commit 7deffaacca17361b7e1770ce2522ab3e6b29fe6f · patrick.sirref.org/opentrace

.dockerignore

···

       1
       +
       .git

     

       2
       +
       _build

+23

Dockerfile

···

       1
       +
       FROM ocaml/opam:alpine-ocaml-5.3 as build

     

       2
       +
       

     

       3
       +
       RUN sudo apk add --no-cache \

     

       4
       +
         build-base \

     

       5
       +
         git \

     

       6
       +
         pkgconf \

     

       7
       +
         clang \

     

       8
       +
         libffi-dev \

     

       9
       +
         libbpf-dev \

     

       10
       +
         musl-dev

     

       11
       +
       

     

       12
       +
       WORKDIR /src

     

       13
       +
       

     

       14
       +
       COPY opentrace.opam /src

     

       15
       +
       RUN opam install . --deps-only

     

       16
       +
       

     

       17
       +
       COPY . /src

     

       18
       +
       RUN git apply static.patch

     

       19
       +
       RUN opam exec -- dune build --profile=release

     

       20
       +
       

     

       21
       +
       FROM alpine

     

       22
       +
       COPY --from=build /src/_build/default/install/opentrace /opentrace

     

       23
       +

dune

···

       1
        
       (executable

     

       2
        
        (name opentrace)

     

       0
        
       
     

       0
        
       
     

       3
        
        (libraries unix libbpf libbpf_maps))

     

       4
        
       

     

       5
        
       (rule

···

       1
        
       (executable

     

       2
        
        (name opentrace)

     

       3
       +
        (public_name opentrace)

     

       4
       +
        (flags (:standard -cclib -static -cclib -no-pie))

     

       5
        
        (libraries unix libbpf libbpf_maps))

     

       6
        
       

     

       7
        
       (rule

+64 -1

opentrace.bpf.c

···

       12
        
       

     

       13
        
       #define FILE_NAME_LEN 1024

     

       14
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       15
        
       // An open event

     

       16
        
       struct open_event

     

       17
        
       {

     

       18
        
         uint32_t  e_pid;

     

       0
        
       
     

       19
        
         int       e_flags;

     

       20
        
         uint32_t  e_mode;

     

       21
        
         char      e_filename[FILE_NAME_LEN];

     
···

       38
        
               return false;

     

       39
        
       

     

       40
        
       	// Fill the open event

     

       41
       -
       	oet->e_pid = bpf_get_current_pid_tgid();

     

       0
        
       
     

       42
        
       	oet->e_flags = (int)ctx->args[2];

     

       43
        
       	oet->e_mode = (__u32)ctx->args[3];

     

       44
        
       	bpf_probe_read(oet->e_filename, sizeof(filename), (char *) ctx->args[1]);

     
···

       47
        
           return 0;

     

       48
        
       }

     

       49
        
       

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       12
        
       

     

       13
        
       #define FILE_NAME_LEN 1024

     

       14
        
       

     

       15
       +
       #define OPEN_KIND 0

     

       16
       +
       #define OPENAT_KIND 1

     

       17
       +
       #define OPENAT2_KIND 2

     

       18
       +
       

     

       19
        
       // An open event

     

       20
        
       struct open_event

     

       21
        
       {

     

       22
        
         uint32_t  e_pid;

     

       23
       +
         int       e_kind;

     

       24
        
         int       e_flags;

     

       25
        
         uint32_t  e_mode;

     

       26
        
         char      e_filename[FILE_NAME_LEN];

     
···

       43
        
               return false;

     

       44
        
       

     

       45
        
       	// Fill the open event

     

       46
       +
       	oet->e_pid = id;

     

       47
       +
       	oet->e_kind = OPENAT_KIND;

     

       48
        
       	oet->e_flags = (int)ctx->args[2];

     

       49
        
       	oet->e_mode = (__u32)ctx->args[3];

     

       50
        
       	bpf_probe_read(oet->e_filename, sizeof(filename), (char *) ctx->args[1]);

     
···

       53
        
           return 0;

     

       54
        
       }

     

       55
        
       

     

       56
       +
       SEC("tracepoint/syscalls/sys_enter_openat2")

     

       57
       +
       int tracepoint__syscalls__sys_enter_openat2(struct trace_event_raw_sys_enter* ctx)

     

       58
       +
       {

     

       59
       +
           u64 id = bpf_get_current_pid_tgid();

     

       60
       +
           u32 pid = id >> 32;

     

       61
       +
           

     

       62
       +
       	char filename[FILE_NAME_LEN];

     

       63
       +
       	struct open_event *oet;

     

       64
       +
       

     

       65
       +
       	oet = bpf_ringbuf_reserve(&rb, sizeof(struct open_event), 0);

     

       66
       +
       	if (!oet)

     

       67
       +
       		return 0;

     

       68
       +
       

     

       69
       +
           if (pid_target && pid_target != pid)

     

       70
       +
               return false;

     

       71
       +
       

     

       72
       +
           struct open_how how = {};

     

       73
       +
       	bpf_probe_read_user(&how, sizeof(how), (void *)ctx->args[2]);

     

       74
       +
       	oet->e_flags = (int)how.flags;

     

       75
       +
       	oet->e_mode = (__u32)how.mode;

     

       76
       +
       	oet->e_kind = OPENAT2_KIND;

     

       77
       +
       	// Fill the open event

     

       78
       +
       	oet->e_pid = id;

     

       79
       +
       	

     

       80
       +
       	bpf_probe_read(oet->e_filename, sizeof(filename), (char *) ctx->args[1]);

     

       81
       +
       	

     

       82
       +
       	bpf_ringbuf_submit(oet, 0);

     

       83
       +
           return 0;

     

       84
       +
       }

     

       85
       +
       

     

       86
       +
       SEC("tracepoint/syscalls/sys_enter_open")

     

       87
       +
       int tracepoint__syscalls__sys_enter_open(struct trace_event_raw_sys_enter* ctx)

     

       88
       +
       {

     

       89
       +
           u64 id = bpf_get_current_pid_tgid();

     

       90
       +
           u32 pid = id >> 32;

     

       91
       +
           

     

       92
       +
       	char filename[FILE_NAME_LEN];

     

       93
       +
       	struct open_event *oet;

     

       94
       +
       

     

       95
       +
       	oet = bpf_ringbuf_reserve(&rb, sizeof(struct open_event), 0);

     

       96
       +
       	if (!oet)

     

       97
       +
       		return 0;

     

       98
       +
       

     

       99
       +
           if (pid_target && pid_target != pid)

     

       100
       +
               return false;

     

       101
       +
       

     

       102
       +
       	oet->e_flags = (int)ctx->args[2];

     

       103
       +
       	oet->e_mode = (__u32)ctx->args[3];

     

       104
       +
       	oet->e_kind = OPEN_KIND;

     

       105
       +
       	// Fill the open event

     

       106
       +
       	oet->e_pid = id;

     

       107
       +
       	

     

       108
       +
       	bpf_probe_read(oet->e_filename, sizeof(filename), (char *) ctx->args[1]);

     

       109
       +
       	

     

       110
       +
       	bpf_ringbuf_submit(oet, 0);

     

       111
       +
           return 0;

     

       112
       +
       }

+28 -7

opentrace.ml

···

       2
        
       open Libbpf_maps

     

       3
        
       

     

       4
        
       let obj_path = "opentrace.bpf.o"

     

       5
       -
       let program_names = [ "tracepoint__syscalls__sys_enter_openat" ]

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       6
        
       

     

       7
        
       module Open_event = struct

     

       8
        
         open Ctypes

     

       9
        
       

     

       10
        
         type t

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       11
        
       

     

       12
        
         let t : t structure typ = Ctypes.structure "event"

     

       13
        
         let ( -: ) ty label = Ctypes.field t label ty

     

       14
       -
         let pid = int -: "e_pid"

     

       0
        
       
     

       15
        
         let flags = int -: "e_flags"

     

       16
       -
         let mode = int -: "e_mode"

     

       17
        
         let filename = array 256 char -: "e_filename"

     

       18
        
         let () = seal t

     

       19
        
       

     
···

       28
        
             Buffer.contents b

     

       29
        
           with Exit -> Buffer.contents b

     

       30
        
       

     

       31
       -
         let get_pid s = getf s pid

     

       32
        
         let get_flags s = getf s flags

     

       33
       -
         let get_mode s = getf s mode

     

       34
        
         let get_fname s = getf s filename |> char_array_as_string

     

       0
        
       
     

       35
        
       end

     

       36
        
       

     

       37
        
       let () =

     
···

       43
        
           Sys.(set_signal sigterm sig_handler);

     

       44
        
       

     

       45
        
           (* Print header *)

     

       46
       -
           Format.printf "pid,flags,mode,filename\n";

     

       47
        
       

     

       48
        
           let map = Libbpf.bpf_object_find_map_by_name obj "rb" in

     

       49
        
           let callback : RingBuffer.callback =

     

       50
        
            fun _ data _ ->

     

       51
        
             let event = Ctypes.(!@(from_voidp Open_event.t data)) in

     

       52
       -
             Format.printf "%i,%i,%i,\"%s\"\n%!" (Open_event.get_pid event)

     

       0
        
       
     

       53
        
               (Open_event.get_flags event)

     

       54
        
               (Open_event.get_mode event)

     

       55
        
               (Open_event.get_fname event);

···

       2
        
       open Libbpf_maps

     

       3
        
       

     

       4
        
       let obj_path = "opentrace.bpf.o"

     

       5
       +
       

     

       6
       +
       let program_names =

     

       7
       +
         [

     

       8
       +
           "tracepoint__syscalls__sys_enter_openat";

     

       9
       +
           "tracepoint__syscalls__sys_enter_openat2";

     

       10
       +
           "tracepoint__syscalls__sys_enter_open";

     

       11
       +
         ]

     

       12
        
       

     

       13
        
       module Open_event = struct

     

       14
        
         open Ctypes

     

       15
        
       

     

       16
        
         type t

     

       17
       +
         type kind = Open_ | Openat | Openat2

     

       18
       +
       

     

       19
       +
         let kind_to_string = function

     

       20
       +
           | Open_ -> "open"

     

       21
       +
           | Openat -> "openat"

     

       22
       +
           | Openat2 -> "openat2"

     

       23
       +
       

     

       24
       +
         let kind_of_int = function

     

       25
       +
           | 0 -> Open_

     

       26
       +
           | 1 -> Openat

     

       27
       +
           | 2 -> Openat2

     

       28
       +
           | n -> failwith ("Invalid kind of open syscall: " ^ string_of_int n)

     

       29
        
       

     

       30
        
         let t : t structure typ = Ctypes.structure "event"

     

       31
        
         let ( -: ) ty label = Ctypes.field t label ty

     

       32
       +
         let pid = uint32_t -: "e_pid"

     

       33
       +
         let kind = int -: "e_kind"

     

       34
        
         let flags = int -: "e_flags"

     

       35
       +
         let mode = uint32_t -: "e_mode"

     

       36
        
         let filename = array 256 char -: "e_filename"

     

       37
        
         let () = seal t

     

       38
        
       

     
···

       47
        
             Buffer.contents b

     

       48
        
           with Exit -> Buffer.contents b

     

       49
        
       

     

       50
       +
         let get_pid s = getf s pid |> Unsigned.UInt32.to_int

     

       51
        
         let get_flags s = getf s flags

     

       52
       +
         let get_mode s = getf s mode |> Unsigned.UInt32.to_int

     

       53
        
         let get_fname s = getf s filename |> char_array_as_string

     

       54
       +
         let get_kind s = getf s kind |> kind_of_int

     

       55
        
       end

     

       56
        
       

     

       57
        
       let () =

     
···

       63
        
           Sys.(set_signal sigterm sig_handler);

     

       64
        
       

     

       65
        
           (* Print header *)

     

       66
       +
           Format.printf "pid,kind,flags,mode,filename\n";

     

       67
        
       

     

       68
        
           let map = Libbpf.bpf_object_find_map_by_name obj "rb" in

     

       69
        
           let callback : RingBuffer.callback =

     

       70
        
            fun _ data _ ->

     

       71
        
             let event = Ctypes.(!@(from_voidp Open_event.t data)) in

     

       72
       +
             Format.printf "%i,%s,%i,%i,\"%s\"\n%!" (Open_event.get_pid event)

     

       73
       +
               (Open_event.get_kind event |> Open_event.kind_to_string)

     

       74
        
               (Open_event.get_flags event)

     

       75
        
               (Open_event.get_mode event)

     

       76
        
               (Open_event.get_fname event);

+5 -1

opentrace.opam

···

       9
        
         "dune" {>= "3.17"}

     

       10
        
         "ocaml"

     

       11
        
         "libbpf"

     

       12
       -
         "libbpg_map"

     

       13
        
         "odoc" {with-doc}

     

       14
        
       ]

     

       15
        
       build: [

     
···

       27
        
         ]

     

       28
        
       ]

     

       29
        
       homepage: "https://tangled.sh/@patrick.sirref.org/opentrace"

     

       0
        
       
     

       0
        
       
     

       0
        
       
     

       0

···

       9
        
         "dune" {>= "3.17"}

     

       10
        
         "ocaml"

     

       11
        
         "libbpf"

     

       12
       +
         "libbpf_maps"

     

       13
        
         "odoc" {with-doc}

     

       14
        
       ]

     

       15
        
       build: [

     
···

       27
        
         ]

     

       28
        
       ]

     

       29
        
       homepage: "https://tangled.sh/@patrick.sirref.org/opentrace"

     

       30
       +
       pin-depends:[

     

       31
       +
         [ "libbpf.dev" "git+https://github.com/patricoferris/ocaml-libbpf#alpine" ]

     

       32
       +
         [ "libbpf_maps.dev" "git+https://github.com/patricoferris/ocaml-libbpf#alpine" ]

     

       33
       +
       ]