-
Notifications
You must be signed in to change notification settings - Fork 0
/
clone-exec-bpftrace.sh
46 lines (39 loc) · 941 Bytes
/
clone-exec-bpftrace.sh
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
if [ -n "$EXEC" ];
then
TYPE=$1
BPFTRACE_OUT=$2
if [ $TYPE == "run" ];
then
EXP_APP_NAME=$3 #
TRACER_EB=$4 # Executor Binary
killall -v -w bpftrace
>&2 echo "Running clone and exec bpftrace probes"
bpftrace -B 'line' probes-specs/execve-clone-probes.bt ${EXP_APP_NAME:0:15} $TRACER_EB > $BPFTRACE_OUT &
BPFTRACER_PID=$!
>&2 echo "BPFTracer PID=$BPFTRACER_PID"
while [ $(wc -c "$BPFTRACE_OUT" | awk '{print $1}') -eq 0 ];
do
sleep 1
done
echo "$BPFTRACER_PID"
elif [ $TYPE == "parse" ];
then
EXECID=$3
EXEC_SUCCESS=$4
BPFTRACER_PID=$5
RESULTS_FILENAME=$6
echo "Killing bpftracer with pid=$BPFTRACER_PID"
kill -SIGINT $BPFTRACER_PID
if [ $EXEC_SUCCESS -eq 0 ];
then
sleep 1
sync
set +e
python -u probes-specs/execve-clone-parser-bpftrace.py $EXECID < $BPFTRACE_OUT >> $RESULTS_FILENAME
set -e
fi
else
echo "Cannot identify tracer behavior type [$TYPE]"
exit 1
fi
fi