Current Dir: /usr/sbin/
[FILE] a2disconf [ edit | delete | rename ]
[FILE] a2dismod [ edit | delete | rename ]
[FILE] a2dissite [ edit | delete | rename ]
[FILE] a2enconf [ edit | delete | rename ]
[FILE] a2enmod [ edit | delete | rename ]
[FILE] a2ensite [ edit | delete | rename ]
[FILE] a2query [ edit | delete | rename ]
[FILE] aa-load [ edit | delete | rename ]
[FILE] aa-remove-unknown [ edit | delete | rename ]
[FILE] aa-status [ edit | delete | rename ]
[FILE] aa-teardown [ edit | delete | rename ]
[FILE] accessdb [ edit | delete | rename ]
[FILE] add-shell [ edit | delete | rename ]
[FILE] addgnupghome [ edit | delete | rename ]
[FILE] addgroup [ edit | delete | rename ]
[FILE] adduser [ edit | delete | rename ]
[FILE] agetty [ edit | delete | rename ]
[FILE] apache2 [ edit | delete | rename ]
[FILE] apache2ctl [ edit | delete | rename ]
[FILE] apachectl [ edit | delete | rename ]
[FILE] apparmor_parser [ edit | delete | rename ]
[FILE] apparmor_status [ edit | delete | rename ]
[FILE] applygnupgdefaults [ edit | delete | rename ]
[FILE] argdist-bpfcc [ edit | delete | rename ]
[FILE] arpd [ edit | delete | rename ]
[FILE] arptables [ edit | delete | rename ]
[FILE] arptables-nft [ edit | delete | rename ]
[FILE] arptables-nft-restore [ edit | delete | rename ]
[FILE] arptables-nft-save [ edit | delete | rename ]
[FILE] arptables-restore [ edit | delete | rename ]
[FILE] arptables-save [ edit | delete | rename ]
[FILE] badblocks [ edit | delete | rename ]
[FILE] bashreadline-bpfcc [ edit | delete | rename ]
[FILE] bashreadline.bt [ edit | delete | rename ]
[FILE] bcache-super-show [ edit | delete | rename ]
[FILE] bindsnoop-bpfcc [ edit | delete | rename ]
[FILE] biolatency-bpfcc [ edit | delete | rename ]
[FILE] biolatency-kp.bt [ edit | delete | rename ]
[FILE] biolatency.bt [ edit | delete | rename ]
[FILE] biolatpcts-bpfcc [ edit | delete | rename ]
[FILE] biopattern-bpfcc [ edit | delete | rename ]
[FILE] biosdecode [ edit | delete | rename ]
[FILE] biosnoop-bpfcc [ edit | delete | rename ]
[FILE] biosnoop.bt [ edit | delete | rename ]
[FILE] biostacks.bt [ edit | delete | rename ]
[FILE] biotop-bpfcc [ edit | delete | rename ]
[FILE] bitesize-bpfcc [ edit | delete | rename ]
[FILE] bitesize.bt [ edit | delete | rename ]
[FILE] blkdeactivate [ edit | delete | rename ]
[FILE] blkdiscard [ edit | delete | rename ]
[FILE] blkid [ edit | delete | rename ]
[FILE] blkzone [ edit | delete | rename ]
[FILE] blockdev [ edit | delete | rename ]
[FILE] bpflist-bpfcc [ edit | delete | rename ]
[FILE] bpftool [ edit | delete | rename ]
[FILE] bridge [ edit | delete | rename ]
[FILE] btrfsdist-bpfcc [ edit | delete | rename ]
[FILE] btrfsslower-bpfcc [ edit | delete | rename ]
[FILE] cachestat-bpfcc [ edit | delete | rename ]
[FILE] cachetop-bpfcc [ edit | delete | rename ]
[FILE] cache_check [ edit | delete | rename ]
[FILE] cache_dump [ edit | delete | rename ]
[FILE] cache_metadata_size [ edit | delete | rename ]
[FILE] cache_repair [ edit | delete | rename ]
[FILE] cache_restore [ edit | delete | rename ]
[FILE] cache_writeback [ edit | delete | rename ]
[FILE] capable-bpfcc [ edit | delete | rename ]
[FILE] capable.bt [ edit | delete | rename ]
[FILE] capsh [ edit | delete | rename ]
[FILE] cfdisk [ edit | delete | rename ]
[FILE] cgdisk [ edit | delete | rename ]
[FILE] chcpu [ edit | delete | rename ]
[FILE] check_forensic [ edit | delete | rename ]
[FILE] chgpasswd [ edit | delete | rename ]
[FILE] chmem [ edit | delete | rename ]
[FILE] chpasswd [ edit | delete | rename ]
[FILE] chroot [ edit | delete | rename ]
[FILE] cobjnew-bpfcc [ edit | delete | rename ]
[FILE] compactsnoop-bpfcc [ edit | delete | rename ]
[FILE] cpgr [ edit | delete | rename ]
[FILE] cppw [ edit | delete | rename ]
[FILE] cpudist-bpfcc [ edit | delete | rename ]
[FILE] cpuunclaimed-bpfcc [ edit | delete | rename ]
[FILE] cpuwalk.bt [ edit | delete | rename ]
[FILE] criticalstat-bpfcc [ edit | delete | rename ]
[FILE] cron [ edit | delete | rename ]
[FILE] cryptdisks_start [ edit | delete | rename ]
[FILE] cryptdisks_stop [ edit | delete | rename ]
[FILE] cryptsetup [ edit | delete | rename ]
[FILE] ctrlaltdel [ edit | delete | rename ]
[FILE] dbslower-bpfcc [ edit | delete | rename ]
[FILE] dbstat-bpfcc [ edit | delete | rename ]
[FILE] dcb [ edit | delete | rename ]
[FILE] dcsnoop-bpfcc [ edit | delete | rename ]
[FILE] dcsnoop.bt [ edit | delete | rename ]
[FILE] dcstat-bpfcc [ edit | delete | rename ]
[FILE] deadlock-bpfcc [ edit | delete | rename ]
[FILE] debugfs [ edit | delete | rename ]
[FILE] delgroup [ edit | delete | rename ]
[FILE] deluser [ edit | delete | rename ]
[FILE] depmod [ edit | delete | rename ]
[FILE] devlink [ edit | delete | rename ]
[FILE] dhcpcd [ edit | delete | rename ]
[FILE] dirtop-bpfcc [ edit | delete | rename ]
[FILE] dmeventd [ edit | delete | rename ]
[FILE] dmidecode [ edit | delete | rename ]
[FILE] dmsetup [ edit | delete | rename ]
[FILE] dmstats [ edit | delete | rename ]
[FILE] dosfsck [ edit | delete | rename ]
[FILE] dosfslabel [ edit | delete | rename ]
[FILE] dpkg-preconfigure [ edit | delete | rename ]
[FILE] dpkg-reconfigure [ edit | delete | rename ]
[FILE] drsnoop-bpfcc [ edit | delete | rename ]
[FILE] dumpe2fs [ edit | delete | rename ]
[FILE] e2freefrag [ edit | delete | rename ]
[FILE] e2fsck [ edit | delete | rename ]
[FILE] e2image [ edit | delete | rename ]
[FILE] e2label [ edit | delete | rename ]
[FILE] e2mmpstatus [ edit | delete | rename ]
[FILE] e2scrub [ edit | delete | rename ]
[FILE] e2scrub_all [ edit | delete | rename ]
[FILE] e2undo [ edit | delete | rename ]
[FILE] e4crypt [ edit | delete | rename ]
[FILE] e4defrag [ edit | delete | rename ]
[FILE] ebtables [ edit | delete | rename ]
[FILE] ebtables-nft [ edit | delete | rename ]
[FILE] ebtables-nft-restore [ edit | delete | rename ]
[FILE] ebtables-nft-save [ edit | delete | rename ]
[FILE] ebtables-restore [ edit | delete | rename ]
[FILE] ebtables-save [ edit | delete | rename ]
[FILE] ebtables-translate [ edit | delete | rename ]
[FILE] era_check [ edit | delete | rename ]
[FILE] era_dump [ edit | delete | rename ]
[FILE] era_invalidate [ edit | delete | rename ]
[FILE] era_restore [ edit | delete | rename ]
[FILE] escapesrc [ edit | delete | rename ]
[FILE] ethtool [ edit | delete | rename ]
[FILE] execsnoop-bpfcc [ edit | delete | rename ]
[FILE] execsnoop.bt [ edit | delete | rename ]
[FILE] exitsnoop-bpfcc [ edit | delete | rename ]
[FILE] ext4dist-bpfcc [ edit | delete | rename ]
[FILE] ext4slower-bpfcc [ edit | delete | rename ]
[FILE] faillock [ edit | delete | rename ]
[FILE] fatlabel [ edit | delete | rename ]
[FILE] fdisk [ edit | delete | rename ]
[FILE] filefrag [ edit | delete | rename ]
[FILE] filegone-bpfcc [ edit | delete | rename ]
[FILE] filelife-bpfcc [ edit | delete | rename ]
[FILE] fileslower-bpfcc [ edit | delete | rename ]
[FILE] filetop-bpfcc [ edit | delete | rename ]
[FILE] findfs [ edit | delete | rename ]
[FILE] fixparts [ edit | delete | rename ]
[FILE] fsadm [ edit | delete | rename ]
[FILE] fsck [ edit | delete | rename ]
[FILE] fsck.btrfs [ edit | delete | rename ]
[FILE] fsck.cramfs [ edit | delete | rename ]
[FILE] fsck.ext2 [ edit | delete | rename ]
[FILE] fsck.ext3 [ edit | delete | rename ]
[FILE] fsck.ext4 [ edit | delete | rename ]
[FILE] fsck.fat [ edit | delete | rename ]
[FILE] fsck.minix [ edit | delete | rename ]
[FILE] fsck.msdos [ edit | delete | rename ]
[FILE] fsck.vfat [ edit | delete | rename ]
[FILE] fsck.xfs [ edit | delete | rename ]
[FILE] fsfreeze [ edit | delete | rename ]
[FILE] fstab-decode [ edit | delete | rename ]
[FILE] fstrim [ edit | delete | rename ]
[FILE] funccount-bpfcc [ edit | delete | rename ]
[FILE] funcinterval-bpfcc [ edit | delete | rename ]
[FILE] funclatency-bpfcc [ edit | delete | rename ]
[FILE] funcslower-bpfcc [ edit | delete | rename ]
[FILE] gdisk [ edit | delete | rename ]
[FILE] genccode [ edit | delete | rename ]
[FILE] gencmn [ edit | delete | rename ]
[FILE] genl [ edit | delete | rename ]
[FILE] gennorm2 [ edit | delete | rename ]
[FILE] gensprep [ edit | delete | rename ]
[FILE] getcap [ edit | delete | rename ]
[FILE] gethostlatency-bpfcc [ edit | delete | rename ]
[FILE] gethostlatency.bt [ edit | delete | rename ]
[FILE] getpcaps [ edit | delete | rename ]
[FILE] getty [ edit | delete | rename ]
[FILE] groupadd [ edit | delete | rename ]
[FILE] groupdel [ edit | delete | rename ]
[FILE] groupmems [ edit | delete | rename ]
[FILE] groupmod [ edit | delete | rename ]
[FILE] grpck [ edit | delete | rename ]
[FILE] grpconv [ edit | delete | rename ]
[FILE] grpunconv [ edit | delete | rename ]
[FILE] grub-bios-setup [ edit | delete | rename ]
[FILE] grub-install [ edit | delete | rename ]
[FILE] grub-macbless [ edit | delete | rename ]
[FILE] grub-mkconfig [ edit | delete | rename ]
[FILE] grub-mkdevicemap [ edit | delete | rename ]
[FILE] grub-probe [ edit | delete | rename ]
[FILE] grub-reboot [ edit | delete | rename ]
[FILE] grub-set-default [ edit | delete | rename ]
[FILE] halt [ edit | delete | rename ]
[FILE] hardirqs-bpfcc [ edit | delete | rename ]
[FILE] hdparm [ edit | delete | rename ]
[FILE] httxt2dbm [ edit | delete | rename ]
[FILE] iconvconfig [ edit | delete | rename ]
[FILE] icupkg [ edit | delete | rename ]
[FILE] init [ edit | delete | rename ]
[FILE] inject-bpfcc [ edit | delete | rename ]
[FILE] insmod [ edit | delete | rename ]
[FILE] install-sgmlcatalog [ edit | delete | rename ]
[FILE] installkernel [ edit | delete | rename ]
[FILE] integritysetup [ edit | delete | rename ]
[FILE] invoke-rc.d [ edit | delete | rename ]
[FILE] ip [ edit | delete | rename ]
[FILE] ip6tables [ edit | delete | rename ]
[FILE] ip6tables-apply [ edit | delete | rename ]
[FILE] ip6tables-legacy [ edit | delete | rename ]
[FILE] ip6tables-legacy-restore [ edit | delete | rename ]
[FILE] ip6tables-legacy-save [ edit | delete | rename ]
[FILE] ip6tables-nft [ edit | delete | rename ]
[FILE] ip6tables-nft-restore [ edit | delete | rename ]
[FILE] ip6tables-nft-save [ edit | delete | rename ]
[FILE] ip6tables-restore [ edit | delete | rename ]
[FILE] ip6tables-restore-translate [ edit | delete | rename ]
[FILE] ip6tables-save [ edit | delete | rename ]
[FILE] ip6tables-translate [ edit | delete | rename ]
[FILE] iptables [ edit | delete | rename ]
[FILE] iptables-apply [ edit | delete | rename ]
[FILE] iptables-legacy [ edit | delete | rename ]
[FILE] iptables-legacy-restore [ edit | delete | rename ]
[FILE] iptables-legacy-save [ edit | delete | rename ]
[FILE] iptables-nft [ edit | delete | rename ]
[FILE] iptables-nft-restore [ edit | delete | rename ]
[FILE] iptables-nft-save [ edit | delete | rename ]
[FILE] iptables-restore [ edit | delete | rename ]
[FILE] iptables-restore-translate [ edit | delete | rename ]
[FILE] iptables-save [ edit | delete | rename ]
[FILE] iptables-translate [ edit | delete | rename ]
[FILE] iscsi-iname [ edit | delete | rename ]
[FILE] iscsiadm [ edit | delete | rename ]
[FILE] iscsid [ edit | delete | rename ]
[FILE] iscsistart [ edit | delete | rename ]
[FILE] iscsi_discovery [ edit | delete | rename ]
[FILE] isosize [ edit | delete | rename ]
[FILE] javacalls-bpfcc [ edit | delete | rename ]
[FILE] javaflow-bpfcc [ edit | delete | rename ]
[FILE] javagc-bpfcc [ edit | delete | rename ]
[FILE] javaobjnew-bpfcc [ edit | delete | rename ]
[FILE] javastat-bpfcc [ edit | delete | rename ]
[FILE] javathreads-bpfcc [ edit | delete | rename ]
[FILE] kbdrate [ edit | delete | rename ]
[FILE] killall5 [ edit | delete | rename ]
[FILE] killsnoop-bpfcc [ edit | delete | rename ]
[FILE] killsnoop.bt [ edit | delete | rename ]
[FILE] klockstat-bpfcc [ edit | delete | rename ]
[FILE] kpartx [ edit | delete | rename ]
[FILE] kvmexit-bpfcc [ edit | delete | rename ]
[FILE] ldattach [ edit | delete | rename ]
[FILE] ldconfig [ edit | delete | rename ]
[FILE] ldconfig.real [ edit | delete | rename ]
[FILE] llcstat-bpfcc [ edit | delete | rename ]
[FILE] loads.bt [ edit | delete | rename ]
[FILE] locale-gen [ edit | delete | rename ]
[FILE] logrotate [ edit | delete | rename ]
[FILE] logsave [ edit | delete | rename ]
[FILE] losetup [ edit | delete | rename ]
[FILE] lsmod [ edit | delete | rename ]
[FILE] luksformat [ edit | delete | rename ]
[FILE] lvchange [ edit | delete | rename ]
[FILE] lvconvert [ edit | delete | rename ]
[FILE] lvcreate [ edit | delete | rename ]
[FILE] lvdisplay [ edit | delete | rename ]
[FILE] lvextend [ edit | delete | rename ]
[FILE] lvm [ edit | delete | rename ]
[FILE] lvmconfig [ edit | delete | rename ]
[FILE] lvmdiskscan [ edit | delete | rename ]
[FILE] lvmdump [ edit | delete | rename ]
[FILE] lvmpolld [ edit | delete | rename ]
[FILE] lvmsadc [ edit | delete | rename ]
[FILE] lvmsar [ edit | delete | rename ]
[FILE] lvreduce [ edit | delete | rename ]
[FILE] lvremove [ edit | delete | rename ]
[FILE] lvrename [ edit | delete | rename ]
[FILE] lvresize [ edit | delete | rename ]
[FILE] lvs [ edit | delete | rename ]
[FILE] lvscan [ edit | delete | rename ]
[FILE] lxc [ edit | delete | rename ]
[FILE] lxd [ edit | delete | rename ]
[FILE] make-bcache [ edit | delete | rename ]
[FILE] make-ssl-cert [ edit | delete | rename ]
[FILE] mdadm [ edit | delete | rename ]
[FILE] mdflush-bpfcc [ edit | delete | rename ]
[FILE] mdflush.bt [ edit | delete | rename ]
[FILE] mdmon [ edit | delete | rename ]
[FILE] memleak-bpfcc [ edit | delete | rename ]
[FILE] mkdosfs [ edit | delete | rename ]
[FILE] mke2fs [ edit | delete | rename ]
[FILE] mkfs [ edit | delete | rename ]
[FILE] mkfs.bfs [ edit | delete | rename ]
[FILE] mkfs.btrfs [ edit | delete | rename ]
[FILE] mkfs.cramfs [ edit | delete | rename ]
[FILE] mkfs.ext2 [ edit | delete | rename ]
[FILE] mkfs.ext3 [ edit | delete | rename ]
[FILE] mkfs.ext4 [ edit | delete | rename ]
[FILE] mkfs.fat [ edit | delete | rename ]
[FILE] mkfs.minix [ edit | delete | rename ]
[FILE] mkfs.msdos [ edit | delete | rename ]
[FILE] mkfs.ntfs [ edit | delete | rename ]
[FILE] mkfs.vfat [ edit | delete | rename ]
[FILE] mkfs.xfs [ edit | delete | rename ]
[FILE] mkhomedir_helper [ edit | delete | rename ]
[FILE] mkinitramfs [ edit | delete | rename ]
[FILE] mklost+found [ edit | delete | rename ]
[FILE] mkntfs [ edit | delete | rename ]
[FILE] mkswap [ edit | delete | rename ]
[FILE] ModemManager [ edit | delete | rename ]
[FILE] modinfo [ edit | delete | rename ]
[FILE] modprobe [ edit | delete | rename ]
[FILE] mount.fuse [ edit | delete | rename ]
[FILE] mount.fuse3 [ edit | delete | rename ]
[FILE] mount.lowntfs-3g [ edit | delete | rename ]
[FILE] mount.ntfs [ edit | delete | rename ]
[FILE] mount.ntfs-3g [ edit | delete | rename ]
[FILE] mountsnoop-bpfcc [ edit | delete | rename ]
[FILE] mpathpersist [ edit | delete | rename ]
[FILE] multipath [ edit | delete | rename ]
[FILE] multipathc [ edit | delete | rename ]
[FILE] multipathd [ edit | delete | rename ]
[FILE] mysqld [ edit | delete | rename ]
[FILE] mysqld_qslower-bpfcc [ edit | delete | rename ]
[FILE] naptime.bt [ edit | delete | rename ]
[FILE] needrestart [ edit | delete | rename ]
[FILE] netplan [ edit | delete | rename ]
[FILE] netqtop-bpfcc [ edit | delete | rename ]
[FILE] newusers [ edit | delete | rename ]
[FILE] nfnl_osf [ edit | delete | rename ]
[FILE] nfsdist-bpfcc [ edit | delete | rename ]
[FILE] nfsslower-bpfcc [ edit | delete | rename ]
[FILE] nft [ edit | delete | rename ]
[FILE] nginx [ edit | delete | rename ]
[FILE] nodegc-bpfcc [ edit | delete | rename ]
[FILE] nodestat-bpfcc [ edit | delete | rename ]
[FILE] nologin [ edit | delete | rename ]
[FILE] ntfsclone [ edit | delete | rename ]
[FILE] ntfscp [ edit | delete | rename ]
[FILE] ntfslabel [ edit | delete | rename ]
[FILE] ntfsresize [ edit | delete | rename ]
[FILE] ntfsundelete [ edit | delete | rename ]
[FILE] offcputime-bpfcc [ edit | delete | rename ]
[FILE] offwaketime-bpfcc [ edit | delete | rename ]
[FILE] on_ac_power [ edit | delete | rename ]
[FILE] oomkill-bpfcc [ edit | delete | rename ]
[FILE] oomkill.bt [ edit | delete | rename ]
[FILE] opendkim [ edit | delete | rename ]
[FILE] opendkim-atpszone [ edit | delete | rename ]
[FILE] opendkim-expire [ edit | delete | rename ]
[FILE] opendkim-gengraphs [ edit | delete | rename ]
[FILE] opendkim-genkey [ edit | delete | rename ]
[FILE] opendkim-genstats [ edit | delete | rename ]
[FILE] opendkim-genzone [ edit | delete | rename ]
[FILE] opendkim-importstats [ edit | delete | rename ]
[FILE] opendkim-stats [ edit | delete | rename ]
[FILE] opendkim-testkey [ edit | delete | rename ]
[FILE] opendkim-testmsg [ edit | delete | rename ]
[FILE] opensnoop-bpfcc [ edit | delete | rename ]
[FILE] opensnoop.bt [ edit | delete | rename ]
[FILE] overlayroot-chroot [ edit | delete | rename ]
[FILE] ownership [ edit | delete | rename ]
[FILE] pam-auth-update [ edit | delete | rename ]
[FILE] pam_extrausers_chkpwd [ edit | delete | rename ]
[FILE] pam_extrausers_update [ edit | delete | rename ]
[FILE] pam_getenv [ edit | delete | rename ]
[FILE] pam_namespace_helper [ edit | delete | rename ]
[FILE] pam_timestamp_check [ edit | delete | rename ]
[FILE] paperconfig [ edit | delete | rename ]
[FILE] parted [ edit | delete | rename ]
[FILE] partprobe [ edit | delete | rename ]
[FILE] pdata_tools [ edit | delete | rename ]
[FILE] perlcalls-bpfcc [ edit | delete | rename ]
[FILE] perlflow-bpfcc [ edit | delete | rename ]
[FILE] perlstat-bpfcc [ edit | delete | rename ]
[FILE] pg_updatedicts [ edit | delete | rename ]
[FILE] phpcalls-bpfcc [ edit | delete | rename ]
[FILE] phpdismod [ edit | delete | rename ]
[FILE] phpenmod [ edit | delete | rename ]
[FILE] phpflow-bpfcc [ edit | delete | rename ]
[FILE] phpquery [ edit | delete | rename ]
[FILE] phpstat-bpfcc [ edit | delete | rename ]
[FILE] pidpersec-bpfcc [ edit | delete | rename ]
[FILE] pidpersec.bt [ edit | delete | rename ]
[FILE] pivot_root [ edit | delete | rename ]
[FILE] plocate-build [ edit | delete | rename ]
[FILE] plymouthd [ edit | delete | rename ]
[FILE] postalias [ edit | delete | rename ]
[FILE] postcat [ edit | delete | rename ]
[FILE] postconf [ edit | delete | rename ]
[FILE] postdrop [ edit | delete | rename ]
[FILE] postfix [ edit | delete | rename ]
[FILE] postfix-add-filter [ edit | delete | rename ]
[FILE] postfix-add-policy [ edit | delete | rename ]
[FILE] postfix-collate [ edit | delete | rename ]
[FILE] postkick [ edit | delete | rename ]
[FILE] postlock [ edit | delete | rename ]
[FILE] postlog [ edit | delete | rename ]
[FILE] postmap [ edit | delete | rename ]
[FILE] postmulti [ edit | delete | rename ]
[FILE] postqueue [ edit | delete | rename ]
[FILE] postsuper [ edit | delete | rename ]
[FILE] posttls-finger [ edit | delete | rename ]
[FILE] poweroff [ edit | delete | rename ]
[FILE] ppchcalls-bpfcc [ edit | delete | rename ]
[FILE] profile-bpfcc [ edit | delete | rename ]
[FILE] pvchange [ edit | delete | rename ]
[FILE] pvck [ edit | delete | rename ]
[FILE] pvcreate [ edit | delete | rename ]
[FILE] pvdisplay [ edit | delete | rename ]
[FILE] pvmove [ edit | delete | rename ]
[FILE] pvremove [ edit | delete | rename ]
[FILE] pvresize [ edit | delete | rename ]
[FILE] pvs [ edit | delete | rename ]
[FILE] pvscan [ edit | delete | rename ]
[FILE] pwck [ edit | delete | rename ]
[FILE] pwconv [ edit | delete | rename ]
[FILE] pwhistory_helper [ edit | delete | rename ]
[FILE] pwunconv [ edit | delete | rename ]
[FILE] pythoncalls-bpfcc [ edit | delete | rename ]
[FILE] pythonflow-bpfcc [ edit | delete | rename ]
[FILE] pythongc-bpfcc [ edit | delete | rename ]
[FILE] pythonstat-bpfcc [ edit | delete | rename ]
[FILE] qemu-ga [ edit | delete | rename ]
[FILE] qmqp-sink [ edit | delete | rename ]
[FILE] qmqp-source [ edit | delete | rename ]
[FILE] qshape [ edit | delete | rename ]
[FILE] rdmaucma-bpfcc [ edit | delete | rename ]
[FILE] readahead-bpfcc [ edit | delete | rename ]
[FILE] readprofile [ edit | delete | rename ]
[FILE] reboot [ edit | delete | rename ]
[FILE] remove-shell [ edit | delete | rename ]
[FILE] reset-trace-bpfcc [ edit | delete | rename ]
[FILE] resize2fs [ edit | delete | rename ]
[FILE] resolvconf [ edit | delete | rename ]
[FILE] rmail [ edit | delete | rename ]
[FILE] rmmod [ edit | delete | rename ]
[FILE] rmt [ edit | delete | rename ]
[FILE] rmt-tar [ edit | delete | rename ]
[FILE] rsyslogd [ edit | delete | rename ]
[FILE] rtacct [ edit | delete | rename ]
[FILE] rtcwake [ edit | delete | rename ]
[FILE] rtmon [ edit | delete | rename ]
[FILE] rubycalls-bpfcc [ edit | delete | rename ]
[FILE] rubyflow-bpfcc [ edit | delete | rename ]
[FILE] rubygc-bpfcc [ edit | delete | rename ]
[FILE] rubyobjnew-bpfcc [ edit | delete | rename ]
[FILE] rubystat-bpfcc [ edit | delete | rename ]
[FILE] runlevel [ edit | delete | rename ]
[FILE] runqlat-bpfcc [ edit | delete | rename ]
[FILE] runqlat.bt [ edit | delete | rename ]
[FILE] runqlen-bpfcc [ edit | delete | rename ]
[FILE] runqlen.bt [ edit | delete | rename ]
[FILE] runqslower-bpfcc [ edit | delete | rename ]
[FILE] runuser [ edit | delete | rename ]
[FILE] sendmail [ edit | delete | rename ]
[FILE] service [ edit | delete | rename ]
[FILE] setcap [ edit | delete | rename ]
[FILE] setuids.bt [ edit | delete | rename ]
[FILE] setvesablank [ edit | delete | rename ]
[FILE] setvtrgb [ edit | delete | rename ]
[FILE] sfdisk [ edit | delete | rename ]
[FILE] sgdisk [ edit | delete | rename ]
[FILE] shadowconfig [ edit | delete | rename ]
[FILE] shmsnoop-bpfcc [ edit | delete | rename ]
[FILE] shutdown [ edit | delete | rename ]
[FILE] slabratetop-bpfcc [ edit | delete | rename ]
[FILE] smtp-sink [ edit | delete | rename ]
[FILE] smtp-source [ edit | delete | rename ]
[FILE] sofdsnoop-bpfcc [ edit | delete | rename ]
[FILE] softirqs-bpfcc [ edit | delete | rename ]
[FILE] solisten-bpfcc [ edit | delete | rename ]
[FILE] split-logfile [ edit | delete | rename ]
[FILE] sshd [ edit | delete | rename ]
[FILE] ssllatency.bt [ edit | delete | rename ]
[FILE] sslsniff-bpfcc [ edit | delete | rename ]
[FILE] sslsnoop.bt [ edit | delete | rename ]
[FILE] stackcount-bpfcc [ edit | delete | rename ]
[FILE] start-stop-daemon [ edit | delete | rename ]
[FILE] statsnoop-bpfcc [ edit | delete | rename ]
[FILE] statsnoop.bt [ edit | delete | rename ]
[FILE] sudo_logsrvd [ edit | delete | rename ]
[FILE] sudo_sendlog [ edit | delete | rename ]
[FILE] sulogin [ edit | delete | rename ]
[FILE] swapin.bt [ edit | delete | rename ]
[FILE] swaplabel [ edit | delete | rename ]
[FILE] swapoff [ edit | delete | rename ]
[FILE] swapon [ edit | delete | rename ]
[FILE] switch_root [ edit | delete | rename ]
[FILE] syncsnoop-bpfcc [ edit | delete | rename ]
[FILE] syncsnoop.bt [ edit | delete | rename ]
[FILE] syscount-bpfcc [ edit | delete | rename ]
[FILE] syscount.bt [ edit | delete | rename ]
[FILE] sysctl [ edit | delete | rename ]
[FILE] tarcat [ edit | delete | rename ]
[FILE] tc [ edit | delete | rename ]
[FILE] tclcalls-bpfcc [ edit | delete | rename ]
[FILE] tclflow-bpfcc [ edit | delete | rename ]
[FILE] tclobjnew-bpfcc [ edit | delete | rename ]
[FILE] tclstat-bpfcc [ edit | delete | rename ]
[FILE] tcpaccept-bpfcc [ edit | delete | rename ]
[FILE] tcpaccept.bt [ edit | delete | rename ]
[FILE] tcpcong-bpfcc [ edit | delete | rename ]
[FILE] tcpconnect-bpfcc [ edit | delete | rename ]
[FILE] tcpconnect.bt [ edit | delete | rename ]
[FILE] tcpconnlat-bpfcc [ edit | delete | rename ]
[FILE] tcpdrop-bpfcc [ edit | delete | rename ]
[FILE] tcpdrop.bt [ edit | delete | rename ]
[FILE] tcplife-bpfcc [ edit | delete | rename ]
[FILE] tcplife.bt [ edit | delete | rename ]
[FILE] tcpretrans-bpfcc [ edit | delete | rename ]
[FILE] tcpretrans.bt [ edit | delete | rename ]
[FILE] tcprtt-bpfcc [ edit | delete | rename ]
[FILE] tcpstates-bpfcc [ edit | delete | rename ]
[FILE] tcpsubnet-bpfcc [ edit | delete | rename ]
[FILE] tcpsynbl-bpfcc [ edit | delete | rename ]
[FILE] tcpsynbl.bt [ edit | delete | rename ]
[FILE] tcptop-bpfcc [ edit | delete | rename ]
[FILE] tcptracer-bpfcc [ edit | delete | rename ]
[FILE] telinit [ edit | delete | rename ]
[FILE] thin_check [ edit | delete | rename ]
[FILE] thin_delta [ edit | delete | rename ]
[FILE] thin_dump [ edit | delete | rename ]
[FILE] thin_ls [ edit | delete | rename ]
[FILE] thin_metadata_size [ edit | delete | rename ]
[FILE] thin_repair [ edit | delete | rename ]
[FILE] thin_restore [ edit | delete | rename ]
[FILE] thin_rmap [ edit | delete | rename ]
[FILE] thin_trim [ edit | delete | rename ]
[FILE] threadsnoop-bpfcc [ edit | delete | rename ]
[FILE] threadsnoop.bt [ edit | delete | rename ]
[FILE] tipc [ edit | delete | rename ]
[FILE] tplist-bpfcc [ edit | delete | rename ]
[FILE] trace-bpfcc [ edit | delete | rename ]
[FILE] ttysnoop-bpfcc [ edit | delete | rename ]
[FILE] tune2fs [ edit | delete | rename ]
[FILE] ucalls [ edit | delete | rename ]
[FILE] uflow [ edit | delete | rename ]
[FILE] ufw [ edit | delete | rename ]
[FILE] ugc [ edit | delete | rename ]
[FILE] umount.udisks2 [ edit | delete | rename ]
[FILE] undump.bt [ edit | delete | rename ]
[FILE] unix_chkpwd [ edit | delete | rename ]
[FILE] unix_update [ edit | delete | rename ]
[FILE] uobjnew [ edit | delete | rename ]
[FILE] update-ca-certificates [ edit | delete | rename ]
[FILE] update-catalog [ edit | delete | rename ]
[FILE] update-fonts-alias [ edit | delete | rename ]
[FILE] update-fonts-dir [ edit | delete | rename ]
[FILE] update-fonts-scale [ edit | delete | rename ]
[FILE] update-grub [ edit | delete | rename ]
[FILE] update-grub-gfxpayload [ edit | delete | rename ]
[FILE] update-grub2 [ edit | delete | rename ]
[FILE] update-gsfontmap [ edit | delete | rename ]
[FILE] update-icon-caches [ edit | delete | rename ]
[FILE] update-ieee-data [ edit | delete | rename ]
[FILE] update-info-dir [ edit | delete | rename ]
[FILE] update-initramfs [ edit | delete | rename ]
[FILE] update-locale [ edit | delete | rename ]
[FILE] update-mime [ edit | delete | rename ]
[FILE] update-passwd [ edit | delete | rename ]
[FILE] update-pciids [ edit | delete | rename ]
[FILE] update-rc.d [ edit | delete | rename ]
[FILE] update-secureboot-policy [ edit | delete | rename ]
[FILE] update-shells [ edit | delete | rename ]
[FILE] update-xmlcatalog [ edit | delete | rename ]
[FILE] updatedb.plocate [ edit | delete | rename ]
[FILE] upgrade-from-grub-legacy [ edit | delete | rename ]
[FILE] usb_modeswitch [ edit | delete | rename ]
[FILE] usb_modeswitch_dispatcher [ edit | delete | rename ]
[FILE] useradd [ edit | delete | rename ]
[FILE] userdel [ edit | delete | rename ]
[FILE] usermod [ edit | delete | rename ]
[FILE] ustat [ edit | delete | rename ]
[FILE] uthreads [ edit | delete | rename ]
[FILE] uuidd [ edit | delete | rename ]
[FILE] validlocale [ edit | delete | rename ]
[FILE] vcstime [ edit | delete | rename ]
[FILE] vdpa [ edit | delete | rename ]
[FILE] veritysetup [ edit | delete | rename ]
[FILE] vfscount-bpfcc [ edit | delete | rename ]
[FILE] vfscount.bt [ edit | delete | rename ]
[FILE] vfsstat-bpfcc [ edit | delete | rename ]
[FILE] vfsstat.bt [ edit | delete | rename ]
[FILE] vgcfgbackup [ edit | delete | rename ]
[FILE] vgcfgrestore [ edit | delete | rename ]
[FILE] vgchange [ edit | delete | rename ]
[FILE] vgck [ edit | delete | rename ]
[FILE] vgconvert [ edit | delete | rename ]
[FILE] vgcreate [ edit | delete | rename ]
[FILE] vgdisplay [ edit | delete | rename ]
[FILE] vgexport [ edit | delete | rename ]
[FILE] vgextend [ edit | delete | rename ]
[FILE] vgimport [ edit | delete | rename ]
[FILE] vgimportclone [ edit | delete | rename ]
[FILE] vgmerge [ edit | delete | rename ]
[FILE] vgmknodes [ edit | delete | rename ]
[FILE] vgreduce [ edit | delete | rename ]
[FILE] vgremove [ edit | delete | rename ]
[FILE] vgrename [ edit | delete | rename ]
[FILE] vgs [ edit | delete | rename ]
[FILE] vgscan [ edit | delete | rename ]
[FILE] vgsplit [ edit | delete | rename ]
[FILE] vigr [ edit | delete | rename ]
[FILE] vipw [ edit | delete | rename ]
[FILE] virtiostat-bpfcc [ edit | delete | rename ]
[FILE] visudo [ edit | delete | rename ]
[FILE] vpddecode [ edit | delete | rename ]
[FILE] wakeuptime-bpfcc [ edit | delete | rename ]
[FILE] wipefs [ edit | delete | rename ]
[FILE] writeback.bt [ edit | delete | rename ]
[FILE] xfsdist-bpfcc [ edit | delete | rename ]
[FILE] xfsdist.bt [ edit | delete | rename ]
[FILE] xfsslower-bpfcc [ edit | delete | rename ]
[FILE] xfs_admin [ edit | delete | rename ]
[FILE] xfs_bmap [ edit | delete | rename ]
[FILE] xfs_copy [ edit | delete | rename ]
[FILE] xfs_db [ edit | delete | rename ]
[FILE] xfs_estimate [ edit | delete | rename ]
[FILE] xfs_freeze [ edit | delete | rename ]
[FILE] xfs_fsr [ edit | delete | rename ]
[FILE] xfs_growfs [ edit | delete | rename ]
[FILE] xfs_info [ edit | delete | rename ]
[FILE] xfs_io [ edit | delete | rename ]
[FILE] xfs_logprint [ edit | delete | rename ]
[FILE] xfs_mdrestore [ edit | delete | rename ]
[FILE] xfs_metadump [ edit | delete | rename ]
[FILE] xfs_mkfile [ edit | delete | rename ]
[FILE] xfs_ncheck [ edit | delete | rename ]
[FILE] xfs_quota [ edit | delete | rename ]
[FILE] xfs_repair [ edit | delete | rename ]
[FILE] xfs_rtcp [ edit | delete | rename ]
[FILE] xfs_scrub [ edit | delete | rename ]
[FILE] xfs_scrub_all [ edit | delete | rename ]
[FILE] xfs_spaceman [ edit | delete | rename ]
[FILE] xtables-legacy-multi [ edit | delete | rename ]
[FILE] xtables-monitor [ edit | delete | rename ]
[FILE] xtables-nft-multi [ edit | delete | rename ]
[FILE] zerofree [ edit | delete | rename ]
[FILE] zfsdist-bpfcc [ edit | delete | rename ]
[FILE] zfsslower-bpfcc [ edit | delete | rename ]
[FILE] zic [ edit | delete | rename ]
[FILE] zramctl [ edit | delete | rename ]
Viewing: /usr/sbin/mountsnoop-bpfcc
#! /usr/bin/python3
#
# mountsnoop Trace mount() and umount syscalls.
# For Linux, uses BCC, eBPF. Embedded C.
#
# USAGE: mountsnoop [-h]
#
# Copyright (c) 2016 Facebook, Inc.
# Licensed under the Apache License, Version 2.0 (the "License")
#
# 14-Oct-2016 Omar Sandoval Created this.
from __future__ import print_function
import argparse
import bcc
from bcc.containers import filter_by_containers
import ctypes
import errno
import functools
import sys
bpf_text = r"""
#include <uapi/linux/ptrace.h>
#include <linux/sched.h>
#include <linux/nsproxy.h>
#include <linux/ns_common.h>
/*
* XXX: struct mnt_namespace is defined in fs/mount.h, which is private to the
* VFS and not installed in any kernel-devel packages. So, let's duplicate the
* important part of the definition. There are actually more members in the
* real struct, but we don't need them, and they're more likely to change.
*
* To add support for --selector option, we need to call filter_by_containers().
* But this function adds code which defines struct mnt_namespace.
* To avoid having this structure twice, we define MNT_NAMESPACE_DEFINED in
* filter_by_containers(), then here we check if macro is already defined before
* adding struct definition.
*/
#ifndef MNT_NAMESPACE_DEFINED
struct mnt_namespace {
// This field was removed in https://github.com/torvalds/linux/commit/1a7b8969e664d6af328f00fe6eb7aabd61a71d13
#if LINUX_VERSION_CODE < KERNEL_VERSION(5, 11, 0)
atomic_t count;
#endif
struct ns_common ns;
};
#endif /* !MNT_NAMESPACE_DEFINED */
/*
* XXX: this could really use first-class string support in BPF. target is a
* NUL-terminated path up to PATH_MAX in length. source and type are
* NUL-terminated strings up to PAGE_SIZE in length. data is a weird case: it's
* almost always a NUL-terminated string, but for some filesystems (e.g., older
* NFS variants), it's a binary structure with plenty of NUL bytes, so the
* kernel always copies up to PAGE_SIZE bytes, stopping when it hits a fault.
*
* The best we can do with the existing BPF helpers is to copy as much of each
* argument as we can. Our stack space is limited, and we need to leave some
* headroom for the rest of the function, so this should be a decent value.
*/
#define MAX_STR_LEN 412
enum event_type {
EVENT_MOUNT,
EVENT_MOUNT_SOURCE,
EVENT_MOUNT_TARGET,
EVENT_MOUNT_TYPE,
EVENT_MOUNT_DATA,
EVENT_MOUNT_RET,
EVENT_UMOUNT,
EVENT_UMOUNT_TARGET,
EVENT_UMOUNT_RET,
};
struct data_t {
enum event_type type;
pid_t pid, tgid;
union {
/* EVENT_MOUNT, EVENT_UMOUNT */
struct {
/* current->nsproxy->mnt_ns->ns.inum */
unsigned int mnt_ns;
char comm[TASK_COMM_LEN];
char pcomm[TASK_COMM_LEN];
pid_t ppid;
unsigned long flags;
} enter;
/*
* EVENT_MOUNT_SOURCE, EVENT_MOUNT_TARGET, EVENT_MOUNT_TYPE,
* EVENT_MOUNT_DATA, EVENT_UMOUNT_TARGET
*/
char str[MAX_STR_LEN];
/* EVENT_MOUNT_RET, EVENT_UMOUNT_RET */
int retval;
};
};
BPF_PERF_OUTPUT(events);
int syscall__mount(struct pt_regs *ctx, char __user *source,
char __user *target, char __user *type,
unsigned long flags, char __user *data)
{
struct data_t event = {};
struct task_struct *task;
struct nsproxy *nsproxy;
struct mnt_namespace *mnt_ns;
if (container_should_be_filtered()) {
return 0;
}
event.pid = bpf_get_current_pid_tgid() & 0xffffffff;
event.tgid = bpf_get_current_pid_tgid() >> 32;
event.type = EVENT_MOUNT;
bpf_get_current_comm(event.enter.comm, sizeof(event.enter.comm));
event.enter.flags = flags;
task = (struct task_struct *)bpf_get_current_task();
event.enter.ppid = task->real_parent->tgid;
bpf_probe_read_kernel_str(&event.enter.pcomm, TASK_COMM_LEN, task->real_parent->comm);
nsproxy = task->nsproxy;
mnt_ns = nsproxy->mnt_ns;
event.enter.mnt_ns = mnt_ns->ns.inum;
events.perf_submit(ctx, &event, sizeof(event));
event.type = EVENT_MOUNT_SOURCE;
__builtin_memset(event.str, 0, sizeof(event.str));
bpf_probe_read_user(event.str, sizeof(event.str), source);
events.perf_submit(ctx, &event, sizeof(event));
event.type = EVENT_MOUNT_TARGET;
__builtin_memset(event.str, 0, sizeof(event.str));
bpf_probe_read_user(event.str, sizeof(event.str), target);
events.perf_submit(ctx, &event, sizeof(event));
event.type = EVENT_MOUNT_TYPE;
__builtin_memset(event.str, 0, sizeof(event.str));
bpf_probe_read_user(event.str, sizeof(event.str), type);
events.perf_submit(ctx, &event, sizeof(event));
event.type = EVENT_MOUNT_DATA;
__builtin_memset(event.str, 0, sizeof(event.str));
bpf_probe_read_user(event.str, sizeof(event.str), data);
events.perf_submit(ctx, &event, sizeof(event));
return 0;
}
int do_ret_sys_mount(struct pt_regs *ctx)
{
struct data_t event = {};
event.type = EVENT_MOUNT_RET;
event.pid = bpf_get_current_pid_tgid() & 0xffffffff;
event.tgid = bpf_get_current_pid_tgid() >> 32;
event.retval = PT_REGS_RC(ctx);
events.perf_submit(ctx, &event, sizeof(event));
return 0;
}
int syscall__umount(struct pt_regs *ctx, char __user *target, int flags)
{
struct data_t event = {};
struct task_struct *task;
struct nsproxy *nsproxy;
struct mnt_namespace *mnt_ns;
if (container_should_be_filtered()) {
return 0;
}
event.pid = bpf_get_current_pid_tgid() & 0xffffffff;
event.tgid = bpf_get_current_pid_tgid() >> 32;
event.type = EVENT_UMOUNT;
bpf_get_current_comm(event.enter.comm, sizeof(event.enter.comm));
event.enter.flags = flags;
task = (struct task_struct *)bpf_get_current_task();
event.enter.ppid = task->real_parent->tgid;
bpf_probe_read_kernel_str(&event.enter.pcomm, TASK_COMM_LEN, task->real_parent->comm);
nsproxy = task->nsproxy;
mnt_ns = nsproxy->mnt_ns;
event.enter.mnt_ns = mnt_ns->ns.inum;
events.perf_submit(ctx, &event, sizeof(event));
event.type = EVENT_UMOUNT_TARGET;
__builtin_memset(event.str, 0, sizeof(event.str));
bpf_probe_read_user(event.str, sizeof(event.str), target);
events.perf_submit(ctx, &event, sizeof(event));
return 0;
}
int do_ret_sys_umount(struct pt_regs *ctx)
{
struct data_t event = {};
event.type = EVENT_UMOUNT_RET;
event.pid = bpf_get_current_pid_tgid() & 0xffffffff;
event.tgid = bpf_get_current_pid_tgid() >> 32;
event.retval = PT_REGS_RC(ctx);
events.perf_submit(ctx, &event, sizeof(event));
return 0;
}
"""
# sys/mount.h
MS_MGC_VAL = 0xc0ed0000
MS_MGC_MSK = 0xffff0000
MOUNT_FLAGS = [
('MS_RDONLY', 1),
('MS_NOSUID', 2),
('MS_NODEV', 4),
('MS_NOEXEC', 8),
('MS_SYNCHRONOUS', 16),
('MS_REMOUNT', 32),
('MS_MANDLOCK', 64),
('MS_DIRSYNC', 128),
('MS_NOATIME', 1024),
('MS_NODIRATIME', 2048),
('MS_BIND', 4096),
('MS_MOVE', 8192),
('MS_REC', 16384),
('MS_SILENT', 32768),
('MS_POSIXACL', 1 << 16),
('MS_UNBINDABLE', 1 << 17),
('MS_PRIVATE', 1 << 18),
('MS_SLAVE', 1 << 19),
('MS_SHARED', 1 << 20),
('MS_RELATIME', 1 << 21),
('MS_KERNMOUNT', 1 << 22),
('MS_I_VERSION', 1 << 23),
('MS_STRICTATIME', 1 << 24),
('MS_LAZYTIME', 1 << 25),
('MS_ACTIVE', 1 << 30),
('MS_NOUSER', 1 << 31),
]
UMOUNT_FLAGS = [
('MNT_FORCE', 1),
('MNT_DETACH', 2),
('MNT_EXPIRE', 4),
('UMOUNT_NOFOLLOW', 8),
]
TASK_COMM_LEN = 16 # linux/sched.h
MAX_STR_LEN = 412
class EventType(object):
EVENT_MOUNT = 0
EVENT_MOUNT_SOURCE = 1
EVENT_MOUNT_TARGET = 2
EVENT_MOUNT_TYPE = 3
EVENT_MOUNT_DATA = 4
EVENT_MOUNT_RET = 5
EVENT_UMOUNT = 6
EVENT_UMOUNT_TARGET = 7
EVENT_UMOUNT_RET = 8
class EnterData(ctypes.Structure):
_fields_ = [
('mnt_ns', ctypes.c_uint),
('comm', ctypes.c_char * TASK_COMM_LEN),
('pcomm', ctypes.c_char * TASK_COMM_LEN),
('ppid', ctypes.c_uint),
('flags', ctypes.c_ulong),
]
class DataUnion(ctypes.Union):
_fields_ = [
('enter', EnterData),
('str', ctypes.c_char * MAX_STR_LEN),
('retval', ctypes.c_int),
]
class Event(ctypes.Structure):
_fields_ = [
('type', ctypes.c_uint),
('pid', ctypes.c_uint),
('tgid', ctypes.c_uint),
('union', DataUnion),
]
def _decode_flags(flags, flag_list):
str_flags = []
for flag, bit in flag_list:
if flags & bit:
str_flags.append(flag)
flags &= ~bit
if flags or not str_flags:
str_flags.append('0x{:x}'.format(flags))
return str_flags
def decode_flags(flags, flag_list):
return '|'.join(_decode_flags(flags, flag_list))
def decode_mount_flags(flags):
str_flags = []
if flags & MS_MGC_MSK == MS_MGC_VAL:
flags &= ~MS_MGC_MSK
str_flags.append('MS_MGC_VAL')
str_flags.extend(_decode_flags(flags, MOUNT_FLAGS))
return '|'.join(str_flags)
def decode_umount_flags(flags):
return decode_flags(flags, UMOUNT_FLAGS)
def decode_errno(retval):
try:
return '-' + errno.errorcode[-retval]
except KeyError:
return str(retval)
_escape_chars = {
ord('\a'): '\\a',
ord('\b'): '\\b',
ord('\t'): '\\t',
ord('\n'): '\\n',
ord('\v'): '\\v',
ord('\f'): '\\f',
ord('\r'): '\\r',
ord('"'): '\\"',
ord('\\'): '\\\\',
}
def escape_character(c):
try:
return _escape_chars[c]
except KeyError:
if 0x20 <= c <= 0x7e:
return chr(c)
else:
return '\\x{:02x}'.format(c)
if sys.version_info.major < 3:
def decode_mount_string(s):
return '"{}"'.format(''.join(escape_character(ord(c)) for c in s))
else:
def decode_mount_string(s):
return '"{}"'.format(''.join(escape_character(c) for c in s))
def print_event(mounts, umounts, parent, cpu, data, size):
event = ctypes.cast(data, ctypes.POINTER(Event)).contents
try:
if event.type == EventType.EVENT_MOUNT:
mounts[event.pid] = {
'pid': event.pid,
'tgid': event.tgid,
'mnt_ns': event.union.enter.mnt_ns,
'comm': event.union.enter.comm,
'flags': event.union.enter.flags,
'ppid': event.union.enter.ppid,
'pcomm': event.union.enter.pcomm,
}
elif event.type == EventType.EVENT_MOUNT_SOURCE:
mounts[event.pid]['source'] = event.union.str
elif event.type == EventType.EVENT_MOUNT_TARGET:
mounts[event.pid]['target'] = event.union.str
elif event.type == EventType.EVENT_MOUNT_TYPE:
mounts[event.pid]['type'] = event.union.str
elif event.type == EventType.EVENT_MOUNT_DATA:
# XXX: data is not always a NUL-terminated string
mounts[event.pid]['data'] = event.union.str
elif event.type == EventType.EVENT_UMOUNT:
umounts[event.pid] = {
'pid': event.pid,
'tgid': event.tgid,
'mnt_ns': event.union.enter.mnt_ns,
'comm': event.union.enter.comm,
'flags': event.union.enter.flags,
'ppid': event.union.enter.ppid,
'pcomm': event.union.enter.pcomm,
}
elif event.type == EventType.EVENT_UMOUNT_TARGET:
umounts[event.pid]['target'] = event.union.str
elif (event.type == EventType.EVENT_MOUNT_RET or
event.type == EventType.EVENT_UMOUNT_RET):
if event.type == EventType.EVENT_MOUNT_RET:
syscall = mounts.pop(event.pid)
call = ('mount({source}, {target}, {type}, {flags}, {data}) ' +
'= {retval}').format(
source=decode_mount_string(syscall['source']),
target=decode_mount_string(syscall['target']),
type=decode_mount_string(syscall['type']),
flags=decode_mount_flags(syscall['flags']),
data=decode_mount_string(syscall['data']),
retval=decode_errno(event.union.retval))
else:
syscall = umounts.pop(event.pid)
call = 'umount({target}, {flags}) = {retval}'.format(
target=decode_mount_string(syscall['target']),
flags=decode_umount_flags(syscall['flags']),
retval=decode_errno(event.union.retval))
if parent:
print('{:16} {:<7} {:<7} {:16} {:<7} {:<11} {}'.format(
syscall['comm'].decode('utf-8', 'replace'), syscall['tgid'],
syscall['pid'], syscall['pcomm'].decode('utf-8', 'replace'),
syscall['ppid'], syscall['mnt_ns'], call))
else:
print('{:16} {:<7} {:<7} {:<11} {}'.format(
syscall['comm'].decode('utf-8', 'replace'), syscall['tgid'],
syscall['pid'], syscall['mnt_ns'], call))
sys.stdout.flush()
except KeyError:
# This might happen if we lost an event.
pass
def main():
parser = argparse.ArgumentParser(
description='trace mount() and umount() syscalls'
)
parser.add_argument("--ebpf", action="store_true",
help=argparse.SUPPRESS)
parser.add_argument("-P", "--parent_process", action="store_true",
help="also snoop the parent process")
parser.add_argument("--cgroupmap",
help="trace cgroups in this BPF map only")
parser.add_argument("--mntnsmap",
help="trace mount namespaces in this BPF map only")
args = parser.parse_args()
mounts = {}
umounts = {}
global bpf_text
bpf_text = filter_by_containers(args) + bpf_text
if args.ebpf:
print(bpf_text)
exit()
b = bcc.BPF(text=bpf_text)
mount_fnname = b.get_syscall_fnname("mount")
b.attach_kprobe(event=mount_fnname, fn_name="syscall__mount")
b.attach_kretprobe(event=mount_fnname, fn_name="do_ret_sys_mount")
umount_fnname = b.get_syscall_fnname("umount")
b.attach_kprobe(event=umount_fnname, fn_name="syscall__umount")
b.attach_kretprobe(event=umount_fnname, fn_name="do_ret_sys_umount")
b['events'].open_perf_buffer(
functools.partial(print_event, mounts, umounts, args.parent_process))
if args.parent_process:
print('{:16} {:<7} {:<7} {:16} {:<7} {:<11} {}'.format(
'COMM', 'PID', 'TID', 'PCOMM', 'PPID', 'MNT_NS', 'CALL'))
else:
print('{:16} {:<7} {:<7} {:<11} {}'.format(
'COMM', 'PID', 'TID', 'MNT_NS', 'CALL'))
while True:
try:
b.perf_buffer_poll()
except KeyboardInterrupt:
exit()
if __name__ == '__main__':
main()