search

elastic / ebpf

Elastic's eBPF
Other
62 stars 11 forks source link

EventProbe: capture file info from inode #178

Closed mmat11 closed 10 months ago

mmat11 commented 11 months ago

tested manually (eventstrace):

{"event_type":"FILE_CREATE","pids":{"tid":3874,"tgid":3813,"ppid":2956,"pgid":2956,"sid":2956,"start_time_ns":50065645985},"mount_namespace":4026531841,"comm":"Cache2 I/O","file_info":{"type":"FILE","inode":48667076,"mode":100600,"size":0,"uid":1000,"gid":1000,"mtime":493949622,"ctime":493949622},"path":"/home/matt/.cache/mozilla/firefox/lpqgi4lp.default-release/cache2/entries/080AE6076F29C7973BFF7A893740046655644EBE","symlink_target_path":""}
{"event_type":"FILE_DELETE","pids":{"tid":777527,"tgid":777527,"ppid":13733,"pgid":777527,"sid":777527,"start_time_ns":181390102798979},"mount_namespace":4026531841,"comm":"zsh","file_info":{"type":"SYMLINK","inode":48667077,"mode":120777,"size":23,"uid":1000,"gid":1000,"mtime":773993000,"ctime":774993006},"path":"/home/matt/.zsh_history.LOCK","symlink_target_path":""}
{"event_type":"FILE_DELETE","pids":{"tid":979918,"tgid":979918,"ppid":777527,"pgid":979918,"sid":777527,"start_time_ns":231767498246356},"mount_namespace":4026531841,"comm":"rm","file_info":{"type":"SYMLINK","inode":6706,"mode":120777,"size":11,"uid":1000,"gid":1000,"mtime":241817035,"ctime":776993018},"path":"/tmp/ciao124","symlink_target_path":"/tmp/ciao123"}

draft: this temporarily reintroduces this bug: https://github.com/elastic/ebpf/commit/039ceef2f91a1c667319a211830692b487c1cda2 ; can be merged after I find a workaround edit: veristat is succesful on both elastic/ebpf and elastic/ebpfevents compiled probes, the problem was probably caused by the previous usage of the (old) FUNC_ARG_READ_PTREGS; tldr: this is good to go