linux-bpf 工具

zengxiaobai

已于 2022-10-27 20:00:04 修改

阅读量272

点赞数

分类专栏：内核-ebpf 文章标签： linux 运维服务器

于 2022-10-25 14:09:07 首次发布

本文链接：https://blog.csdn.net/qq_39015563/article/details/127512304

版权

内核-ebpf 专栏收录该内容

5 篇文章 0 订阅

订阅专栏

文件删除监控：

#include <linux/sched.h>
#include <linux/dcache.h>
    BEGIN
    {
        printf("%-15s %-10s %-20s %-20s %10s %s\n","TIME", "USERNAME", "PID","COMM", "PPCOMM", "FNAME");
    }
    tracepoint:syscalls:sys_enter_unlinkat,tracepoint:syscalls:sys_enter_unlink
    {
        $pp = curtask->real_parent;
        time("%H:%M:%S\t");
        printf("%-10s %-10u %-10u %-20s %-20s %s    ",  username, uid, pid, comm,  $pp->comm, str(args->pathname));
        $ppp = $pp->parent;
        printf("%-10s\n", $ppp->comm);
    }

Kprobe 版：

#include <linux/dcache.h>
kprobe:vfs_unlink {
    printf("%-10s %-10u %-10u %-20s %s\n", username, uid, pid, comm, str(((struct dentry *)arg1)->d_name.name))
}

kprobe:vfs_rmdir {
    printf("%-10s %-10u %-10u %-20s %s\n", username, uid, pid, comm, str(((struct dentry *)arg1)->d_name.name))
}

参考：https://blog.51cto.com/helloween/5011426