
233+
234+
SEC("tracepoint/syscalls/sys_enter_move_mount")
235+
int move_mount_entry(struct syscall_trace_enter *ctx)
236+
{
237+
union sys_arg arg = {};
238+
239+
arg.move_mount.from_dfd = (int)ctx->args[0];
240+
arg.move_mount.from_pathname = (const char *)ctx->args[1];
241+
arg.move_mount.to_dfd = (int)ctx->args[2];
242+
arg.move_mount.to_pathname = (const char *)ctx->args[3];
243+
244+
return probe_entry(&arg, MOVE_MOUNT);
245+
}
246+
247+
SEC("tracepoint/syscalls/sys_exit_move_mount")
248+
int move_mount_exit(struct syscall_trace_exit *ctx)
249+
{
250+
return probe_exit(ctx, (int)ctx->ret);
251+
}
252+
133253
char LICENSE[] SEC("license") = "Dual BSD/GPL";

0 commit comments

Comments
 (0)