denet 0.7.0

a simple process monitor
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

//! Syscall tracing eBPF program
//! This program attaches to syscall tracepoints and counts syscall frequency.
//!
//! Coverage spans the categories surfaced by `categorize_syscall` in
//! `src/ebpf/metrics.rs`: file_io, memory, process, network, ipc, signal, time.
//! New tracepoints must be mirrored in the `tracepoints` table in
//! `src/ebpf/syscall_tracker.rs`.
//!
//! Note: read/write on a connected socket fd are counted as file_io here.
//! Disambiguating socket vs. file fds is not possible from a syscall
//! tracepoint without an extra fd-type map, so connect/sendmsg/recvmsg are
//! the primary network signal.

#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>

// BPF map to store syscall counts per PID
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __type(key, __u32);   // PID
    __type(value, __u64); // syscall count
    __uint(max_entries, 10240);
} syscall_counts SEC(".maps");

// BPF map to store per-syscall counts for each PID
// Key is (pid << 16 | syscall_nr) to fit both in a u32
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __type(key, __u32);   // PID << 16 | syscall_nr
    __type(value, __u32); // count for this syscall
    __uint(max_entries, 65536);
} pid_syscall_map SEC(".maps");

// Helper function to update both syscall maps
static inline void update_syscall_maps(__u32 pid, __u32 syscall_nr) {
    // Update total syscall count for PID
    __u64 *count = bpf_map_lookup_elem(&syscall_counts, &pid);
    if (count) {
        __sync_fetch_and_add(count, 1);
    } else {
        __u64 initial_count = 1;
        bpf_map_update_elem(&syscall_counts, &pid, &initial_count, BPF_ANY);
    }

    // Update per-syscall count for this PID
    __u32 key = (pid << 16) | (syscall_nr & 0xFFFF);
    __u32 *syscall_count = bpf_map_lookup_elem(&pid_syscall_map, &key);
    if (syscall_count) {
        __sync_fetch_and_add(syscall_count, 1);
    } else {
        __u32 initial_count = 1;
        bpf_map_update_elem(&pid_syscall_map, &key, &initial_count, BPF_ANY);
    }
}

// Generate a tracepoint program for a single syscall. The `name` must match
// `/sys/kernel/debug/tracing/events/syscalls/sys_enter_<name>` and the Rust
// attach table in `syscall_tracker.rs`.
#define TRACE_SYSCALL(name, nr)                                                \
    SEC("tracepoint/syscalls/sys_enter_" #name)                                \
    int trace_##name##_enter(void *ctx) {                                      \
        __u32 pid = bpf_get_current_pid_tgid() >> 32;                          \
        update_syscall_maps(pid, (nr));                                        \
        return 0;                                                              \
    }

// file_io
TRACE_SYSCALL(read,    0)
TRACE_SYSCALL(write,   1)
TRACE_SYSCALL(close,   3)
TRACE_SYSCALL(openat,  257)

// memory
TRACE_SYSCALL(mmap,    9)
TRACE_SYSCALL(munmap,  11)
TRACE_SYSCALL(brk,     12)

// process
TRACE_SYSCALL(clone,       56)
TRACE_SYSCALL(fork,        57)
TRACE_SYSCALL(vfork,       58)
TRACE_SYSCALL(execve,      59)
TRACE_SYSCALL(exit,        60)
TRACE_SYSCALL(wait4,       61)
TRACE_SYSCALL(kill,        62)
TRACE_SYSCALL(exit_group, 231)

// network
TRACE_SYSCALL(socket,    41)
TRACE_SYSCALL(connect,   42)
TRACE_SYSCALL(accept,    43)
TRACE_SYSCALL(sendto,    44)
TRACE_SYSCALL(recvfrom,  45)
TRACE_SYSCALL(sendmsg,   46)
TRACE_SYSCALL(recvmsg,   47)
TRACE_SYSCALL(bind,      49)
TRACE_SYSCALL(accept4,  288)

// ipc
TRACE_SYSCALL(futex,    202)
TRACE_SYSCALL(pipe,      22)
TRACE_SYSCALL(pipe2,    293)

// signal
TRACE_SYSCALL(rt_sigaction,   13)
TRACE_SYSCALL(rt_sigprocmask, 14)
TRACE_SYSCALL(tgkill,        234)

// time
TRACE_SYSCALL(nanosleep,        35)
TRACE_SYSCALL(clock_gettime,   228)
TRACE_SYSCALL(clock_nanosleep, 230)

char LICENSE[] SEC("license") = "GPL";