denet 0.5.0

a simple process monitor
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133

# eBPF Setup Tools for DeNet

This directory contains tools and configuration files to help set up the necessary permissions for DeNet to use eBPF tracepoints without requiring root privileges.

## Problem

By default, eBPF tracepoints require:

1. The `CAP_BPF` and `CAP_PERFMON` capabilities (for loading eBPF programs and accessing performance monitoring)
2. Access to the tracefs filesystem at `/sys/kernel/debug/tracing` (typically restricted to root)
3. Proper kernel settings, particularly `kernel.kptr_restrict=0` (CRITICAL!)

While capabilities can be added to the binary with `setcap`, the tracefs filesystem permissions are not persistent across system reboots when modified manually.

## Solution

This directory provides several tools to configure persistent permissions:

### `setup_tracefs_permissions.sh`

A comprehensive setup script that:

- Creates a 'tracing' group
- Adds the current user to the group
- Creates and enables a systemd service for persistent tracefs permissions
- Sets up systemd mount overrides for debugfs
- Configures kernel parameters for eBPF access
- Sets permissions for the current session

Usage:

```bash
sudo ./setup_tracefs_permissions.sh
```

After running, log out and log back in for the group changes to take effect.

### `tracefs-permissions.service`

A systemd service that sets the appropriate permissions on the tracefs filesystem during system boot.

### `99-tracefs.rules`

A udev rules file that sets permissions on tracefs directories when they're created.

## Manual Installation

If the automated script doesn't work for your system, you can manually install the components:

1. Create the tracing group:
   ```bash
   sudo groupadd -r tracing
   ```

2. Add your user to the group:
   ```bash
   sudo usermod -aG tracing $USER
   ```

3. Install the systemd service:
   ```bash
   sudo cp tracefs-permissions.service /etc/systemd/system/
   sudo systemctl daemon-reload
   sudo systemctl enable tracefs-permissions.service
   sudo systemctl start tracefs-permissions.service
   ```

4. Install the udev rules:
   ```bash
   sudo cp 99-tracefs.rules /etc/udev/rules.d/
   sudo udevadm control --reload-rules
   sudo udevadm trigger
   ```

5. Create a systemd mount override for debugfs:
   ```bash
   sudo mkdir -p /etc/systemd/system/sys-kernel-debug.mount.d/
   echo -e "[Mount]\nOptions=mode=755" | sudo tee /etc/systemd/system/sys-kernel-debug.mount.d/override.conf
   sudo systemctl daemon-reload
   ```

6. Set kernel parameters (CRITICAL):
   ```bash
   # These are REQUIRED for eBPF to work with capabilities
   echo "kernel.unprivileged_bpf_disabled=0" | sudo tee /etc/sysctl.d/10-ebpf.conf
   echo "kernel.kptr_restrict=0" | sudo tee -a /etc/sysctl.d/10-ebpf.conf
   
   # Apply immediately
   sudo sysctl -w kernel.unprivileged_bpf_disabled=0
   sudo sysctl -w kernel.kptr_restrict=0
   
   # Check perf_event_paranoid (warn if > 1)
   sysctl kernel.perf_event_paranoid
   ```

## Verifying the Setup

After installation and logging back in, you can verify that the setup is working:

```bash
ls -la /sys/kernel/debug/tracing/events/syscalls
```

If you can access this directory, the permissions are set correctly.

Set the required capabilities on the binary:

```bash
sudo setcap cap_bpf,cap_perfmon=ep target/release/denet
```

Then try running DeNet with eBPF enabled (use a command that makes syscalls):

```bash
denet --enable-ebpf run -- wget https://example.com
```

## Troubleshooting

If you still encounter issues:

1. Make sure you've logged out and back in after running the setup
2. Check if your user is in the tracing group: `groups $USER`
3. Verify the critical kernel settings:
   ```bash
   sysctl kernel.unprivileged_bpf_disabled  # Must be 0
   sysctl kernel.kptr_restrict              # Must be 0 (CRITICAL!)
   sysctl kernel.perf_event_paranoid        # Warn if > 1
   ```
4. Verify capabilities are set: `getcap target/release/denet`
5. Check the systemd service status: `systemctl status tracefs-permissions.service`
6. Try running with `sudo` to see if the issue is permissions-related
7. Use the diagnostic tool: `./target/release/ebpf_diag --debug`