Merge pull request #6 from SentinalFS/fix/renameAndDelete

Fix/rename and delete

Author: technoBlogger-2001

.github/workflows/releases.yaml

@@ -61,7 +61,7 @@ jobs:
           tag_name: v${{ env.version }}
           name: Release v${{ env.version }}
           files: build/monitor.bpf.o 
-          # generate_release_notes: true
+          generate_release_notes: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.vscode/settings.json

@@ -18,6 +18,9 @@
 		"cstdio": "c",
 		"*.inc": "c",
 		"bpf_core_read.h": "c",
-		"data_types.h": "c"
+		"data_types.h": "c",
+		"chrono": "c",
+		"text_encoding": "c",
+		"typeinfo": "c"
 	}
 }

CHANGELOG.json

@@ -1,28 +1,32 @@
-[   {
-        "version": "0.2.0",
-        "changes": [
-            "Implimented ring buffer for file events"
-        ]
-    },
-    {
-        "version": "0.1.2",
-        "changes": [
-            "Fix release extras"
-        ]
-    },
+[   
     {
-        "version": "0.1.1",
+        "version": "0.3.0",
         "changes": [
-            "Added support for monitoring file deletions",
-            "Improved performance for large directories",
-            "Fixed a bug where some file events were not captured"
+            "Fix rename and delete events",
+            "Added cgroup support for file events"
         ]
     },
-    {
-        "version": "0.1.0",
-        "changes": [
-            "A local file monitoring tool early release",
-            "Can monitor read, write, rename, create"
-        ]
-    }
-]
+	{
+		"version": "0.2.0",
+		"changes": ["Implimented ring buffer for file events"]
+	},
+	{
+		"version": "0.1.2",
+		"changes": ["Fix release extras"]
+	},
+	{
+		"version": "0.1.1",
+		"changes": [
+			"Added support for monitoring file deletions",
+			"Improved performance for large directories",
+			"Fixed a bug where some file events were not captured"
+		]
+	},
+	{
+		"version": "0.1.0",
+		"changes": [
+			"A local file monitoring tool early release",
+			"Can monitor read, write, rename, create"
+		]
+	}
+]

README.md

@@ -1,4 +1,113 @@
-# Local_file_monitor
+# file monitor
 
-It monitors local files
+It monitors files
 
+## Dir structure
+
+```
+.
+├── CHANGELOG.json
+├── CMakeLists.txt
+├── common.h
+├── data_types.h
+├── headers.h
+├── helpers
+│   ├── delete.h
+│   ├── read_write.h
+│   └── rename.h
+├── monitor.c
+├── README.md
+├── VERSION.txt
+└── vmlinux.h
+```
+
+## BPF traces
+
+### VFS Read
+
+```sh
+sudo bpftrace -e 'kprobe:vfs_read { 
+    $file = (struct file *)arg0;
+    $dentry = $file->f_path.dentry;
+    
+    if ($dentry != 0) {
+        printf("READ - File: %s, Size: %d bytes, PID: %d, Comm: %s\n", 
+               str($dentry->d_name.name), 
+               arg2,  // count/size parameter
+               pid, 
+               comm);
+               
+        $parent = $dentry->d_parent;
+        if ($parent != 0) {
+            printf("  Parent dir: %s\n", str($parent->d_name.name));
+        }
+    }
+}'
+```
+
+### VFS Write
+
+```sh
+sudo bpftrace -e 'kprobe:vfs_write { 
+    $file = (struct file *)arg0;
+    $dentry = $file->f_path.dentry;
+    
+    if ($dentry != 0) {
+        printf("WRITE - File: %s, Size: %d bytes, PID: %d, Comm: %s\n", 
+               str($dentry->d_name.name), 
+               arg2,  // count/size parameter
+               pid, 
+               comm);
+               
+        $parent = $dentry->d_parent;
+        if ($parent != 0) {
+            printf("  Parent dir: %s\n", str($parent->d_name.name));
+        }
+    }
+}'
+```
+
+### VFS Rename
+
+```sh
+sudo bpftrace -e 'kprobe:vfs_rename { 
+    $old_dentry = (struct dentry *)arg1;
+    $new_dentry = (struct dentry *)arg3;
+    
+    if ($old_dentry != 0 && $new_dentry != 0) {
+        printf("RENAME - From: %s, To: %s, PID: %d, Comm: %s\n", 
+               str($old_dentry->d_name.name), 
+               str($new_dentry->d_name.name),
+               pid, 
+               comm);
+               
+        $old_parent = $old_dentry->d_parent;
+        $new_parent = $new_dentry->d_parent;
+        
+        if ($old_parent != 0) {
+            printf("  Source dir: %s\n", str($old_parent->d_name.name));
+        }
+        
+        if ($new_parent != 0) {
+            printf("  Target dir: %s\n", str($new_parent->d_name.name));
+        }
+    }
+}'
+```
+
+### VFS Unlink
+
+```sh
+sudo bpftrace -e 'kprobe:vfs_unlink { 
+    $dentry = (struct dentry *)arg2;
+    printf("dentry ptr: %p, d_name.len: %d, d_name.name_ptr: %s\n", 
+    $dentry, $dentry->d_name.len, str($dentry->d_name.name));
+    
+    $parent = $dentry->d_parent;
+    if ($parent != 0) {
+        printf("Parent name: %s\n", str($parent->d_name.name));
+    } else {
+        printf("Parent: NULL\n");
+    }
+}'
+```

VERSION.txt

@@ -1 +1 @@
-0.2.0
+0.3.0

common.h

@@ -1,65 +1,11 @@
+#ifndef COMMON_H
+#define COMMON_H
+
 #include "headers.h"
 #include "data_types.h"
+#include "helpers/read_write.h"
+#include "helpers/rename.h"
+#include "helpers/delete.h"
+// Common includes and definitions can stay here
 
-static __always_inline int trace_file_operation(struct pt_regs *ctx, struct file *file, const char *operation)
-{
-    if (!file)
-        return 0;
-
-    struct data_t *data = bpf_ringbuf_reserve(&events, sizeof(struct data_t), 0);
-    if (!data) {
-        return 0;
-    }
-    __builtin_memset(data, 0, sizeof(*data));
-
-
-    struct dentry *de = NULL;
-    bpf_core_read(&de, sizeof(de), &file->f_path.dentry);
-    if (!de) {
-        bpf_ringbuf_discard(data, 0);
-        return 0;
-    }
-
-    struct qstr d_name = {};
-    bpf_core_read(&d_name, sizeof(d_name), &de->d_name);
-    if (d_name.len == 0) {
-        bpf_ringbuf_discard(data, 0);
-        return 0;
-    }
-
-    char fname[128] = {};
-    bpf_core_read_str(fname, sizeof(fname), d_name.name);
-
-    data->pid = bpf_get_current_pid_tgid() >> 32;
-    data->uid = bpf_get_current_uid_gid();
-    data->timestamp = bpf_ktime_get_ns();
-
-    __builtin_memcpy(data->filename, fname, sizeof(data->filename));
-    __builtin_memcpy(data->otype, operation, sizeof(data->otype));
-    bpf_get_current_comm(&data->comm, sizeof(data->comm));
-
-    struct inode *inode = NULL;
-    bpf_core_read(&inode, sizeof(inode), &file->f_inode);
-    if (!inode) {
-        bpf_ringbuf_discard(data, 0);
-        return 0;
-    }
-
-    u32 inode_num = 0;
-    bpf_core_read(&inode_num, sizeof(inode_num), &inode->i_ino);
-
-    struct inode_key key = {.inode = inode_num};
-
-    bpf_trace_printk("LOG: filename=%s otype=%s comm=%s\n", sizeof("LOG: filename=%s otype=%s comm=%s\n"), data->filename, data->otype, data->comm);
-    bpf_trace_printk("LOG: inode=%u\n", sizeof("LOG: inode=%u\n"), inode_num);
-
-    u32 *monitored = bpf_map_lookup_elem(&monitored_inodes, &key);
-    if (!monitored) {
-        bpf_ringbuf_discard(data, 0);
-        return 0;
-    }
-
-    bpf_ringbuf_submit(data, 0);
-
-    return 0;
-}
+#endif /* COMMON_H */

data_types.h

@@ -1,10 +1,18 @@
+#ifndef DATA_TYPES_H
+#define DATA_TYPES_H
+
 #include "headers.h"
 
 struct {
     __uint(type, BPF_MAP_TYPE_RINGBUF);
-    __uint(max_entries, 256 * 1024);
+    __uint(max_entries, 512 * 1024);
 } events SEC(".maps");
 
+struct {
+    __uint(type, BPF_MAP_TYPE_RINGBUF);
+    __uint(max_entries, 256 * 1024);
+} rename_events SEC(".maps");
+
 struct
 {
     __uint(type, BPF_MAP_TYPE_HASH);
@@ -23,8 +31,23 @@ struct data_t
 {
     u32 pid;
     u32 uid;
-    char filename[128];
-    char comm[16];
+    char filename[FILE_NAME_SIZE];
+    char comm[COMM_SIZE];
+    u64 timestamp;
+    u64 cgroup_id;
+    char otype[OTYPE_SIZE];
+};
+
+struct rename_data_t
+{
+    u32 pid;
+    u32 uid;
+    char old_filename[FILE_NAME_SIZE];
+    char new_filename[FILE_NAME_SIZE];
+    char comm[COMM_SIZE];
     u64 timestamp;
-    char otype[16];
-};
+    u64 cgroup_id;
+    char otype[OTYPE_SIZE];
+};
+
+#endif

headers.h

@@ -7,5 +7,9 @@
 #include <bpf/bpf_tracing.h>
 #include <bpf/bpf_endian.h>
 
+#define FILE_NAME_SIZE 144
+#define OTYPE_SIZE 16
+#define COMM_SIZE 32
+#define DCACHE_NEGATIVE_DENTRY 0x0020
 
 #endif

helpers/delete.h

@@ -0,0 +1,59 @@
+#ifndef DELETE_H
+#define DELETE_H
+
+#include "../headers.h"
+#include "../data_types.h"
+
+static __always_inline int trace_file_delete(struct pt_regs *ctx, struct dentry *de)
+{
+    if (!de)
+    {
+        bpf_trace_printk("trace_file_delete: dentry is NULL\n", sizeof("trace_file_delete: dentry is NULL\n"));
+        return 0;
+    }
+
+    struct data_t *data = bpf_ringbuf_reserve(&events, sizeof(struct data_t), 0);
+    if (!data)
+    {
+        bpf_trace_printk("trace_file_delete: failed to reserve ringbuf\n", sizeof("trace_file_delete: failed to reserve ringbuf\n"));
+        return 0;
+    }
+    __builtin_memset(data, 0, sizeof(*data));
+
+    struct qstr d_name_qstr = {};
+    bpf_core_read(&d_name_qstr, sizeof(d_name_qstr), &de->d_name);
+
+    if (d_name_qstr.len <= 0 || !d_name_qstr.name || d_name_qstr.name == (void *)-1UL || d_name_qstr.name == NULL)
+    {
+        bpf_ringbuf_discard(data, 0);
+        return 0;
+    }
+
+    unsigned char d_flags = 0;
+    bpf_core_read(&d_flags, sizeof(d_flags), &de->d_flags);
+    if (d_flags & DCACHE_NEGATIVE_DENTRY) {
+        bpf_trace_printk("trace_file_delete: negative dentry detected (file likely non-existent). Discarding.\n", sizeof("trace_file_delete: negative dentry detected (file likely non-existent). Discarding.\n"));
+        bpf_ringbuf_discard(data, 0);
+        return 0;
+    }
+
+    char fname[FILE_NAME_SIZE] = {};
+    bpf_core_read_str(fname, sizeof(fname), d_name_qstr.name);
+
+    char OPRN[] = "DELETE";
+    __builtin_memcpy(data->filename, fname, sizeof(data->filename));
+    __builtin_memcpy(data->otype, OPRN, sizeof(data->otype));
+    data->pid = bpf_get_current_pid_tgid() >> 32;
+    data->uid = bpf_get_current_uid_gid();
+    data->timestamp = bpf_ktime_get_ns();
+    
+    bpf_get_current_comm(&data->comm, sizeof(data->comm));
+
+    int cgroup_id = bpf_get_current_cgroup_id();
+    data->cgroup_id = cgroup_id;
+
+    bpf_ringbuf_submit(data, 0);
+    return 0;
+}
+
+#endif