使用来自iovisor/bcc的opensnoop.py,我正在尝试扩展 ebpf 代码以处理从相对路径中提取完整路径。
例如,运行 opensnoop.py 并在另一个终端运行cat anything.txt
, opensnoop 中的输出将显示相对文件名,而不是绝对路径:
$ sudo ./venv/bin/python bcc/tools/opensnoop.py | grep anything.txt &
$ cat anything.txt 2>/dev/null
19536 cat -1 2 anything.txt
$ cat /tmp/anything.txt 2>/dev/null
19540 cat -1 2 /tmp/anything.txt
我已经在 opensnoop.py 中叙述了我应该考虑修改的代码块,并添加了一些类似于以下的逻辑:
// .. existing code
bpf_probe_read_user(&data.fname, sizeof(data.fname), (void *)filename);
data.id = id;
data.ts = tsp / 1000;
data.uid = bpf_get_current_uid_gid();
data.flags = flags; // EXTENDED_STRUCT_MEMBER
data.ret = ret;
// new code to handle relative paths:
if (data.fname[0] != '/' && data.fname[0] != '\\0') {
// TODO if filename doesn't start with a /, need to convert relative path to abs
struct fs_struct *fs = ((struct task_struct *) bpf_get_current_task())->fs;
// TODO: get pwd path from fs->pwd
struct path *pwd_path = &fs->pwd // ?
// TODO: call bpf_d_path(pwd_path, buf, sz)
// TODO: update data.fname to insert buf pwd)
}
events.perf_submit(ctx, &data, sizeof(data));
我被困的地方是 TODO 部分,似乎没有很多/任何使用新bpf_d_path
辅助函数的好例子