Skip to content

Commit df76fa1

Browse files
geyslanrafaeldtinoco
geyslan
authored and
rafaeldtinoco
committed
ebpf: standardize and reorder syscall names
Order syscalls as in: - https://cs.opensource.google/go/x/sys/+/master:unix/zsysnum_linux_amd64.go Prefixing them with SYSCALL instead of SYS can avoid conflicts with kernel headers.
1 parent eef81b1 commit df76fa1

File tree

1 file changed

+232
-57
lines changed

1 file changed

+232
-57
lines changed

‎pkg/ebpf/c/tracee.bpf.c‎

Lines changed: 232 additions & 57 deletions
Original file line numberDiff line numberDiff line change
@@ -147,47 +147,220 @@ enum argument_type_e
147147
#define UNDEFINED_SYSCALL 1000
148148

149149
#if defined(bpf_target_x86)
150-
#define SYS_MMAP 9
151-
#define SYS_MPROTECT 10
152-
#define SYS_RT_SIGRETURN 15
153-
#define SYS_EXECVE 59
154-
#define SYS_EXIT 60
155-
#define SYS_EXIT_GROUP 231
156-
#define SYS_EXECVEAT 322
157-
#define SYSCALL_CONNECT 42
158-
#define SYSCALL_ACCEPT 43
159-
#define SYSCALL_ACCEPT4 288
160-
#define SYSCALL_LISTEN 50
161-
#define SYSCALL_BIND 49
162-
#define SYSCALL_SOCKET 41
163-
#define SYSC_SETSOCKOPT 54
164-
#define SYS_DUP 32
165-
#define SYS_DUP2 33
166-
#define SYS_DUP3 292
167-
#define SYS_OPEN 2
168-
#define SYS_OPENAT 257
169-
#define SYS_OPENAT2 437
150+
#define SYSCALL_READ 0
151+
#define SYSCALL_WRITE 1
152+
#define SYSCALL_OPEN 2
153+
#define SYSCALL_CLOSE 3
154+
#define SYSCALL_FSTAT 5
155+
#define SYSCALL_LSEEK 8
156+
#define SYSCALL_MMAP 9
157+
#define SYSCALL_MPROTECT 10
158+
#define SYSCALL_RT_SIGRETURN 15
159+
#define SYSCALL_IOCTL 16
160+
#define SYSCALL_PREAD64 17
161+
#define SYSCALL_PWRITE64 18
162+
#define SYSCALL_READV 19
163+
#define SYSCALL_WRITEV 20
164+
#define SYSCALL_DUP 32
165+
#define SYSCALL_DUP2 33
166+
#define SYSCALL_SOCKET 41
167+
#define SYSCALL_CONNECT 42
168+
#define SYSCALL_ACCEPT 43
169+
#define SYSCALL_SENDTO 44
170+
#define SYSCALL_RECVFROM 45
171+
#define SYSCALL_SENDMSG 46
172+
#define SYSCALL_RECVMSG 47
173+
#define SYSCALL_SHUTDOWN 48
174+
#define SYSCALL_BIND 49
175+
#define SYSCALL_LISTEN 50
176+
#define SYSCALL_GETSOCKNAME 51
177+
#define SYSCALL_GETPEERNAME 52
178+
#define SYSCALL_SETSOCKOPT 54
179+
#define SYSCALL_GETSOCKOPT 55
180+
#define SYSCALL_EXECVE 59
181+
#define SYSCALL_EXIT 60
182+
#define SYSCALL_FCNTL 72
183+
#define SYSCALL_FLOCK 73
184+
#define SYSCALL_FSYNC 74
185+
#define SYSCALL_FDATASYNC 75
186+
#define SYSCALL_FTRUNCATE 77
187+
#define SYSCALL_GETDENTS 78
188+
#define SYSCALL_FCHDIR 81
189+
#define SYSCALL_FCHMOD 91
190+
#define SYSCALL_FCHOWN 93
191+
#define SYSCALL_FSTATFS 138
192+
#define SYSCALL_READAHEAD 187
193+
#define SYSCALL_FSETXATTR 190
194+
#define SYSCALL_FGETXATTR 193
195+
#define SYSCALL_FLISTXATTR 196
196+
#define SYSCALL_FREMOVEXATTR 199
197+
#define SYSCALL_GETDENTS64 217
198+
#define SYSCALL_FADVISE64 221
199+
#define SYSCALL_EXIT_GROUP 231
200+
#define SYSCALL_EPOLL_WAIT 232
201+
#define SYSCALL_EPOLL_CTL 233
202+
#define SYSCALL_INOTIFY_ADD_WATCH 254
203+
#define SYSCALL_INOTIFY_RM_WATCH 255
204+
#define SYSCALL_OPENAT 257
205+
#define SYSCALL_MKDIRAT 258
206+
#define SYSCALL_MKNODAT 259
207+
#define SYSCALL_FCHOWNAT 260
208+
#define SYSCALL_FUTIMESAT 261
209+
#define SYSCALL_NEWFSTATAT 262
210+
#define SYSCALL_UNLINKAT 263
211+
#define SYSCALL_SYMLINKAT 266
212+
#define SYSCALL_READLINKAT 267
213+
#define SYSCALL_FCHMODAT 268
214+
#define SYSCALL_FACCESSAT 269
215+
#define SYSCALL_SYNC_FILE_RANGE 277
216+
#define SYSCALL_VMSPLICE 278
217+
#define SYSCALL_UTIMENSAT 280
218+
#define SYSCALL_EPOLL_PWAIT 281
219+
#define SYSCALL_SIGNALFD 282
220+
#define SYSCALL_FALLOCATE 285
221+
#define SYSCALL_TIMERFD_SETTIME 286
222+
#define SYSCALL_TIMERFD_GETTIME 287
223+
#define SYSCALL_ACCEPT4 288
224+
#define SYSCALL_SIGNALFD4 289
225+
#define SYSCALL_DUP3 292
226+
#define SYSCALL_PREADV 295
227+
#define SYSCALL_PWRITEV 296
228+
#define SYSCALL_PERF_EVENT_OPEN 298
229+
#define SYSCALL_RECVMMSG 299
230+
#define SYSCALL_NAME_TO_HANDLE_AT 303
231+
#define SYSCALL_OPEN_BY_HANDLE_AT 304
232+
#define SYSCALL_SYNCFS 306
233+
#define SYSCALL_SENDMMSG 307
234+
#define SYSCALL_SETNS 308
235+
#define SYSCALL_FINIT_MODULE 313
236+
#define SYSCALL_EXECVEAT 322
237+
#define SYSCALL_PREADV2 327
238+
#define SYSCALL_PWRITEV2 328
239+
#define SYSCALL_STATX 332
240+
#define SYSCALL_PIDFD_SEND_SIGNAL 424
241+
#define SYSCALL_IO_URING_ENTER 426
242+
#define SYSCALL_IO_URING_REGISTER 427
243+
#define SYSCALL_OPEN_TREE 428
244+
#define SYSCALL_FSCONFIG 431
245+
#define SYSCALL_FSMOUNT 432
246+
#define SYSCALL_FSPICK 433
247+
#define SYSCALL_OPENAT2 437
248+
#define SYSCALL_FACCESSAT2 439
249+
#define SYSCALL_PROCESS_MADVISE 440
250+
#define SYSCALL_EPOLL_PWAIT2 441
251+
#define SYSCALL_MOUNT_SETATTR 442
252+
#define SYSCALL_QUOTACTL_FD 443
253+
#define SYSCALL_LANDLOCK_ADD_RULE 445
254+
#define SYSCALL_LANDLOCK_RESTRICT_SELF 446
255+
#define SYSCALL_PROCESS_MRELEASE 448
256+
170257
#elif defined(bpf_target_arm64)
171-
#define SYS_MMAP 222
172-
#define SYS_MPROTECT 226
173-
#define SYS_RT_SIGRETURN 139
174-
#define SYS_EXECVE 221
175-
#define SYS_EXIT 93
176-
#define SYS_EXIT_GROUP 94
177-
#define SYS_EXECVEAT 281
178-
#define SYSCALL_CONNECT 203
179-
#define SYSCALL_ACCEPT 202
180-
#define SYSCALL_ACCEPT4 242
181-
#define SYSCALL_LISTEN 201
182-
#define SYSCALL_BIND 200
183-
#define SYSCALL_SOCKET 198
184-
#define SYSC_SETSOCKOPT 208
185-
#define SYS_DUP 23
186-
#define SYS_DUP2 UNDEFINED_SYSCALL
187-
#define SYS_DUP3 24
188-
#define SYS_OPEN UNDEFINED_SYSCALL
189-
#define SYS_OPENAT 56
190-
#define SYS_OPENAT2 437
258+
#define SYSCALL_READ 63
259+
#define SYSCALL_WRITE 64
260+
#define SYSCALL_OPEN UNDEFINED_SYSCALL
261+
#define SYSCALL_CLOSE 57
262+
#define SYSCALL_FSTAT 80
263+
#define SYSCALL_LSEEK 62
264+
#define SYSCALL_MMAP 222
265+
#define SYSCALL_MPROTECT 226
266+
#define SYSCALL_RT_SIGRETURN 139
267+
#define SYSCALL_IOCTL 29
268+
#define SYSCALL_PREAD64 67
269+
#define SYSCALL_PWRITE64 68
270+
#define SYSCALL_READV 65
271+
#define SYSCALL_WRITEV 66
272+
#define SYSCALL_DUP 23
273+
#define SYSCALL_DUP2 UNDEFINED_SYSCALL
274+
#define SYSCALL_SOCKET 198
275+
#define SYSCALL_CONNECT 203
276+
#define SYSCALL_ACCEPT 202
277+
#define SYSCALL_SENDTO 206
278+
#define SYSCALL_RECVFROM 207
279+
#define SYSCALL_SENDMSG 211
280+
#define SYSCALL_RECVMSG 212
281+
#define SYSCALL_SHUTDOWN 210
282+
#define SYSCALL_BIND 200
283+
#define SYSCALL_LISTEN 201
284+
#define SYSCALL_GETSOCKNAME 204
285+
#define SYSCALL_GETPEERNAME 205
286+
#define SYSCALL_SETSOCKOPT 208
287+
#define SYSCALL_GETSOCKOPT 209
288+
#define SYSCALL_EXECVE 221
289+
#define SYSCALL_EXIT 93
290+
#define SYSCALL_FCNTL 25
291+
#define SYSCALL_FLOCK 32
292+
#define SYSCALL_FSYNC 82
293+
#define SYSCALL_FDATASYNC 83
294+
#define SYSCALL_FTRUNCATE 46
295+
#define SYSCALL_GETDENTS UNDEFINED_SYSCALL
296+
#define SYSCALL_FCHDIR 50
297+
#define SYSCALL_FCHMOD 52
298+
#define SYSCALL_FCHOWN 55
299+
#define SYSCALL_FSTATFS 44
300+
#define SYSCALL_READAHEAD 213
301+
#define SYSCALL_FSETXATTR 7
302+
#define SYSCALL_FGETXATTR 10
303+
#define SYSCALL_FLISTXATTR 13
304+
#define SYSCALL_FREMOVEXATTR 16
305+
#define SYSCALL_GETDENTS64 61
306+
#define SYSCALL_FADVISE64 223
307+
#define SYSCALL_EXIT_GROUP 94
308+
#define SYSCALL_EPOLL_WAIT UNDEFINED_SYSCALL
309+
#define SYSCALL_EPOLL_CTL 21
310+
#define SYSCALL_INOTIFY_ADD_WATCH 27
311+
#define SYSCALL_INOTIFY_RM_WATCH 28
312+
#define SYSCALL_OPENAT 56
313+
#define SYSCALL_MKDIRAT 34
314+
#define SYSCALL_MKNODAT 33
315+
#define SYSCALL_FCHOWNAT 54
316+
#define SYSCALL_FUTIMESAT UNDEFINED_SYSCALL
317+
#define SYSCALL_NEWFSTATAT UNDEFINED_SYSCALL
318+
#define SYSCALL_UNLINKAT 35
319+
#define SYSCALL_SYMLINKAT 36
320+
#define SYSCALL_READLINKAT 78
321+
#define SYSCALL_FCHMODAT 53
322+
#define SYSCALL_FACCESSAT 48
323+
#define SYSCALL_SYNC_FILE_RANGE 84
324+
#define SYSCALL_VMSPLICE 75
325+
#define SYSCALL_UTIMENSAT 88
326+
#define SYSCALL_EPOLL_PWAIT 22
327+
#define SYSCALL_SIGNALFD UNDEFINED_SYSCALL
328+
#define SYSCALL_FALLOCATE 47
329+
#define SYSCALL_TIMERFD_SETTIME 86
330+
#define SYSCALL_TIMERFD_GETTIME 87
331+
#define SYSCALL_ACCEPT4 242
332+
#define SYSCALL_SIGNALFD4 74
333+
#define SYSCALL_DUP3 24
334+
#define SYSCALL_PREADV 69
335+
#define SYSCALL_PWRITEV 70
336+
#define SYSCALL_PERF_EVENT_OPEN 241
337+
#define SYSCALL_RECVMMSG 243
338+
#define SYSCALL_NAME_TO_HANDLE_AT 264
339+
#define SYSCALL_OPEN_BY_HANDLE_AT 265
340+
#define SYSCALL_SYNCFS 267
341+
#define SYSCALL_SENDMMSG 269
342+
#define SYSCALL_SETNS 268
343+
#define SYSCALL_FINIT_MODULE 273
344+
#define SYSCALL_EXECVEAT 281
345+
#define SYSCALL_PREADV2 286
346+
#define SYSCALL_PWRITEV2 287
347+
#define SYSCALL_STATX 291
348+
#define SYSCALL_PIDFD_SEND_SIGNAL 424
349+
#define SYSCALL_IO_URING_ENTER 426
350+
#define SYSCALL_IO_URING_REGISTER 427
351+
#define SYSCALL_OPEN_TREE 428
352+
#define SYSCALL_FSCONFIG 431
353+
#define SYSCALL_FSMOUNT 432
354+
#define SYSCALL_FSPICK 433
355+
#define SYSCALL_OPENAT2 437
356+
#define SYSCALL_FACCESSAT2 439
357+
#define SYSCALL_PROCESS_MADVISE 440
358+
#define SYSCALL_EPOLL_PWAIT2 441
359+
#define SYSCALL_MOUNT_SETATTR 442
360+
#define SYSCALL_QUOTACTL_FD 443
361+
#define SYSCALL_LANDLOCK_ADD_RULE 445
362+
#define SYSCALL_LANDLOCK_RESTRICT_SELF 446
363+
#define SYSCALL_PROCESS_MRELEASE 448
191364
#endif
192365

193366
enum event_id_e
@@ -2517,10 +2690,11 @@ int tracepoint__raw_syscalls__sys_enter(struct bpf_raw_tracepoint_args *ctx)
25172690
}
25182691

25192692
// exit, exit_group and rt_sigreturn syscalls don't return
2520-
if (sys->id != SYS_EXIT && sys->id != SYS_EXIT_GROUP && sys->id != SYS_RT_SIGRETURN) {
2693+
if (sys->id != SYSCALL_EXIT && sys->id != SYSCALL_EXIT_GROUP &&
2694+
sys->id != SYSCALL_RT_SIGRETURN) {
25212695
sys->ts = data.context.ts;
25222696
data.task_info->syscall_traced = true;
2523-
} else if ((sys->id != SYS_RT_SIGRETURN) && (should_submit(sys->id, data.config))) {
2697+
} else if ((sys->id != SYSCALL_RT_SIGRETURN) && (should_submit(sys->id, data.config))) {
25242698
data.buf_off = sizeof(event_context_t);
25252699
data.context.argnum = 0;
25262700
save_to_submit_buf(&data, &sys->args.args[0], sizeof(int), 0);
@@ -2580,8 +2754,8 @@ int tracepoint__raw_syscalls__sys_exit(struct bpf_raw_tracepoint_args *ctx)
25802754
goto out;
25812755
}
25822756
types = *saved_types;
2583-
if ((id != SYS_EXECVE && id != SYS_EXECVEAT) ||
2584-
((id == SYS_EXECVE || id == SYS_EXECVEAT) && (ret != 0))) {
2757+
if ((id != SYSCALL_EXECVE && id != SYSCALL_EXECVEAT) ||
2758+
((id == SYSCALL_EXECVE || id == SYSCALL_EXECVEAT) && (ret != 0))) {
25852759
// We can't use saved args after execve syscall, as pointers are
25862760
// invalid To avoid showing execve event both on entry and exit, we
25872761
// only output failed execs
@@ -2613,7 +2787,7 @@ int syscall__execve(void *ctx)
26132787
return -1;
26142788
syscall_data_t *sys = &data.task_info->syscall_data;
26152789

2616-
if (!should_submit(SYS_EXECVE, data.config))
2790+
if (!should_submit(SYSCALL_EXECVE, data.config))
26172791
return 0;
26182792

26192793
save_str_to_buf(&data, (void *) sys->args.args[0] /*filename*/, 0);
@@ -2622,7 +2796,7 @@ int syscall__execve(void *ctx)
26222796
save_str_arr_to_buf(&data, (const char *const *) sys->args.args[2] /*envp*/, 2);
26232797
}
26242798

2625-
return events_perf_submit(&data, SYS_EXECVE, 0);
2799+
return events_perf_submit(&data, SYSCALL_EXECVE, 0);
26262800
}
26272801

26282802
SEC("raw_tracepoint/sys_execveat")
@@ -2636,7 +2810,7 @@ int syscall__execveat(void *ctx)
26362810
return -1;
26372811
syscall_data_t *sys = &data.task_info->syscall_data;
26382812

2639-
if (!should_submit(SYS_EXECVEAT, data.config))
2813+
if (!should_submit(SYSCALL_EXECVEAT, data.config))
26402814
return 0;
26412815

26422816
save_to_submit_buf(&data, (void *) &sys->args.args[0] /*dirfd*/, sizeof(int), 0);
@@ -2647,7 +2821,7 @@ int syscall__execveat(void *ctx)
26472821
}
26482822
save_to_submit_buf(&data, (void *) &sys->args.args[4] /*flags*/, sizeof(int), 4);
26492823

2650-
return events_perf_submit(&data, SYS_EXECVEAT, 0);
2824+
return events_perf_submit(&data, SYSCALL_EXECVEAT, 0);
26512825
}
26522826

26532827
static __always_inline int send_socket_dup(event_data_t *data, u64 oldfd, u64 newfd)
@@ -2722,11 +2896,11 @@ int sys_dup_exit_tail(void *ctx)
27222896
return 0;
27232897
}
27242898

2725-
if (sys->id == SYS_DUP) {
2899+
if (sys->id == SYSCALL_DUP) {
27262900
// args.args[0]: oldfd
27272901
// retval: newfd
27282902
send_socket_dup(&data, sys->args.args[0], sys->ret);
2729-
} else if (sys->id == SYS_DUP2 || sys->id == SYS_DUP3) {
2903+
} else if (sys->id == SYSCALL_DUP2 || sys->id == SYSCALL_DUP3) {
27302904
// args.args[0]: oldfd
27312905
// args.args[1]: newfd
27322906
// retval: retval
@@ -3367,11 +3541,11 @@ int BPF_KPROBE(trace_security_file_open)
33673541
if (syscall_traced) {
33683542
sys = &data.task_info->syscall_data;
33693543
switch (sys->id) {
3370-
case SYS_OPEN:
3544+
case SYSCALL_OPEN:
33713545
syscall_pathname = (void *) sys->args.args[0];
33723546
break;
3373-
case SYS_OPENAT:
3374-
case SYS_OPENAT2:
3547+
case SYSCALL_OPENAT:
3548+
case SYSCALL_OPENAT2:
33753549
syscall_pathname = (void *) sys->args.args[1];
33763550
break;
33773551
}
@@ -3917,7 +4091,7 @@ int BPF_KPROBE(trace_security_socket_setsockopt)
39174091
return -1;
39184092
}
39194093

3920-
if (!data.task_info->syscall_traced || sys->id != SYSC_SETSOCKOPT)
4094+
if (!data.task_info->syscall_traced || sys->id != SYSCALL_SETSOCKOPT)
39214095
return 0;
39224096

39234097
save_to_submit_buf(&data, (void *) &sys->args.args[0], sizeof(u32), 0);
@@ -4771,7 +4945,7 @@ int BPF_KPROBE(trace_mmap_alert)
47714945

47724946
// Load the arguments given to the mmap syscall (which eventually invokes this function)
47734947
syscall_data_t *sys = &data.task_info->syscall_data;
4774-
if (!data.task_info->syscall_traced || sys->id != SYS_MMAP)
4948+
if (!data.task_info->syscall_traced || sys->id != SYSCALL_MMAP)
47754949
return 0;
47764950

47774951
if ((sys->args.args[2] & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
@@ -4811,7 +4985,8 @@ int BPF_KPROBE(trace_security_mmap_file)
48114985

48124986
syscall_data_t *sys = &data.task_info->syscall_data;
48134987
if (should_submit(SHARED_OBJECT_LOADED, data.config)) {
4814-
if (data.task_info->syscall_traced && (prot & VM_EXEC) == VM_EXEC && sys->id == SYS_MMAP) {
4988+
if (data.task_info->syscall_traced && (prot & VM_EXEC) == VM_EXEC &&
4989+
sys->id == SYSCALL_MMAP) {
48154990
events_perf_submit(&data, SHARED_OBJECT_LOADED, 0);
48164991
}
48174992
}
@@ -4858,7 +5033,7 @@ int BPF_KPROBE(trace_security_file_mprotect)
48585033
if (should_submit(MEM_PROT_ALERT, data.config)) {
48595034
// Load the arguments given to the mprotect syscall (which eventually invokes this function)
48605035
syscall_data_t *sys = &data.task_info->syscall_data;
4861-
if (!data.task_info->syscall_traced || sys->id != SYS_MPROTECT)
5036+
if (!data.task_info->syscall_traced || sys->id != SYSCALL_MPROTECT)
48625037
return 0;
48635038

48645039
// unsigned long prot = PT_REGS_PARM3(ctx);

0 commit comments

Comments
 (0)