runtime/agent: implement detaching - Githubissues

eunomia-bpf / bpftime

Userspace eBPF runtime for fast Uprobe & Syscall hook & Extensions with LLVM JIT

https://eunomia.dev/bpftime/

MIT License

687 stars 68 forks source link

runtime/agent: implement detaching #264

Closed Officeyutong closed 3 months ago

Officeyutong commented 3 months ago

Closes #261

Why?

We need a way to revert remote injected attaches

What to do:

Agent should revert any attached entries when received SIGUSR1
After that, agent should unload itself from the injected process, i.e unload the shared object from the memory space of the injected process
Add subcommand detach for bpftime cli

How to implement?

Every agent instance stores its pid into shared memory, if it was injected through frida
Agent would register signal handler for SIGUSR1, and will call bpf_attach_ctx::destroy_all_attach_links to perform detach
When we run bpftime detach, it reads all pids that was stored in the shared memory, and sends SIGUSR1 to them

Known bugs:

We can't unload the injected agent library. A shared object can't unload itself in its code