3 ms·

https://media.ccc.de/v/35c3-9532-kernel_tracing_with_ebpf https://media.ccc.de/v/35c3-9532-kernel_tracing_with_ebpf seems to have PoC that you can do intercepti

• woodruffw 8y ago
  I skimmed through their talk, but my understand of eBPF is that it cannot do syscall interception (i.e., actually changing the code that a syscall executes) itself. Their PoC, from what I can tell, is a separate kernel module that disables some of eBPF's safety checks so that they can do more expressive things within it. They do, however, show that eBPF can be used to detect changes to particular files and alert the user/provide feedback when that happens. That's extremely useful, although not the same as actually denying that change (which would require modifying the syscall itself). Edit: I just watched up to the point when they discuss `bpf_probe_write_user`, which I didn't know about. Looks like you can indeed use that to do much of what I'm interested in!
  • EE84M3i 8y ago
    I haven't watched that talk, but in the past I've done this by LD_PRELOADing a shared object that injected a seccomp filter on init with SECCOMP_RET_TRAP as appropriate and then rewrote the saved thread state higher up the stack to simulate the syscall / replace the return value. It worked pretty well.
  • jakeogh 8y ago
    Ya, I was curious about that too. Finally started messing with bcc, found: https://stackoverflow.com/questions/43003805/can-ebpf-modify-the-return-value-or-parameters-of-a-syscall https://stackoverflow.com/questions/43003805/can-ebpf-modify... and a tangentally related https://dev.framing.life/tracing/uprobes-and-int3-insn/ https://dev.framing.life/tracing/uprobes-and-int3-insn/