Skip to content

Commit fe3dfa9

Browse files
yunwei37yunwei37
committed
add code for hide signal sudo and replace
1 parent e71352c commit fe3dfa9

29 files changed

Lines changed: 2743 additions & 0 deletions

‎src/24-hide/.gitignore‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
.vscode
2+
package.json
3+
*.o
4+
*.skel.json
5+
*.skel.yaml
6+
package.yaml
7+
ecli
8+
bootstrap
9+
textreplace2

‎src/24-hide/LICENSE‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
BSD 3-Clause License
2+
3+
Copyright (c) 2020, Andrii Nakryiko
4+
All rights reserved.
5+
6+
Redistribution and use in source and binary forms, with or without
7+
modification, are permitted provided that the following conditions are met:
8+
9+
1. Redistributions of source code must retain the above copyright notice, this
10+
list of conditions and the following disclaimer.
11+
12+
2. Redistributions in binary form must reproduce the above copyright notice,
13+
this list of conditions and the following disclaimer in the documentation
14+
and/or other materials provided with the distribution.
15+
16+
3. Neither the name of the copyright holder nor the names of its
17+
contributors may be used to endorse or promote products derived from
18+
this software without specific prior written permission.
19+
20+
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
21+
AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22+
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
23+
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
24+
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25+
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
26+
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
27+
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
28+
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
29+
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

‎src/24-hide/Makefile‎

Lines changed: 141 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,141 @@
1+
# SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause)
2+
OUTPUT := .output
3+
CLANG ?= clang
4+
LIBBPF_SRC := $(abspath ../../libbpf/src)
5+
BPFTOOL_SRC := $(abspath ../../bpftool/src)
6+
LIBBPF_OBJ := $(abspath $(OUTPUT)/libbpf.a)
7+
BPFTOOL_OUTPUT ?= $(abspath $(OUTPUT)/bpftool)
8+
BPFTOOL ?= $(BPFTOOL_OUTPUT)/bootstrap/bpftool
9+
LIBBLAZESYM_SRC := $(abspath ../../blazesym/)
10+
LIBBLAZESYM_OBJ := $(abspath $(OUTPUT)/libblazesym.a)
11+
LIBBLAZESYM_HEADER := $(abspath $(OUTPUT)/blazesym.h)
12+
ARCH ?= $(shell uname -m | sed 's/x86_64/x86/' \
13+
| sed 's/arm.*/arm/' \
14+
| sed 's/aarch64/arm64/' \
15+
| sed 's/ppc64le/powerpc/' \
16+
| sed 's/mips.*/mips/' \
17+
| sed 's/riscv64/riscv/' \
18+
| sed 's/loongarch64/loongarch/')
19+
VMLINUX := ../../vmlinux/$(ARCH)/vmlinux.h
20+
# Use our own libbpf API headers and Linux UAPI headers distributed with
21+
# libbpf to avoid dependency on system-wide headers, which could be missing or
22+
# outdated
23+
INCLUDES := -I$(OUTPUT) -I../../libbpf/include/uapi -I$(dir $(VMLINUX))
24+
CFLAGS := -g -Wall
25+
ALL_LDFLAGS := $(LDFLAGS) $(EXTRA_LDFLAGS)
26+
27+
APPS = textreplace2 # minimal minimal_legacy uprobe kprobe fentry usdt sockfilter tc ksyscall
28+
29+
CARGO ?= $(shell which cargo)
30+
ifeq ($(strip $(CARGO)),)
31+
BZS_APPS :=
32+
else
33+
BZS_APPS := # profile
34+
APPS += $(BZS_APPS)
35+
# Required by libblazesym
36+
ALL_LDFLAGS += -lrt -ldl -lpthread -lm
37+
endif
38+
39+
# Get Clang's default includes on this system. We'll explicitly add these dirs
40+
# to the includes list when compiling with `-target bpf` because otherwise some
41+
# architecture-specific dirs will be "missing" on some architectures/distros -
42+
# headers such as asm/types.h, asm/byteorder.h, asm/socket.h, asm/sockios.h,
43+
# sys/cdefs.h etc. might be missing.
44+
#
45+
# Use '-idirafter': Don't interfere with include mechanics except where the
46+
# build would have failed anyways.
47+
CLANG_BPF_SYS_INCLUDES ?= $(shell $(CLANG) -v -E - </dev/null 2>&1 \
48+
| sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }')
49+
50+
ifeq ($(V),1)
51+
Q =
52+
msg =
53+
else
54+
Q = @
55+
msg = @printf ' %-8s %s%s\n' \
56+
"$(1)" \
57+
"$(patsubst $(abspath $(OUTPUT))/%,%,$(2))" \
58+
"$(if $(3), $(3))";
59+
MAKEFLAGS += --no-print-directory
60+
endif
61+
62+
define allow-override
63+
$(if $(or $(findstring environment,$(origin $(1))),\
64+
$(findstring command line,$(origin $(1)))),,\
65+
$(eval $(1) = $(2)))
66+
endef
67+
68+
$(call allow-override,CC,$(CROSS_COMPILE)cc)
69+
$(call allow-override,LD,$(CROSS_COMPILE)ld)
70+
71+
.PHONY: all
72+
all: $(APPS)
73+
74+
.PHONY: clean
75+
clean:
76+
$(call msg,CLEAN)
77+
$(Q)rm -rf $(OUTPUT) $(APPS)
78+
79+
$(OUTPUT) $(OUTPUT)/libbpf $(BPFTOOL_OUTPUT):
80+
$(call msg,MKDIR,$@)
81+
$(Q)mkdir -p $@
82+
83+
# Build libbpf
84+
$(LIBBPF_OBJ): $(wildcard $(LIBBPF_SRC)/*.[ch] $(LIBBPF_SRC)/Makefile) | $(OUTPUT)/libbpf
85+
$(call msg,LIB,$@)
86+
$(Q)$(MAKE) -C $(LIBBPF_SRC) BUILD_STATIC_ONLY=1 \
87+
OBJDIR=$(dir $@)/libbpf DESTDIR=$(dir $@) \
88+
INCLUDEDIR= LIBDIR= UAPIDIR= \
89+
install
90+
91+
# Build bpftool
92+
$(BPFTOOL): | $(BPFTOOL_OUTPUT)
93+
$(call msg,BPFTOOL,$@)
94+
$(Q)$(MAKE) ARCH= CROSS_COMPILE= OUTPUT=$(BPFTOOL_OUTPUT)/ -C $(BPFTOOL_SRC) bootstrap
95+
96+
97+
$(LIBBLAZESYM_SRC)/target/release/libblazesym.a::
98+
$(Q)cd $(LIBBLAZESYM_SRC) && $(CARGO) build --features=cheader,dont-generate-test-files --release
99+
100+
$(LIBBLAZESYM_OBJ): $(LIBBLAZESYM_SRC)/target/release/libblazesym.a | $(OUTPUT)
101+
$(call msg,LIB, $@)
102+
$(Q)cp $(LIBBLAZESYM_SRC)/target/release/libblazesym.a $@
103+
104+
$(LIBBLAZESYM_HEADER): $(LIBBLAZESYM_SRC)/target/release/libblazesym.a | $(OUTPUT)
105+
$(call msg,LIB,$@)
106+
$(Q)cp $(LIBBLAZESYM_SRC)/target/release/blazesym.h $@
107+
108+
# Build BPF code
109+
$(OUTPUT)/%.bpf.o: %.bpf.c $(LIBBPF_OBJ) $(wildcard %.h) $(VMLINUX) | $(OUTPUT) $(BPFTOOL)
110+
$(call msg,BPF,$@)
111+
$(Q)$(CLANG) -g -O2 -target bpf -D__TARGET_ARCH_$(ARCH) \
112+
$(INCLUDES) $(CLANG_BPF_SYS_INCLUDES) \
113+
-c $(filter %.c,$^) -o $(patsubst %.bpf.o,%.tmp.bpf.o,$@)
114+
$(Q)$(BPFTOOL) gen object $@ $(patsubst %.bpf.o,%.tmp.bpf.o,$@)
115+
116+
# Generate BPF skeletons
117+
$(OUTPUT)/%.skel.h: $(OUTPUT)/%.bpf.o | $(OUTPUT) $(BPFTOOL)
118+
$(call msg,GEN-SKEL,$@)
119+
$(Q)$(BPFTOOL) gen skeleton $< > $@
120+
121+
# Build user-space code
122+
$(patsubst %,$(OUTPUT)/%.o,$(APPS)): %.o: %.skel.h
123+
124+
$(OUTPUT)/%.o: %.c $(wildcard %.h) | $(OUTPUT)
125+
$(call msg,CC,$@)
126+
$(Q)$(CC) $(CFLAGS) $(INCLUDES) -c $(filter %.c,$^) -o $@
127+
128+
$(patsubst %,$(OUTPUT)/%.o,$(BZS_APPS)): $(LIBBLAZESYM_HEADER)
129+
130+
$(BZS_APPS): $(LIBBLAZESYM_OBJ)
131+
132+
# Build application binary
133+
$(APPS): %: $(OUTPUT)/%.o $(LIBBPF_OBJ) | $(OUTPUT)
134+
$(call msg,BINARY,$@)
135+
$(Q)$(CC) $(CFLAGS) $^ $(ALL_LDFLAGS) -lelf -lz -o $@
136+
137+
# delete failed targets
138+
.DELETE_ON_ERROR:
139+
140+
# keep intermediate (.skel.h, .bpf.o, etc) targets
141+
.SECONDARY:

‎src/24-hide/common.h‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
// SPDX-License-Identifier: BSD-3-Clause
2+
#ifndef BAD_BPF_COMMON_H
3+
#define BAD_BPF_COMMON_H
4+
5+
// These are used by a number of
6+
// different programs to sync eBPF Tail Call
7+
// login between user space and kernel
8+
#define PROG_00 0
9+
#define PROG_01 1
10+
#define PROG_02 2
11+
12+
// Used when replacing text
13+
#define FILENAME_LEN_MAX 50
14+
#define TEXT_LEN_MAX 20
15+
16+
// Simple message structure to get events from eBPF Programs
17+
// in the kernel to user spcae
18+
#define TASK_COMM_LEN 16
19+
struct event {
20+
int pid;
21+
char comm[TASK_COMM_LEN];
22+
bool success;
23+
};
24+
25+
struct tr_file {
26+
char filename[FILENAME_LEN_MAX];
27+
unsigned int filename_len;
28+
};
29+
30+
struct tr_text {
31+
char text[TEXT_LEN_MAX];
32+
unsigned int text_len;
33+
};
34+
35+
#endif // BAD_BPF_COMMON_H

‎src/24-hide/common_um.h‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
// SPDX-License-Identifier: BSD-3-Clause
2+
#ifndef BAD_BPF_COMMON_UM_H
3+
#define BAD_BPF_COMMON_UM_H
4+
5+
#include <bpf/bpf.h>
6+
#include <bpf/libbpf.h>
7+
#include <unistd.h>
8+
#include <signal.h>
9+
#include <sys/resource.h>
10+
#include <errno.h>
11+
#include <fcntl.h>
12+
13+
static volatile sig_atomic_t exiting;
14+
15+
void sig_int(int signo)
16+
{
17+
exiting = 1;
18+
}
19+
20+
static bool setup_sig_handler() {
21+
// Add handlers for SIGINT and SIGTERM so we shutdown cleanly
22+
__sighandler_t sighandler = signal(SIGINT, sig_int);
23+
if (sighandler == SIG_ERR) {
24+
fprintf(stderr, "can't set signal handler: %s\n", strerror(errno));
25+
return false;
26+
}
27+
sighandler = signal(SIGTERM, sig_int);
28+
if (sighandler == SIG_ERR) {
29+
fprintf(stderr, "can't set signal handler: %s\n", strerror(errno));
30+
return false;
31+
}
32+
return true;
33+
}
34+
35+
static int libbpf_print_fn(enum libbpf_print_level level, const char *format, va_list args)
36+
{
37+
return vfprintf(stderr, format, args);
38+
}
39+
40+
static bool bump_memlock_rlimit(void)
41+
{
42+
struct rlimit rlim_new = {
43+
.rlim_cur = RLIM_INFINITY,
44+
.rlim_max = RLIM_INFINITY,
45+
};
46+
47+
if (setrlimit(RLIMIT_MEMLOCK, &rlim_new)) {
48+
fprintf(stderr, "Failed to increase RLIMIT_MEMLOCK limit! (hint: run as root)\n");
49+
return false;
50+
}
51+
return true;
52+
}
53+
54+
55+
static bool setup() {
56+
// Set up libbpf errors and debug info callback
57+
libbpf_set_print(libbpf_print_fn);
58+
59+
// Bump RLIMIT_MEMLOCK to allow BPF sub-system to do anything
60+
if (!bump_memlock_rlimit()) {
61+
return false;
62+
};
63+
64+
// Setup signal handler so we exit cleanly
65+
if (!setup_sig_handler()) {
66+
return false;
67+
}
68+
69+
return true;
70+
}
71+
72+
73+
#ifdef BAD_BPF_USE_TRACE_PIPE
74+
static void read_trace_pipe(void) {
75+
int trace_fd;
76+
77+
trace_fd = open("/sys/kernel/debug/tracing/trace_pipe", O_RDONLY, 0);
78+
if (trace_fd == -1) {
79+
printf("Error opening trace_pipe: %s\n", strerror(errno));
80+
return;
81+
}
82+
83+
while (!exiting) {
84+
static char buf[4096];
85+
ssize_t sz;
86+
87+
sz = read(trace_fd, buf, sizeof(buf) -1);
88+
if (sz > 0) {
89+
buf[sz] = '\x00';
90+
puts(buf);
91+
}
92+
}
93+
}
94+
#endif // BAD_BPF_USE_TRACE_PIPE
95+
96+
#endif // BAD_BPF_COMMON_UM_H

0 commit comments

Comments
 (0)