使用bpftool将eBPF程序attach到某个tracepoint上

代码 

#include <vmlinux.h>
#include <bpf/bpf_helpers.h>

/// @description "Process ID to trace"
const volatile int pid_target = 0;

SEC("tracepoint/syscalls/sys_enter_openat")
int tracepoint__syscalls__sys_enter_openat(struct trace_event_raw_sys_enter* ctx)
{
 u64 id = bpf_get_current_pid_tgid();
 u32 pid = id;

 if (pid_target && pid_target != pid)
  return false;
 // Use bpf_printk to print the process information
 bpf_printk("Process ID: %d enter sys openat\n", pid);
 return 0;
}

/// "Trace open family syscalls."

TARGETS = ps_open_file

all: $(TARGETS)
.PHONY: all

$(TARGETS): %: %.bpf.o

%.bpf.o: %.bpf.c
        clang \
            -target bpf \
                -I/usr/include/$(shell uname -m)-linux-gnu \
                -g \
            -O2 -o $@ -c $<

clean: 
        - rm *.bpf.o
        - rm -f /sys/fs/bpf/ps_open_file

命令行

make
sudo bpftool prog load ps_open_file.bpf.o /sys/fs/bpf/ps_open_file autoattach
sudo bpftool prog  tracelog | grep bpf_trace_printk