Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 1 | #!/usr/bin/python |
| 2 | # @lint-avoid-python-3-compatibility-imports |
| 3 | # |
| 4 | # execsnoop Trace new processes via exec() syscalls. |
| 5 | # For Linux, uses BCC, eBPF. Embedded C. |
| 6 | # |
Brendan Gregg | 151a43a | 2016-02-09 00:28:09 -0800 | [diff] [blame] | 7 | # USAGE: execsnoop [-h] [-t] [-x] [-n NAME] |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 8 | # |
| 9 | # This currently will print up to a maximum of 19 arguments, plus the process |
| 10 | # name, so 20 fields in total (MAXARG). |
| 11 | # |
| 12 | # This won't catch all new processes: an application may fork() but not exec(). |
| 13 | # |
| 14 | # Copyright 2016 Netflix, Inc. |
| 15 | # Licensed under the Apache License, Version 2.0 (the "License") |
| 16 | # |
| 17 | # 07-Feb-2016 Brendan Gregg Created this. |
| 18 | |
| 19 | from __future__ import print_function |
| 20 | from bcc import BPF |
Brenden Blanco | 42d6098 | 2017-04-24 14:31:28 -0700 | [diff] [blame] | 21 | from bcc.utils import ArgString, printb |
| 22 | import bcc.utils as utils |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 23 | import argparse |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 24 | import ctypes as ct |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 25 | import re |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 26 | import time |
| 27 | from collections import defaultdict |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 28 | |
| 29 | # arguments |
| 30 | examples = """examples: |
| 31 | ./execsnoop # trace all exec() syscalls |
Brendan Gregg | 151a43a | 2016-02-09 00:28:09 -0800 | [diff] [blame] | 32 | ./execsnoop -x # include failed exec()s |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 33 | ./execsnoop -t # include timestamps |
Bastian Reitemeier | 059ff55 | 2018-04-08 22:26:46 +0200 | [diff] [blame] | 34 | ./execsnoop -q # add "quotemarks" around arguments |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 35 | ./execsnoop -n main # only print command lines containing "main" |
Mauricio Vasquez B | d1324ac | 2017-05-17 20:26:47 -0500 | [diff] [blame] | 36 | ./execsnoop -l tpkg # only print command where arguments contains "tpkg" |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 37 | """ |
| 38 | parser = argparse.ArgumentParser( |
| 39 | description="Trace exec() syscalls", |
| 40 | formatter_class=argparse.RawDescriptionHelpFormatter, |
| 41 | epilog=examples) |
| 42 | parser.add_argument("-t", "--timestamp", action="store_true", |
| 43 | help="include timestamp on output") |
Brendan Gregg | 151a43a | 2016-02-09 00:28:09 -0800 | [diff] [blame] | 44 | parser.add_argument("-x", "--fails", action="store_true", |
| 45 | help="include failed exec()s") |
Bastian Reitemeier | 79ce51c | 2018-04-08 21:42:41 +0200 | [diff] [blame] | 46 | parser.add_argument("-q", "--quote", action="store_true", |
| 47 | help="Add quotemarks (\") around arguments." |
| 48 | ) |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 49 | parser.add_argument("-n", "--name", |
Brenden Blanco | 42d6098 | 2017-04-24 14:31:28 -0700 | [diff] [blame] | 50 | type=ArgString, |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 51 | help="only print commands matching this name (regex), any arg") |
Nikita V. Shirokov | 0a01506 | 2017-04-19 13:07:08 -0700 | [diff] [blame] | 52 | parser.add_argument("-l", "--line", |
Brenden Blanco | 42d6098 | 2017-04-24 14:31:28 -0700 | [diff] [blame] | 53 | type=ArgString, |
Nikita V. Shirokov | 0a01506 | 2017-04-19 13:07:08 -0700 | [diff] [blame] | 54 | help="only print commands where arg contains this line (regex)") |
Paul Chaignon | a0c9b48 | 2017-09-29 13:42:18 +0200 | [diff] [blame] | 55 | parser.add_argument("--max-args", default="20", |
| 56 | help="maximum number of arguments parsed and displayed, defaults to 20") |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 57 | parser.add_argument("--ebpf", action="store_true", |
| 58 | help=argparse.SUPPRESS) |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 59 | args = parser.parse_args() |
| 60 | |
| 61 | # define BPF program |
| 62 | bpf_text = """ |
| 63 | #include <uapi/linux/ptrace.h> |
| 64 | #include <linux/sched.h> |
| 65 | #include <linux/fs.h> |
| 66 | |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 67 | #define ARGSIZE 128 |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 68 | |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 69 | enum event_type { |
| 70 | EVENT_ARG, |
| 71 | EVENT_RET, |
| 72 | }; |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 73 | |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 74 | struct data_t { |
| 75 | u32 pid; // PID as in the userspace term (i.e. task->tgid in kernel) |
| 76 | char comm[TASK_COMM_LEN]; |
| 77 | enum event_type type; |
| 78 | char argv[ARGSIZE]; |
| 79 | int retval; |
| 80 | }; |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 81 | |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 82 | BPF_PERF_OUTPUT(events); |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 83 | |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 84 | static int __submit_arg(struct pt_regs *ctx, void *ptr, struct data_t *data) |
| 85 | { |
| 86 | bpf_probe_read(data->argv, sizeof(data->argv), ptr); |
| 87 | events.perf_submit(ctx, data, sizeof(struct data_t)); |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 88 | return 1; |
| 89 | } |
| 90 | |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 91 | static int submit_arg(struct pt_regs *ctx, void *ptr, struct data_t *data) |
| 92 | { |
| 93 | const char *argp = NULL; |
| 94 | bpf_probe_read(&argp, sizeof(argp), ptr); |
| 95 | if (argp) { |
| 96 | return __submit_arg(ctx, (void *)(argp), data); |
| 97 | } |
| 98 | return 0; |
| 99 | } |
| 100 | |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 101 | int do_sys_execve(struct pt_regs *ctx, |
htbegin | 3c399da | 2017-12-09 09:34:56 +0800 | [diff] [blame] | 102 | const char __user *filename, |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 103 | const char __user *const __user *__argv, |
| 104 | const char __user *const __user *__envp) |
| 105 | { |
Sasha Goldshtein | f41ae86 | 2016-10-19 01:14:30 +0300 | [diff] [blame] | 106 | // create data here and pass to submit_arg to save stack space (#555) |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 107 | struct data_t data = {}; |
| 108 | data.pid = bpf_get_current_pid_tgid() >> 32; |
| 109 | bpf_get_current_comm(&data.comm, sizeof(data.comm)); |
| 110 | data.type = EVENT_ARG; |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 111 | |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 112 | __submit_arg(ctx, (void *)filename, &data); |
| 113 | |
Paul Chaignon | a0c9b48 | 2017-09-29 13:42:18 +0200 | [diff] [blame] | 114 | // skip first arg, as we submitted filename |
| 115 | #pragma unroll |
| 116 | for (int i = 1; i < MAXARG; i++) { |
| 117 | if (submit_arg(ctx, (void *)&__argv[i], &data) == 0) |
| 118 | goto out; |
| 119 | } |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 120 | |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 121 | // handle truncated argument list |
| 122 | char ellipsis[] = "..."; |
| 123 | __submit_arg(ctx, (void *)ellipsis, &data); |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 124 | out: |
| 125 | return 0; |
| 126 | } |
| 127 | |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 128 | int do_ret_sys_execve(struct pt_regs *ctx) |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 129 | { |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 130 | struct data_t data = {}; |
| 131 | data.pid = bpf_get_current_pid_tgid() >> 32; |
| 132 | bpf_get_current_comm(&data.comm, sizeof(data.comm)); |
| 133 | data.type = EVENT_RET; |
| 134 | data.retval = PT_REGS_RC(ctx); |
| 135 | events.perf_submit(ctx, &data, sizeof(data)); |
| 136 | |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 137 | return 0; |
| 138 | } |
| 139 | """ |
| 140 | |
Nathan Scott | f13107a | 2018-02-05 08:28:20 +1100 | [diff] [blame] | 141 | bpf_text = bpf_text.replace("MAXARG", args.max_args) |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 142 | if args.ebpf: |
| 143 | print(bpf_text) |
| 144 | exit() |
| 145 | |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 146 | # initialize BPF |
Nathan Scott | cf0792f | 2018-02-02 16:56:50 +1100 | [diff] [blame] | 147 | b = BPF(text=bpf_text) |
Yonghong Song | 6433569 | 2018-04-25 00:40:13 -0700 | [diff] [blame] | 148 | execve_fnname = b.get_syscall_fnname("execve") |
| 149 | b.attach_kprobe(event=execve_fnname, fn_name="do_sys_execve") |
| 150 | b.attach_kretprobe(event=execve_fnname, fn_name="do_ret_sys_execve") |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 151 | |
| 152 | # header |
| 153 | if args.timestamp: |
| 154 | print("%-8s" % ("TIME(s)"), end="") |
Mark Drayton | bfdb3d4 | 2016-06-02 10:53:34 +0100 | [diff] [blame] | 155 | print("%-16s %-6s %-6s %3s %s" % ("PCOMM", "PID", "PPID", "RET", "ARGS")) |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 156 | |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 157 | TASK_COMM_LEN = 16 # linux/sched.h |
| 158 | ARGSIZE = 128 # should match #define in C above |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 159 | |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 160 | class Data(ct.Structure): |
| 161 | _fields_ = [ |
| 162 | ("pid", ct.c_uint), |
| 163 | ("comm", ct.c_char * TASK_COMM_LEN), |
| 164 | ("type", ct.c_int), |
| 165 | ("argv", ct.c_char * ARGSIZE), |
| 166 | ("retval", ct.c_int), |
| 167 | ] |
| 168 | |
| 169 | class EventType(object): |
| 170 | EVENT_ARG = 0 |
| 171 | EVENT_RET = 1 |
| 172 | |
| 173 | start_ts = time.time() |
| 174 | argv = defaultdict(list) |
| 175 | |
Mark Drayton | bfdb3d4 | 2016-06-02 10:53:34 +0100 | [diff] [blame] | 176 | # TODO: This is best-effort PPID matching. Short-lived processes may exit |
Sasha Goldshtein | f41ae86 | 2016-10-19 01:14:30 +0300 | [diff] [blame] | 177 | # before we get a chance to read the PPID. This should be replaced with |
| 178 | # fetching PPID via C when available (#364). |
Mark Drayton | bfdb3d4 | 2016-06-02 10:53:34 +0100 | [diff] [blame] | 179 | def get_ppid(pid): |
| 180 | try: |
| 181 | with open("/proc/%d/status" % pid) as status: |
| 182 | for line in status: |
| 183 | if line.startswith("PPid:"): |
| 184 | return int(line.split()[1]) |
| 185 | except IOError: |
| 186 | pass |
| 187 | return 0 |
| 188 | |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 189 | # process event |
| 190 | def print_event(cpu, data, size): |
| 191 | event = ct.cast(data, ct.POINTER(Data)).contents |
| 192 | |
| 193 | skip = False |
| 194 | |
| 195 | if event.type == EventType.EVENT_ARG: |
| 196 | argv[event.pid].append(event.argv) |
| 197 | elif event.type == EventType.EVENT_RET: |
Kirill Smelkov | ce36bb6 | 2017-09-24 21:58:19 +0300 | [diff] [blame] | 198 | if event.retval != 0 and not args.fails: |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 199 | skip = True |
Brenden Blanco | 42d6098 | 2017-04-24 14:31:28 -0700 | [diff] [blame] | 200 | if args.name and not re.search(bytes(args.name), event.comm): |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 201 | skip = True |
Bastian Reitemeier | 9345df1 | 2018-04-08 21:46:59 +0200 | [diff] [blame] | 202 | if args.line and not re.search(bytes(args.line), |
| 203 | b' '.join(argv[event.pid])): |
| 204 | skip = True |
Bastian Reitemeier | 79ce51c | 2018-04-08 21:42:41 +0200 | [diff] [blame] | 205 | if args.quote: |
| 206 | argv[event.pid] = [ |
| 207 | "\"" + arg.replace("\"", "\\\"") + "\"" |
| 208 | for arg in argv[event.pid] |
| 209 | ] |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 210 | |
| 211 | if not skip: |
| 212 | if args.timestamp: |
| 213 | print("%-8.3f" % (time.time() - start_ts), end="") |
Mark Drayton | bfdb3d4 | 2016-06-02 10:53:34 +0100 | [diff] [blame] | 214 | ppid = get_ppid(event.pid) |
Brenden Blanco | 42d6098 | 2017-04-24 14:31:28 -0700 | [diff] [blame] | 215 | ppid = b"%d" % ppid if ppid > 0 else b"?" |
Javier Honduvilla Coto | 5340c21 | 2018-05-21 12:11:32 +0200 | [diff] [blame] | 216 | argv_text = b' '.join(argv[event.pid]).replace(b'\n', b'\\n') |
Brenden Blanco | 42d6098 | 2017-04-24 14:31:28 -0700 | [diff] [blame] | 217 | printb(b"%-16s %-6d %-6s %3d %s" % (event.comm, event.pid, |
Javier Honduvilla Coto | 5340c21 | 2018-05-21 12:11:32 +0200 | [diff] [blame] | 218 | ppid, event.retval, argv_text)) |
Nikita V. Shirokov | 0a01506 | 2017-04-19 13:07:08 -0700 | [diff] [blame] | 219 | try: |
| 220 | del(argv[event.pid]) |
| 221 | except Exception: |
| 222 | pass |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 223 | |
Mark Drayton | 5b47e0f | 2016-06-02 10:53:20 +0100 | [diff] [blame] | 224 | |
| 225 | # loop with callback to print_event |
| 226 | b["events"].open_perf_buffer(print_event) |
Brendan Gregg | af18bb3 | 2016-02-07 15:28:50 -0800 | [diff] [blame] | 227 | while 1: |
Teng Qin | dbf0029 | 2018-02-28 21:47:50 -0800 | [diff] [blame] | 228 | b.perf_buffer_poll() |