Let consumer application read packets(plain and tls) perf buffers dir…

…ectly

main.go

@@ -41,6 +41,8 @@ var procfs = flag.String("procfs", "/proc", "The procfs directory, used when map
 // development
 var debug = flag.Bool("debug", false, "Enable debug mode")
 
+var initBPF = flag.Bool("init-bpf", false, "Use to initialize bpf filesystem. Common usage is from init containers.")
+
 var disableEbpfCapture = flag.Bool("disable-ebpf", false, "Disable capture packet via eBPF")
 var disableTlsLog = flag.Bool("disable-tls-log", false, "Disable tls logging")
 
@@ -103,6 +105,10 @@ func main() {
 		}
 	}()
 
+	if *initBPF {
+		initBPFSubsystem()
+		return
+	}
 	run()
 }
 

pkg/bpf/bpf.go

@@ -3,6 +3,7 @@ package bpf
 import (
 	"fmt"
 	"path/filepath"
+	"strings"
 
 	"bytes"
 	"os"
@@ -108,15 +109,22 @@ func NewBpfObjects(disableEbpfCapture bool) (*BpfObjects, error) {
 		disableEbpfCapture = true
 	}
 
-	ebpfBackendStatus := "enabled"
-	if disableEbpfCapture {
-		ebpfBackendStatus = "disabled"
+	markDisabledEBPF := func() error {
 		pathNoEbpf := filepath.Join(misc.GetDataDir(), "noebpf")
 		file, err := os.Create(pathNoEbpf)
 		if err != nil {
-			return nil, err
+			return err
 		}
 		file.Close()
+		return nil
+	}
+
+	ebpfBackendStatus := "enabled"
+	if disableEbpfCapture {
+		ebpfBackendStatus = "disabled"
+		if err = markDisabledEBPF(); err != nil {
+			return nil, err
+		}
 	}
 
 	log.Info().Msg(fmt.Sprintf("Detected Linux kernel version: %s cgroups version2: %v, eBPF backend %v", kernelVersion, isCgroupV2, ebpfBackendStatus))
@@ -183,6 +191,17 @@ func NewBpfObjects(disableEbpfCapture bool) (*BpfObjects, error) {
 
 	// Pin packet perf maps:
 
+	defer func() {
+		if os.IsPermission(err) || strings.Contains(fmt.Sprintf("%v", err), "permission") {
+			log.Warn().Msg(fmt.Sprintf("There are no enough permissions to activate eBPF. Error: %v", err))
+			if err = markDisabledEBPF(); err != nil {
+				log.Error().Err(err).Msg("disable ebpf failed")
+			} else {
+				err = nil
+			}
+		}
+	}()
+
 	if err = os.MkdirAll(PinPath, 0700); err != nil {
 		log.Error().Msg(fmt.Sprintf("mkdir pin path failed: %v", err))
 		return nil, err

pkg/utils/utils.go

@@ -2,10 +2,12 @@
 package utils
 
 import (
+	"fmt"
 	"github.com/go-errors/errors"
 	"github.com/rs/zerolog/log"
 	"golang.org/x/sys/unix"
 	"os"
+	"path/filepath"
 	"syscall"
 )
 
@@ -37,3 +39,23 @@ func GetInode(path string) (uint64, error) {
 
 	return stat_t.Ino, nil
 }
+
+func RemoveAllFilesInDir(dir string) (removedFiles []string, err error) {
+	files, err := os.ReadDir(dir)
+	if err != nil {
+		err = fmt.Errorf("failed to read directory %s: %w", dir, err)
+		return
+	}
+
+	for _, file := range files {
+		filePath := filepath.Join(dir, file.Name())
+		if err = os.Remove(filePath); err != nil {
+			err = fmt.Errorf("failed to remove %s: %w", filePath, err)
+			return
+		} else {
+			removedFiles = append(removedFiles, filePath)
+		}
+	}
+
+	return
+}

tracer.go

@@ -14,6 +14,7 @@ import (
 	packetHooks "github.com/kubeshark/tracer/pkg/hooks/packet"
 	syscallHooks "github.com/kubeshark/tracer/pkg/hooks/syscall"
 	"github.com/kubeshark/tracer/pkg/poller"
+	"github.com/kubeshark/tracer/pkg/utils"
 	"github.com/rs/zerolog/log"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/types"
@@ -212,3 +213,20 @@ func getContainerIDs(pod *v1.Pod) []string {
 
 	return containerIDs
 }
+
+func initBPFSubsystem() {
+	// Cleanup is required in case map set or format is changed in the new tracer version
+	if files, err := utils.RemoveAllFilesInDir(bpf.PinPath); err != nil {
+		log.Error().Str("path", bpf.PinPath).Err(err).Msg("directory cleanup failed")
+	} else {
+		for _, file := range files {
+			log.Info().Str("path", file).Msg("removed bpf entry")
+		}
+	}
+
+	_, err := bpf.NewBpfObjects(false)
+	if err != nil {
+		log.Error().Err(err).Msg("create objects failed")
+	}
+
+}