Linux Kernel Debugging by Kaiwan N Billimoria

Author:Kaiwan N Billimoria [Billimoria, Kaiwan N]
Language: eng
Format: epub
Tags: Debug hacks, Linux kernel programming, c, c++, linux, kgdb, kernel architecture, QEMU, OS, debug
Publisher: Packt Publishing
Published: 2022-07-08T00:00:00+00:00

On my x86_64 Ubuntu 20.04 LTS guest VM (running our custom 5.10.60-prod01 kernel), I find there are 112 *-bpfcc utilities installed (they’re actually Python scripts).

In the section just prior to this one, we saw that the execve() (or execveat()) system call is the one that actually executes processes; we attempted to trace it’s execution via the perf-tools utilities (execsnoop-perf), but it just failed. Now, with the eBPF BCC front-ends installed, let’s retry:

$ uname -r 5.10.60-prod01 $ sudo execsnoop-bpfcc 2>/dev/null […] PCOMM PID PPID RET ARGS id 7147 7053 0 /usr/bin/id -u id 7148 7053 0 /usr/bin/id -u git 7149 7053 0 /usr/bin/git config --global credential.helper cache --timeout 36000 cut 7151 7053 0 /usr/bin/cut -d= -f2 grep 7150 7053 0 /usr/bin/grep --color=auto ^PRETTY_NAME /etc/os-release cat 7152 7053 0 /usr/bin/cat /proc/version ip 7157 7053 0 /usr/bin/ip a sudo 7159 7053 0 /usr/bin/sudo route -n route 7160 7159 0 /usr/sbin/route -n [...]

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.