diff --git a/observer_agent/CMakeLists.txt b/observer_agent/CMakeLists.txt index 9d752c3931f5b3d4ff935f871d0f32577af3511c..c809e7778b1d41e148180ae29cd492a9d5e345fb 100644 --- a/observer_agent/CMakeLists.txt +++ b/observer_agent/CMakeLists.txt @@ -8,6 +8,7 @@ add_custom_target(grpc_demo ALL COMMAND make -C ${GRPC_PATH}) add_executable(secDetectord grpc_comm/client.cpp grpc_comm/server.cpp service/main.cpp service/ringbuffer.cpp) +add_dependencies(secDetectord ebpf) target_include_directories(secDetectord PUBLIC service grpc_comm) target_link_directories(secDetectord PUBLIC ${CMAKE_CURRENT_BINARY_DIR}/ebpf) diff --git a/observer_agent/ebpf/CMakeLists.txt b/observer_agent/ebpf/CMakeLists.txt index 4ac77130de66cbbb5821d840447506a0df925a0d..efec7f3200dad96f2cca78fa6a936d890c022097 100644 --- a/observer_agent/ebpf/CMakeLists.txt +++ b/observer_agent/ebpf/CMakeLists.txt @@ -2,7 +2,7 @@ cmake_minimum_required(VERSION 3.16) project(ebpf) -add_custom_target(ebpf ALL +add_custom_target(ebpf COMMAND mkdir -p ${CMAKE_CURRENT_BINARY_DIR}/.output COMMAND bpftool btf dump file /sys/kernel/btf/vmlinux format c > ${CMAKE_CURRENT_BINARY_DIR}/.output/vmlinux.h COMMAND clang -g -O2 -target bpf -D__TARGET_ARCH_x86 -I${CMAKE_CURRENT_BINARY_DIR}/.output -c ${CMAKE_CURRENT_SOURCE_DIR}/fentry.bpf.c -o ${CMAKE_CURRENT_BINARY_DIR}/.output/fentry.bpf.o @@ -11,4 +11,5 @@ add_custom_target(ebpf ALL ) add_executable(test_fentry ${CMAKE_CURRENT_SOURCE_DIR}/test_fentry.c) +add_dependencies(test_fentry ebpf) target_link_libraries(test_fentry ${CMAKE_CURRENT_BINARY_DIR}/.output/fentry.o z elf bpf) diff --git a/observer_agent/ebpf/fentry.bpf.c b/observer_agent/ebpf/fentry.bpf.c index 11742fd12819f8d96e7c3d5cdc6779bebbb1d313..a172931377b0ad636710bcdea3da5dbf6f7aac6a 100644 --- a/observer_agent/ebpf/fentry.bpf.c +++ b/observer_agent/ebpf/fentry.bpf.c @@ -92,14 +92,14 @@ int handle_exec(struct trace_event_raw_sched_process_exec *ctx) return 0; get_common_info(e); - strcpy(e->event_name, "sched_process_exec"); + __builtin_memcpy(e->event_name, "sched_process_exec", sizeof("sched_process_exec")); bpf_ringbuf_submit(e, 0); return 0; } SEC("tp/sched/sched_process_exit") -int handle_exit(struct trace_event_raw_sched_process_exit *ctx) +int handle_exit(void) { struct ebpf_event *e = NULL; u32 exit_code = 0; @@ -109,7 +109,7 @@ int handle_exit(struct trace_event_raw_sched_process_exit *ctx) return 0; get_common_info(e); - strcpy(e->event_name, "sched_process_exit"); + __builtin_memcpy(e->event_name, "sched_process_exit", sizeof("sched_process_exit")); exit_code = BPF_CORE_READ((struct task_struct *)bpf_get_current_task(), exit_code); e->process_info.exit_code = (exit_code >> 8) & 0xff; bpf_ringbuf_submit(e, 0); @@ -126,7 +126,7 @@ int handle_fork(struct trace_event_raw_sched_process_fork *ctx) return 0; get_common_info(e); - strcpy(e->event_name, "sched_process_fork"); + __builtin_memcpy(e->event_name, "sched_process_fork", sizeof("sched_process_fork")); bpf_ringbuf_submit(e, 0); return 0; }