commit 30dcc2f4f54a3f7dc470c1a8801312d251673530 · patrick.sirref.org/opentrace

+4

.gitignore

+1

.ocamlformat

···

       0

···

       1
       +
       version=0.27.0

+4

README.md

···

       1
       +
       opentrace

     

       2
       +
       ---------

     

       3
       +
       

     

       4
       +
       Tracing open-like syscalls using eBPF via OCaml.

+26

dune

···

       1
       +
       (executable

     

       2
       +
        (name opentrace)

     

       3
       +
        (libraries unix libbpf libbpf_maps))

     

       4
       +
       

     

       5
       +
       (rule

     

       6
       +
        (mode

     

       7
       +
         (promote (until-clean)))

     

       8
       +
        (targets opentrace.bpf.o)

     

       9
       +
        (deps arch opentrace.bpf.c)

     

       10
       +
        (action

     

       11
       +
         (system

     

       12
       +
          "NIX_HARDENING_ENABLE=\"\" clang -g -O2 -target bpf -I/usr/include/%{architecture}-linux-gnu/ -c opentrace.bpf.c -D__TARGET_ARCH_%{read:arch}")))

     

       13
       +
       

     

       14
       +
       (rule

     

       15
       +
        (mode

     

       16
       +
         (promote (until-clean)))

     

       17
       +
        (targets vmlinux.h arch)

     

       18
       +
        (action

     

       19
       +
         (progn

     

       20
       +
          (with-stdout-to

     

       21
       +
           vmlinux.h

     

       22
       +
           (run bpftool btf dump file /sys/kernel/btf/vmlinux format c))

     

       23
       +
          (with-stdout-to

     

       24
       +
           arch

     

       25
       +
           (bash

     

       26
       +
            "uname -m | sed 's/x86_64/x86/' | sed 's/arm.*/arm/' | sed 's/aarch64/arm64/' | sed 's/ppc64le/powerpc/' | sed 's/mips.*/mips/' | sed 's/riscv64/riscv/' | sed 's/loongarch64/loongarch/'")))))

+3

dune-project

···

       1
       +
       (lang dune 3.14)

     

       2
       +
       

     

       3
       +
       (name opentrace)

+49

opentrace.bpf.c

···

       1
       +
       #include "vmlinux.h"

     

       2
       +
       #include <bpf/bpf_helpers.h>

     

       3
       +
       

     

       4
       +
       char LICENSE[] SEC("license") = "Dual BSD/GPL";

     

       5
       +
       

     

       6
       +
       const volatile int pid_target = 0;

     

       7
       +
       

     

       8
       +
       struct {

     

       9
       +
       	__uint(type, BPF_MAP_TYPE_RINGBUF);

     

       10
       +
       	__uint(max_entries, 256 * 1024);

     

       11
       +
       } rb SEC(".maps");

     

       12
       +
       

     

       13
       +
       #define FILE_NAME_LEN 1024

     

       14
       +
       

     

       15
       +
       // An open event

     

       16
       +
       struct open_event

     

       17
       +
       {

     

       18
       +
         uint32_t  e_pid;

     

       19
       +
         int       e_flags;

     

       20
       +
         uint32_t  e_mode;

     

       21
       +
         char      e_filename[FILE_NAME_LEN];

     

       22
       +
       };

     

       23
       +
       

     

       24
       +
       SEC("tracepoint/syscalls/sys_enter_openat")

     

       25
       +
       int tracepoint__syscalls__sys_enter_openat(struct trace_event_raw_sys_enter* ctx)

     

       26
       +
       {

     

       27
       +
           u64 id = bpf_get_current_pid_tgid();

     

       28
       +
           u32 pid = id >> 32;

     

       29
       +
           

     

       30
       +
       	char filename[FILE_NAME_LEN];

     

       31
       +
       	struct open_event *oet;

     

       32
       +
       

     

       33
       +
       	oet = bpf_ringbuf_reserve(&rb, sizeof(struct open_event), 0);

     

       34
       +
       	if (!oet)

     

       35
       +
       		return 0;

     

       36
       +
       

     

       37
       +
           if (pid_target && pid_target != pid)

     

       38
       +
               return false;

     

       39
       +
       

     

       40
       +
       	// Fill the open event

     

       41
       +
       	oet->e_pid = bpf_get_current_pid_tgid();

     

       42
       +
       	oet->e_flags = (int)ctx->args[2];

     

       43
       +
       	oet->e_mode = (__u32)ctx->args[3];

     

       44
       +
       	bpf_probe_read(oet->e_filename, sizeof(filename), (char *) ctx->args[1]);

     

       45
       +
       	

     

       46
       +
       	bpf_ringbuf_submit(oet, 0);

     

       47
       +
           return 0;

     

       48
       +
       }

     

       49
       +

+65

opentrace.ml

···

       1
       +
       open Libbpf

     

       2
       +
       open Libbpf_maps

     

       3
       +
       

     

       4
       +
       let obj_path = "opentrace.bpf.o"

     

       5
       +
       let program_names = [ "tracepoint__syscalls__sys_enter_openat" ]

     

       6
       +
       

     

       7
       +
       module Open_event = struct

     

       8
       +
         open Ctypes

     

       9
       +
       

     

       10
       +
         type t

     

       11
       +
       

     

       12
       +
         let t : t structure typ = Ctypes.structure "event"

     

       13
       +
         let ( -: ) ty label = Ctypes.field t label ty

     

       14
       +
         let pid = int -: "e_pid"

     

       15
       +
         let flags = int -: "e_flags"

     

       16
       +
         let mode = int -: "e_mode"

     

       17
       +
         let filename = array 256 char -: "e_filename"

     

       18
       +
         let () = seal t

     

       19
       +
       

     

       20
       +
         let char_array_as_string a =

     

       21
       +
           let len = CArray.length a in

     

       22
       +
           let b = Buffer.create len in

     

       23
       +
           try

     

       24
       +
             for i = 0 to len - 1 do

     

       25
       +
               let c = CArray.get a i in

     

       26
       +
               if c = '\x00' then raise Exit else Buffer.add_char b c

     

       27
       +
             done;

     

       28
       +
             Buffer.contents b

     

       29
       +
           with Exit -> Buffer.contents b

     

       30
       +
       

     

       31
       +
         let get_pid s = getf s pid

     

       32
       +
         let get_flags s = getf s flags

     

       33
       +
         let get_mode s = getf s mode

     

       34
       +
         let get_fname s = getf s filename |> char_array_as_string

     

       35
       +
       end

     

       36
       +
       

     

       37
       +
       let () =

     

       38
       +
         let bpf_callback obj _links =

     

       39
       +
           (* Set signal handlers *)

     

       40
       +
           let exitting = ref true in

     

       41
       +
           let sig_handler = Sys.Signal_handle (fun _ -> exitting := false) in

     

       42
       +
           Sys.(set_signal sigint sig_handler);

     

       43
       +
           Sys.(set_signal sigterm sig_handler);

     

       44
       +
       

     

       45
       +
           (* Print header *)

     

       46
       +
           Format.printf "pid,flags,mode,filename\n";

     

       47
       +
       

     

       48
       +
           let map = Libbpf.bpf_object_find_map_by_name obj "rb" in

     

       49
       +
           let callback : RingBuffer.callback =

     

       50
       +
            fun _ data _ ->

     

       51
       +
             let event = Ctypes.(!@(from_voidp Open_event.t data)) in

     

       52
       +
             Format.printf "%i,%i,%i,\"%s\"\n%!" (Open_event.get_pid event)

     

       53
       +
               (Open_event.get_flags event)

     

       54
       +
               (Open_event.get_mode event)

     

       55
       +
               (Open_event.get_fname event);

     

       56
       +
             0

     

       57
       +
           in

     

       58
       +
           RingBuffer.init map ~callback @@ fun rb ->

     

       59
       +
           while !exitting do

     

       60
       +
             Unix.sleepf 1.0;

     

       61
       +
             let _ : int = RingBuffer.poll rb ~timeout:1 in

     

       62
       +
             ()

     

       63
       +
           done

     

       64
       +
         in

     

       65
       +
         with_bpf_object_open_load_link ~obj_path ~program_names bpf_callback

+29

opentrace.opam

···

       1
       +
       opam-version: "2.0"

     

       2
       +
       synopsis: "Trace the opening of files"

     

       3
       +
       description: "A linux tool using eBPF for tracing calls to open files"

     

       4
       +
       maintainer: ["Patrick Ferris <patrick@sirref.org>"]

     

       5
       +
       authors: ["Patrick Ferris <patrick@sirref.org>"]

     

       6
       +
       license: "MIT"

     

       7
       +
       homepage: "https://tangled.sh/@patrick.sirref.org/opentrace"

     

       8
       +
       depends: [

     

       9
       +
         "dune" {>= "3.17"}

     

       10
       +
         "ocaml"

     

       11
       +
         "libbpf"

     

       12
       +
         "libbpg_map"

     

       13
       +
         "odoc" {with-doc}

     

       14
       +
       ]

     

       15
       +
       build: [

     

       16
       +
         ["dune" "subst"] {dev}

     

       17
       +
         [

     

       18
       +
           "dune"

     

       19
       +
           "build"

     

       20
       +
           "-p"

     

       21
       +
           name

     

       22
       +
           "-j"

     

       23
       +
           jobs

     

       24
       +
           "@install"

     

       25
       +
           "@runtest" {with-test}

     

       26
       +
           "@doc" {with-doc}

     

       27
       +
         ]

     

       28
       +
       ]

     

       29
       +
       homepage: "https://tangled.sh/@patrick.sirref.org/opentrace"