6

How to use the Berkeley Packet Filter (BPF) to filter function arguments in kernel? The function should be any non-inline functions, rather than only system calls. Also, it is better that the pointers in function arguments can be dereferenced for validation.

I searched the Internet but cannot find any use cases. Most of the materials only describe how to use seccomp / seccomp-BPF.

It seems that eBPF and kprobe/jprobe are integrated to implement the hooking. But I cannot find a good example on the web.

WindChaser
  • 960
  • 1
  • 10
  • 30

1 Answers1

4

eBPF is probably what you want. If you have not found them already, you should have a look at the examples provided with the bcc (BPF Compiler Collection) tools.

In particular, the example tool argdist relies on kprobes indeed and could be of some interest to you:

argdist probes functions you specify and collects parameter values into a histogram or a frequency count. This can be used to understand the distribution of values a certain parameter takes, filter and print interesting parameters without attaching a debugger, and obtain general execution statistics on various functions.

For example, suppose you want to find what allocation sizes are common in your application:

# ./argdist -p 2420 -C 'p:c:malloc(size_t size):size_t:size'
[01:42:29]
p:c:malloc(size_t size):size_t:size
       COUNT      EVENT
[01:42:30]
p:c:malloc(size_t size):size_t:size
COUNT EVENT

[…]

(extract from the argdist example uses).

For the record, most examples I found so far with eBPF were located in one of those locations:

  • Under linux/samples/bpf within the Linux kernel sources.
  • In the bcc/tools directory of bcc.
  • (For networking examples involoving tc, under iproute2/examples/tc directory in the iproute2 package sources.)
Qeole
  • 8,284
  • 1
  • 24
  • 52
  • Can it change the control-flow (e.g., directly return), if finding a bad function argument? – WindChaser Aug 28 '16 at 02:34
  • Ah, hmm. I do not think so, but could not tell for sure :-/ It can filter the arguments and retreive only the “bad” ones for example, but [return values](http://www.gossamer-threads.com/lists/linux/kernel/2088761) do not seem to interfere with the execution of the observed function. bcc's developers should be able to answer more precisely to this question — sorry! – Qeole Aug 28 '16 at 14:10