基于Linux bpf跟踪文件读写

基于Linux bpf跟踪文件读写

一、Ubuntu 20.04环境搭建

[eBPF/Ubuntu 18.04 LTS源码构建bcc.md at master · linuxkerneltravel/eBPF · GitHub](https://github.com/linuxkerneltravel/eBPF/blob/master/Install-BCC/Ubuntu 18.04 LTS源码构建bcc.md)

二、文件打开监控

这里我们监控内核通用块层的vfs_read()函数：

打印打开文件的Pid，inode号，文件名信息。

#!/usr/bin/python
from bcc import BPF

prog = """
    #include <asm/ptrace.h>
    #include <linux/fs.h>

    int trace_vfs_open(struct pt_regs *ctx, const struct path *path, struct file *file)
    {
        char *file_name = NULL;
        u32 pid = bpf_get_current_pid_tgid() >> 32;
        u32 uid = bpf_get_current_uid_gid();

        bpf_trace_printk("%d %d %s\\n", pid, path->dentry->d_inode->i_ino, path->dentry->d_iname);
        return 0;
    }
"""

b = BPF(text = prog)
b.attach_kprobe(event = "vfs_open", fn_name = "trace_vfs_open")

print("%-18s %-16s %-6s %s"%("TIME(s)", "COMM", "PID", "MESSAGE"))

#output
while 1:
    try:
        (task, pid, cpu, flags, ts, msg) = b.trace_fields()
    except ValueError:
        continue
    print("%-18.9f %-16s %-6d %s"%(ts, task, pid, msg))

抓取信息

root@curtis-Aspire-E5-471G:/home/curtis/code/bpf/eBPF-master/write_code# ./trace_open.py
TIME(s)            COMM             PID    MESSAGE
19160.428362000    trace_open.py    13025  13025 3015816 trace_open.py
19160.428453000    trace_open.py    13025  13025 1974484 __init__.py
19160.429079000    trace_open.py    13025  13025 1974484 __init__.py

三、文件读监控

这里我们监控内核通用块层的vfs_open()函数：

#!/usr/bin/python
from bcc import BPF

prog = """
    #include <asm/ptrace.h>
    #include <linux/fs.h>

    int trace_vfs_open(struct pt_regs *ctx, struct file *file, char __user *buf, size_t count, loff_t *pos)
    {
        u32 pid = bpf_get_current_pid_tgid() >> 32;
        u32 uid = bpf_get_current_uid_gid();

        bpf_trace_printk("%d %d %s\\n", pid, file->f_inode->i_ino, file->f_path.dentry->d_iname);
        return 0;
    }
"""

b = BPF(text = prog)
b.attach_kprobe(event = "vfs_read", fn_name = "trace_vfs_open")

print("%-18s %-16s %-6s %s"%("TIME(s)", "COMM", "PID", "MESSAGE"))

#output
while 1:
    try:
        (task, pid, cpu, flags, ts, msg) = b.trace_fields()
    except ValueError:
        continue
    print("%-18.9f %-16s %-6d %s"%(ts, task, pid, msg))

抓取信息

19768.367784000    polkitd          668    668 2254 1000
19768.367893000    polkitd          668    668 11799035 passwd
19768.367991000    polkitd          668    668 11796553 group
19768.368283000    polkitd          668    668 285 userdb

三、文件写监控

#!/usr/bin/python
from bcc import BPF

prog = """
    #include <asm/ptrace.h>
    #include <linux/fs.h>

    int trace_vfs_write(struct pt_regs *ctx, struct file *file, const char __user *buf, size_t count, loff_t *pos)
    {
        u32 pid = bpf_get_current_pid_tgid() >> 32;
        u32 uid = bpf_get_current_uid_gid();

        bpf_trace_printk("%d %d %s\\n", pid, file->f_inode->i_ino, file->f_path.dentry->d_iname);
        return 0;
    }
"""

b = BPF(text = prog)
b.attach_kprobe(event = "vfs_write", fn_name = "trace_vfs_write")

print("%-18s %-16s %-6s %s"%("TIME(s)", "COMM", "PID", "MESSAGE"))

#output
while 1:
    try:
        (task, pid, cpu, flags, ts, msg) = b.trace_fields()
    except ValueError:
        continue
    print("%-18.9f %-16s %-6d %s"%(ts, task, pid, msg))

抓取信息

20069.360673000    trace_write.py   13078  13078 4 1
20069.360719000    trace_write.py   13078  13078 4 1
20069.360722000    sshd             4546   4546 178514 TCP
20069.360761000    sshd             4546   4546 178514 TCP