148 lines
6.3 KiB
Plaintext
148 lines
6.3 KiB
Plaintext
Demonstrations of execsnoop, the Linux eBPF/bcc version.
|
|
|
|
|
|
execsnoop traces new processes. For example, tracing the commands invoked when
|
|
running "man ls":
|
|
|
|
# ./execsnoop
|
|
PCOMM PID RET ARGS
|
|
bash 15887 0 /usr/bin/man ls
|
|
preconv 15894 0 /usr/bin/preconv -e UTF-8
|
|
man 15896 0 /usr/bin/tbl
|
|
man 15897 0 /usr/bin/nroff -mandoc -rLL=169n -rLT=169n -Tutf8
|
|
man 15898 0 /usr/bin/pager -s
|
|
nroff 15900 0 /usr/bin/locale charmap
|
|
nroff 15901 0 /usr/bin/groff -mtty-char -Tutf8 -mandoc -rLL=169n -rLT=169n
|
|
groff 15902 0 /usr/bin/troff -mtty-char -mandoc -rLL=169n -rLT=169n -Tutf8
|
|
groff 15903 0 /usr/bin/grotty
|
|
|
|
The output shows the parent process/command name (PCOMM), the PID, the return
|
|
value of the exec() (RET), and the filename with arguments (ARGS).
|
|
|
|
This works by traces the execve() system call (commonly used exec() variant),
|
|
and shows details of the arguments and return value. This catches new processes
|
|
that follow the fork->exec sequence, as well as processes that re-exec()
|
|
themselves. Some applications fork() but do not exec(), eg, for worker
|
|
processes, which won't be included in the execsnoop output.
|
|
|
|
|
|
The -x option can be used to include failed exec()s. For example:
|
|
|
|
# ./execsnoop -x
|
|
PCOMM PID RET ARGS
|
|
supervise 9660 0 ./run
|
|
supervise 9661 0 ./run
|
|
mkdir 9662 0 /bin/mkdir -p ./main
|
|
run 9663 0 ./run
|
|
chown 9664 0 /bin/chown nobody:nobody ./main
|
|
run 9665 0 /bin/mkdir -p ./main
|
|
supervise 9667 0 ./run
|
|
run 9660 -2 /usr/local/bin/setuidgid nobody /command/multilog t ./main
|
|
chown 9668 0 /bin/chown nobody:nobody ./main
|
|
run 9666 0 /bin/chmod 0777 main
|
|
run 9663 -2 /usr/local/bin/setuidgid nobody /command/multilog t ./main
|
|
run 9669 0 /bin/mkdir -p ./main
|
|
run 9661 -2 /usr/local/bin/setuidgid nobody /command/multilog t ./main
|
|
supervise 9670 0 ./run
|
|
[...]
|
|
|
|
This example shows various regular system daemon activity, including some
|
|
failures (trying to execute a /usr/local/bin/setuidgid, which I just noticed
|
|
doesn't exist).
|
|
|
|
|
|
A -T option can be used to include a time column, a -t option to include a
|
|
timestamp column, and a -n option to match on a name. Regular expressions
|
|
are allowed.
|
|
For example, matching commands containing "mount":
|
|
|
|
# ./execsnoop -Ttn mount
|
|
TIME TIME(s) PCOMM PID PPID RET ARGS
|
|
14:08:23 2.849 mount 18049 1045 0 /bin/mount -p
|
|
|
|
The -l option can be used to only show command where one of the arguments
|
|
matches specified line. The limitation is that we are looking only into first 20
|
|
arguments of the command. For example, matching all command where one of the argument
|
|
is "testpkg":
|
|
|
|
# ./execsnoop.py -l testpkg
|
|
PCOMM PID PPID RET ARGS
|
|
service 3344535 4146419 0 /usr/sbin/service testpkg status
|
|
systemctl 3344535 4146419 0 /bin/systemctl status testpkg.service
|
|
yum 3344856 4146419 0 /usr/local/bin/yum remove testpkg
|
|
python 3344856 4146419 0 /usr/local/bin/python /usr/local/bin/yum remove testpkg
|
|
yum 3344856 4146419 0 /usr/bin/yum remove testpkg
|
|
yum 3345086 4146419 0 /usr/local/bin/yum install testpkg
|
|
python 3345086 4146419 0 /usr/local/bin/python /usr/local/bin/yum install testpkg
|
|
yum 3345086 4146419 0 /usr/bin/yum install testpkg
|
|
rpm 3345452 4146419 0 /bin/rpm -qa testpkg
|
|
|
|
|
|
The --cgroupmap option filters based on a cgroup set. It is meant to be used
|
|
with an externally created map.
|
|
|
|
# ./execsnoop --cgroupmap /sys/fs/bpf/test01
|
|
|
|
For more details, see docs/special_filtering.md
|
|
|
|
The -U option include UID on output:
|
|
|
|
# ./execsnoop -U
|
|
|
|
UID PCOMM PID PPID RET ARGS
|
|
1000 ls 171318 133702 0 /bin/ls --color=auto
|
|
1000 w 171322 133702 0 /usr/bin/w
|
|
|
|
The -u options filters output based process UID. You also can use username as
|
|
argument, in that cause UID will be looked up using getpwnam (see man 3 getpwnam).
|
|
|
|
# ./execsnoop -Uu 1000
|
|
UID PCOMM PID PPID RET ARGS
|
|
1000 ls 171335 133702 0 /bin/ls --color=auto
|
|
1000 man 171340 133702 0 /usr/bin/man getpwnam
|
|
1000 bzip2 171341 171340 0 /bin/bzip2 -dc
|
|
1000 bzip2 171342 171340 0 /bin/bzip2 -dc
|
|
1000 bzip2 171345 171340 0 /bin/bzip2 -dc
|
|
1000 manpager 171355 171340 0 /usr/bin/manpager
|
|
1000 less 171355 171340 0 /usr/bin/less
|
|
|
|
USAGE message:
|
|
|
|
# ./execsnoop -h
|
|
usage: execsnoop.py [-h] [-T] [-t] [-x] [--cgroupmap CGROUPMAP] [-u USER] [-q]
|
|
[-n NAME] [-l LINE] [-U] [--max-args MAX_ARGS]
|
|
|
|
Trace exec() syscalls
|
|
|
|
optional arguments:
|
|
-h, --help show this help message and exit
|
|
-T, --time include time column on output (HH:MM:SS)
|
|
-t, --timestamp include timestamp on output
|
|
-x, --fails include failed exec()s
|
|
--cgroupmap CGROUPMAP
|
|
trace cgroups in this BPF map only
|
|
--mntnsmap MNTNSMAP trace mount namespaces in this BPF map only
|
|
-u USER, --uid USER trace this UID only
|
|
-q, --quote Add quotemarks (") around arguments.
|
|
-n NAME, --name NAME only print commands matching this name (regex), any
|
|
arg
|
|
-l LINE, --line LINE only print commands where arg contains this line
|
|
(regex)
|
|
-U, --print-uid print UID column
|
|
--max-args MAX_ARGS maximum number of arguments parsed and displayed,
|
|
defaults to 20
|
|
|
|
examples:
|
|
./execsnoop # trace all exec() syscalls
|
|
./execsnoop -x # include failed exec()s
|
|
./execsnoop -T # include time (HH:MM:SS)
|
|
./execsnoop -U # include UID
|
|
./execsnoop -u 1000 # only trace UID 1000
|
|
./execsnoop -u root # get root UID and trace only this
|
|
./execsnoop -t # include timestamps
|
|
./execsnoop -q # add "quotemarks" around arguments
|
|
./execsnoop -n main # only print command lines containing "main"
|
|
./execsnoop -l tpkg # only print command where arguments contains "tpkg"
|
|
./execsnoop --cgroupmap mappath # only trace cgroups in this BPF map
|
|
./execsnoop --mntnsmap mappath # only trace mount namespaces in the map
|