gadgets: Add trace_lsm #2827

i-Pear · 2024-05-09T16:48:46Z

gadgets: Add trace_lsm

This gadget is used as a "strace" for LSM tracepoints.

How to use

ig run --verify-image=false trace_lsm:latest --help  # list all supported LSM tracepoints
ig run --verify-image=false trace_lsm:latest --trace_inode_mkdir  # trace "inode_mkdir" tracepoint
ig run --verify-image=false trace_lsm:latest --trace_all  # trace all supported LSM tracepoints

alban

Thanks. I commented with some small things to change, and some ideas for future PRs.

gadgets/trace_lsm/program.bpf.c

alban · 2024-05-12T16:11:38Z

gadgets/trace_lsm/program.bpf.c

+	F(sem_semop)                \
+	F(netlink_send)             \
+	F(d_instantiate)            \
+	F(getselfattr)              \


On Linux 6.6.13-100.fc38.x86_64 I get:

program trace_lsm_getselfattr: attach LSM/LSMMac: getselfattr LSM hook not supported

This LSM hook was added in Linux 6.8:
torvalds/linux@a04a119

For this PR, could you remove the hooks that were added recently, so this gadget works on most kernels?

I wonder how to make the user experience better (in another PR). What about a flag "besteffort":

SEC("lsm/getselfattr/besteffort")

And when defined, ig would ignore the error when the LSM hook is not supported in the current kernel.
In this way, the gadget author would decide if it's better to fail or not. Or maybe that should be something defined in gadget.yaml, so the ELF conventions don't diverge between libbpf, cilium/ebpf or ig. Alternatively, it could be something that the WASM module decide based on the BTF data, e.g. in union security_list_options (cc @mauriciovasquezbernal ). What do you think?

The besteffort flag seems to be a general option. Maybe we can create a new macro SEC_BESTEFFORT, and it will add strings [besteffort] in the end of section names. We will identify and erase it while attaching.

uprobe/libc:malloc?failstrategy=ignore&option2=foo2

I'm wrong, the cillum/ebpf library will verify the section name while creating ebpf collections (NewCollectionWithOptions), by finding the symbols in kernel (findProgramTargetInKernel). So if we add ?para&para2 in the end of section names, the ebpf collection will fail to load.

Solved.

For older kernels, the attach LSM/LSMMac: getselfattr LSM hook not supported error message also comes from NewCollectionWithOptions, not our attaching process. So to support the besteffort flag, we may also need to hack cillum/ebpf.

Issue in cillium/ebpf: #https://github.com/cilium/ebpf/discussions/1470

alban · 2024-05-12T16:38:46Z

gadgets/trace_lsm/program.bpf.c

+
+#define TRACE_LSM(name)                                                \
+	SEC("lsm/" #name)                                              \
+	int trace_lsm_##name()                                         \


To be really useful, this gadget should access parameters.

And when it is a well-known type such as struct path * or struct file *, print the full path using include/gadget/filesystem.h.

I wonder if type matches relocations can help (#2542).

But that's for another PR.

I wonder if type matches relocations can help (#2542).

Do you mean we can use bpf_core_type_matches to find struct path * types automatically?

update: seems not. we still need to write types for each argument, and manually output the interested ones.

I was thinking of something like this:

#define TRACE_LSM(name) \ union security_list_options___##name##arg1 { \ int (* #name)(const struct path *); \ }; \ union security_list_options___##name##arg2 { \ int (* #name)(const struct path *, const struct path *); \ }; \ \ /* ignore attaching failures for compatibility */ \ SEC("lsm/" #name) \ int trace_lsm_##name(void *arg1, void *arg2, void *arg3) \ struct event *event; /*TODO: alloc event in a map */ \ char *path_str = NULL; \ struct path *path = NULL; \ if (bpf_core_type_matches(security_list_options___##name##arg1)) { \ path = (struct path *) arg1; \ } \ if (bpf_core_type_matches(security_list_options___##name##arg2)) { \ path = (struct path *) arg1; \ } \ if (path) { \ path_str = get_path_str(&fs->pwd); \ } \ if (path_str) { \ bpf_probe_read_kernel_str(event->path, MAX_STRING_SIZE, path_str); \ } \ ...

But that would work only for hooks with a single struct path * argument (for the arg1 test):

path_truncate

path_chroot

inode_getattr
Or with 2 struct path * arguments:

sb_pivotroot

move_mount

But others would be missed, so I don't know if it is worth it.

In any cases, it is not for this PR.

I haven't much understood the code here, are there structs like security_list_options___* in kernel?
We can discuss about this tomorrow.

Looking into this: https://lwn.net/Articles/967893/

I finally gave up after trying for several hours, I couldn't find any CORE API that can be used to match parameter types.

alban

Thanks!

gadgets/trace_lsm/program.bpf.c

alban · 2024-05-25T12:03:06Z

gadgets/trace_lsm/artifacthub-pkg.yml

It would be good to have a README.md to improve the artifacthub page.

This could be done in another PR.

Currently I don't have a k8s environment, will provide readme files for all my gadgets later.

gadgets/trace_lsm/gadget.yaml

alban · 2024-05-25T12:38:03Z

gadgets/trace_lsm/program.bpf.c

+
+#define TRACE_LSM(name)                                                \
+	SEC("lsm/" #name)                                              \
+	int trace_lsm_##name()                                         \


I was thinking of something like this:

#define TRACE_LSM(name) \ union security_list_options___##name##arg1 { \ int (* #name)(const struct path *); \ }; \ union security_list_options___##name##arg2 { \ int (* #name)(const struct path *, const struct path *); \ }; \ \ /* ignore attaching failures for compatibility */ \ SEC("lsm/" #name) \ int trace_lsm_##name(void *arg1, void *arg2, void *arg3) \ struct event *event; /*TODO: alloc event in a map */ \ char *path_str = NULL; \ struct path *path = NULL; \ if (bpf_core_type_matches(security_list_options___##name##arg1)) { \ path = (struct path *) arg1; \ } \ if (bpf_core_type_matches(security_list_options___##name##arg2)) { \ path = (struct path *) arg1; \ } \ if (path) { \ path_str = get_path_str(&fs->pwd); \ } \ if (path_str) { \ bpf_probe_read_kernel_str(event->path, MAX_STRING_SIZE, path_str); \ } \ ...

But that would work only for hooks with a single struct path * argument (for the arg1 test):

path_truncate

path_chroot

inode_getattr
Or with 2 struct path * arguments:

sb_pivotroot

move_mount

But others would be missed, so I don't know if it is worth it.

In any cases, it is not for this PR.

alban

Some small changes remaining to do. It should be good to go after that. Thanks!

gadgets/trace_lsm/program.bpf.c

gadgets/trace_lsm/gadget.yaml

Co-authored-by: Alban Crequy <albancrequy@linux.microsoft.com> Signed-off-by: Tianyi Liu <i.pear@outlook.com>

i-Pear requested a review from mauriciovasquezbernal as a code owner May 9, 2024 16:48

alban requested changes May 12, 2024

View reviewed changes

i-Pear force-pushed the trace_lsm branch from 60f9d46 to 8460c9a Compare May 13, 2024 17:57

i-Pear requested a review from flyth as a code owner May 13, 2024 17:57

i-Pear force-pushed the trace_lsm branch 3 times, most recently from 2fb8377 to b175251 Compare May 23, 2024 16:35

i-Pear requested a review from alban May 23, 2024 16:41

i-Pear force-pushed the trace_lsm branch from b175251 to caf36e1 Compare May 23, 2024 17:43

alban reviewed May 25, 2024

View reviewed changes

i-Pear force-pushed the trace_lsm branch from caf36e1 to 28ef7ef Compare May 26, 2024 16:14

i-Pear requested a review from alban May 26, 2024 16:16

alban reviewed May 28, 2024

View reviewed changes

gadgets/trace_lsm/program.bpf.c Outdated Show resolved Hide resolved

gadgets/trace_lsm/program.bpf.c Outdated Show resolved Hide resolved

gadgets/trace_lsm/gadget.yaml Outdated Show resolved Hide resolved

gadgets/trace_lsm/gadget.yaml Outdated Show resolved Hide resolved

gadgets: Add trace_lsm

942bcd2

Co-authored-by: Alban Crequy <albancrequy@linux.microsoft.com> Signed-off-by: Tianyi Liu <i.pear@outlook.com>

i-Pear force-pushed the trace_lsm branch from 28ef7ef to 942bcd2 Compare May 28, 2024 15:22

i-Pear requested a review from alban May 28, 2024 15:25

alban approved these changes May 29, 2024

View reviewed changes

alban merged commit fe294b1 into inspektor-gadget:main May 29, 2024
57 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

gadgets: Add trace_lsm #2827

gadgets: Add trace_lsm #2827

i-Pear commented May 9, 2024 •

edited

alban left a comment

alban May 12, 2024

i-Pear May 13, 2024

i-Pear May 13, 2024

i-Pear May 13, 2024 •

edited

i-Pear May 13, 2024

i-Pear May 23, 2024

alban May 12, 2024

i-Pear May 23, 2024 •

edited

alban May 25, 2024

i-Pear May 26, 2024

i-Pear May 27, 2024

i-Pear May 27, 2024

alban left a comment

alban May 25, 2024

i-Pear May 26, 2024

alban May 25, 2024

alban left a comment

gadgets: Add trace_lsm #2827

gadgets: Add trace_lsm #2827

Conversation

i-Pear commented May 9, 2024 • edited

gadgets: Add trace_lsm

How to use

alban left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

i-Pear May 13, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

i-Pear May 23, 2024 • edited

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alban left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

alban left a comment

Choose a reason for hiding this comment

i-Pear commented May 9, 2024 •

edited

i-Pear May 13, 2024 •

edited

i-Pear May 23, 2024 •

edited