About SYSCALL HOOKS

[liusy58]

Hi, sir, I want to understand how to trigger the eBPF programs in trace.bpf.c. I'm new to eBPF, I would appreciate it if you can give me some advice to understand these eBPDF's functionality.

[cdelzotti]

Hello ! I'm a newbie in Tracee but I got some experience in eBPF. By reading the code I think I understood the following :

• tracee.bpf.c contains all the eBPF code for the probes that will keep watching for events. Once loaded, they are triggered automatically depending on their type. For instance, the SEC("kprobe/udp_sendmsg") probe will be triggered by the kernel each time the udp_sendmsg is triggered. Syscalls hooks work just the same, except they are triggered when a particular syscall is used.
• When running tracee-ebpf, Tracee will load these eBPF programs (see the initBPF function in pkg/ebpf/tracee.go).
• Once everything is loaded, you have tracee-ebpf running in the userspace and some bpf programs running within the kernel gathering information about events that occured. How do they communicate ? With perf buffers, which are filled by eBPF programs in the kernel and read by tracee-ebpf in the userspace. Once tracee-ebpf retrieved events information, in can do some processing and filtering in order to only show events the user asked for. Then, trace-ebpf can print the list of events you see as output.

So, with that in mind, if I try to answer you initial question : "I want to understand how to trigger the eBPF programs in trace.bpf.c" I would say that you should look at pkg/ebpf/probes/probes.go and the initBPF function to see how they are loaded, and how perf buffers are set up. For examples of kernel-userland interaction I think looking at the decodeEvents function might help.

[rafaeldtinoco]

We're publishing a new documentation for this next release (being released today) and it will clarify much of the design answers. Maybe we can construct some sort of a "getting started" for developers, @cdelzotti would you be interested in helping there since you're already doing that anyway ? Just wondering, no formalities =).

[cdelzotti]

Oh, that would be nice as I'm still trying to figure out some stuff. What should I put inside this Getting started ?

[rafaeldtinoco]

Maybe a development "starting guide" in Tracee from your own experience ? BTW, the new documentation is in place, with things such as: https://aquasecurity.github.io/tracee/v0.8.0/deep-dive/caching-events/ which might give you an idea IF you want to pursue such "development introduction" doc (no pressure).

[cdelzotti]

Thanks, I will check that. I will take notes of what I do, and once I feel like I get things up and running I'll see if it's relevant to put it in an PR.