Skip to main content

Questions tagged [ebpf]

eBPF is a technology with origins in the Linux kernel that can run sandboxed programs in an operating system kernel. It is used to safely and efficiently extend the capabilities of the kernel without requiring to change kernel source code or load kernel modules. Details refer to https://ebpf.io.

Filter by
Sorted by
Tagged with
0 votes
1 answer
31 views

New added android kernel bpf helpers are not detected

I'm trying to patch an android kernel 4.9 to support probe_read_{user, kernel} and probe_read_{user, kernel} helpers. For the backporting I took example from another patch that adds bpf_probe_read_str ...
Marcel's user avatar
  • 1
0 votes
0 answers
43 views

How to improve performance of unicast to broadcast UDP packet transformation on OpenWrt?

Background We have some devices sending unicast UDP packets which we want to receive on multiple computers by transforming those packets to broadcast. We can't make any changes to the devices sending ...
Linus's user avatar
  • 288
1 vote
1 answer
63 views

eBPF in real-time systems [closed]

I've a question about real-time systems, in particular in LynxOS (LynxOS-178). I would need information on the compatibility and presence of eBPF in these systems. Can anyone help me? I haven't found ...
Serena Schenone's user avatar
0 votes
0 answers
35 views

Why do Instruction Pointers in eBPF stack trace contain the eBPF program twice with the same IP, and a weird unrelated IP?

When taking kernel stack traces in an eBPF program, I get duplicate and a seemingly weird entry: can someone please shed some light on this? Let's start with the eBPF program fragments that are ...
TheDiveO's user avatar
  • 1,337
0 votes
0 answers
33 views

Can I use systemd resource management to deny port only outside containers

On an up-to-date fedora 39, I have set up podman for rootless containers and I limit the ports a user may bind to by creating /etc/systemd/system/user-1000.slice.d/user-resources.conf with [Slice] ...
Gamification's user avatar
0 votes
0 answers
79 views

XDP generic transmit packets to loopback interface dropped

I'm trying to transmit udp packets via xdp (receives work just fine) but the packets are dropped before udp processing. Kernel: Linux fedora 6.5.12-300.fc39.x86_64 #1 SMP PREEMPT_DYNAMIC Mon Nov 20 22:...
user5199947's user avatar
1 vote
0 answers
216 views

eBPF vs verified Linux Kernel Modules

In what way is eBPF superior to a kernel module verified on the user-side? I'm not disputing the value of verified code; both approaches would be fully statically verified. Both approaches require ...
charmoniumQ's user avatar
2 votes
1 answer
222 views

How to get argv[0] in bpftrace?

I have this rather simple script: #!/usr/bin/bpftrace tracepoint:syscalls:sys_enter_exec* { @start[pid] = nsecs; printf("START;%-6d;", pid); join(args->argv); } tracepoint:...
Marcus Müller's user avatar
1 vote
1 answer
534 views

Redirect port using TC BPF

I'm want to use TC BPF to redirect incoming traffic from port 80 to port 8080. Below is my own code, but I've also tried the example from man 8 tc-bpf (search for 8080) and I get the same result. #...
greenro's user avatar
  • 13
1 vote
1 answer
467 views

Log all commands executed regardless of shell?

Suppose a user runs the following command: zcat file.gz | grep something | gzip > grepped.gz I'm looking for a kernel feature (a BPF filter perhaps?) that would note all of the execves, chain ...
d33tah's user avatar
  • 1,361
1 vote
1 answer
126 views

DPROBES (DTRACE_PROBE) for measuring high latency stuff under 1µsec

Currently, I'm analyzing the performance of a high latency application but I'm not confident in my measurements at all. So far, I have used DPROBES for instrumentation and BCC/funclatency for ...
Bahamas's user avatar
  • 113
1 vote
1 answer
3k views

linux bpftool not found in linux-tools-common for kernel 4.19.232

I am trying to check if bpf is properly installed in my linux kernel. It's enabled in the kernel as shown: jakew@desktop:~$ cat config | grep BPF CONFIG_CGROUP_BPF=y CONFIG_BPF=y CONFIG_BPF_SYSCALL=y ...
jake wong's user avatar
  • 131
2 votes
0 answers
461 views

How to get the current cgroup ID from C/C++?

The eBPF helper functions define bpf_get_current_cgroup_id for eBPF programs, which does the obvious thing u64 bpf_get_current_cgroup_id(void) Return A 64-bit integer containing the current ...
user547386's user avatar
2 votes
2 answers
599 views

What are the limitations of eBPF feature-wise?

I understood it is mainly used for observability (ie read-only). I saw you can route packets, but can you do more than that? Can you also manipulate the file system, send signals and write from an ...
funerr's user avatar
  • 123
1 vote
1 answer
510 views

Mellanox NIC doesn't support DRV_MODE in XDP hook?

I'm trying to load my first eBPF program to the XDP hook, but can't use DRV_MODE. To be more specific, I'm using Ubuntu 20.04 LTS (GNU/Linux 5.4.0-100-generic x86_64), with a NIC ca:00.0 Ethernet ...
Zezhou Wang's user avatar
1 vote
0 answers
253 views

CPU Usage based on eBPF profiling

I am relatively new to the concept of eBPF and have, so far, been working with the BCC library. I've found the profile.py tool, alongside with FlameGraphs, to be really helpful when monitoring a ...
user529737's user avatar
0 votes
0 answers
329 views

Simple ebpf code with global variables: failed in the assignment

I have a simple ebpf test code where there are few global variables (As far as I could tell, global variables are accessed vis the map mechanism in my version (5.13 Linux)). Here is the code. int ...
Software-security-is-not-free's user avatar
1 vote
0 answers
30 views

how do I trace guest os system calls from host os? [closed]

Is there a way to trace guest os system calls from host os with bpf?
Huzi's user avatar
  • 412
9 votes
2 answers
3k views

Understanding of BPF

When I need to capture some packets using tcpdump, I use command like: tcpdump -i eth0 "dst host 192.168.1.0" I always think the dst host 192.168.1.0 part is something called BPF, Berkeley ...
Fajela Tajkiya's user avatar
6 votes
2 answers
3k views

How do packets flow through the kernel

When it comes to packet filtering/management I never actually know what is going on inside the kernel. There are so many different tools that act on the packets, either from userspace (modifying ...
AFP_555's user avatar
  • 301
0 votes
1 answer
549 views

How can I filter a packet after an iptables MASQUERADE?

I am trying to build a multi-WAN router based on Debian Buster (kernel version 4.19). It has multiple 'LAN-side' network interfaces (e.g. lan0, lan1, ... lanM), and also multiple 'WAN-side' interfaces ...
Avijit's user avatar
  • 101
1 vote
0 answers
2k views

Kprobe vs Fentry/ Fexit probes -- TOCTTOU

I am reading up upon attaching eBPF programs in the kernel in a security context. While i have read that kprobes are susceptible to time-of-check-to-time-of-use attacks, i would like to know it the ...
BillGatesPriv's user avatar
1 vote
0 answers
168 views

Count number of bytes read() from files on a file system

I have multiple XFS filesystems mounted on my Linux 5 machine. I'd like to know for one of them how many bytes were read() in a time period. Is there an easy way of doing that? I've been looking ...
Marcus Müller's user avatar
-2 votes
1 answer
625 views

Block network access of a process using eBPF?

I know XDP can be used to drop packets/control network, but how we can achieve similar thing at process level? The kernel has no idea what process we are running, so how can I block network access of ...
CureofQuarantine's user avatar
3 votes
1 answer
2k views

'cannot attach kprobe, probe entry may not exist' when execute trace-bpfcc

I am following bcc Tutorial and trying to execute the trace-bpfcc command: sudo trace-bpfcc 'sys_execve "%s", arg1' The command fails with an error: cannot attach kprobe, probe entry may not ...
ibse's user avatar
  • 341
-1 votes
1 answer
711 views

ebpf: sending data from userspace and waiting for that

I'm using ebpf and bcc to write an ebpf-lsm program. I want to block a connected USB device and send its info to userspace and the user send me whether I bind that device or no. how can I do this? I ...
Redwan's user avatar
  • 1
-1 votes
1 answer
583 views

ptrace PTRACE_PEEKTEXT error

Why I get this error when I use ptrace PTRACE_PEEKTEXT in my C program?? the part of program that I use PTRACE_PEEKTEXT in it is: static void read_file(pid_t child, char *file) { char *child_addr; ...
Mostafa Sarmad's user avatar
-2 votes
2 answers
1k views

Getting error while loading ebpf program into kernel

Why I am getting this error when I want to load the ebpf program into kernel?? ebpf_prog.c: #include <bpf/bpf_helpers.h> #include <bpf/libbpf.h> int main(int argc, char **argv) { ...
Mostafa Sarmad's user avatar
1 vote
1 answer
1k views

Interception syscalls and make change in their arguments

I'm interested to write a kernel program that can have all possible controls on syscalls, such as intersection, filtering, and make changes in their arguments. I look up for two goals: read system ...
Mostafa Sarmad's user avatar
0 votes
1 answer
323 views

seccomp vs bcc for syscall interception

how can I use seccomp and prctl syscall vs bcc to interception syscalls? Is there another way to achieve this goal with bcc ?? I know that it is possible with pure ebpf code in C but it is too ...
Mostafa Sarmad's user avatar
0 votes
1 answer
1k views

Loading BPF program into kernel dynamically?

I'm looking for a way to load a BPF program without rebuilding the kernel.
Mostafa Sarmad's user avatar
0 votes
1 answer
39 views

Estimate number of LOC of namespaces implementation and bpf implementation

How can I estimate the LOC of a linux component? In this case I would compare the LOC number that implement namespaces with the number of LOC which implement BPF.
Maicake's user avatar
  • 109
1 vote
0 answers
1k views

bpf_helpers.h file is missing

I'm trying to run some example XDP code that depends on bpf_helpers.h and the file is missing. The distribution is CentOS 8.0 with kernel 4.18.0-80.el8.x86_64 with CONFIG_XDP_SOCKETS=y. I've ...
Jim's user avatar
  • 111
0 votes
0 answers
975 views

bpf vs ebpf communication between kernel space and user space

Does bpf allow just passing data from kernel space to user space ? Or there is a way to pass data from user space to kernel space without using ebpf?
Maicake's user avatar
  • 109
1 vote
0 answers
232 views

Mapping from uname -m to /usr/src/linux-headers/arch/*

I'm building an eBPF program. For it to build I need to add as include paths (-I) some headers located in /usr/src/linux-headers-*/arch/x86/include. Since this path is x86-specific, to be able to ...
Albert Vaca Cintora's user avatar