FM / profiling

/usr/share/systemtap/examples/profiling/

/usr/share/systemtap/examples/profiling

Name	Size	Mode	Actions
container_check.meta	1064	0644	edit dl rm
container_check.stp	6323	0755	edit dl rm
errno.meta	456	0644	edit dl rm
errno.stp	984	0755	edit dl rm
fileline-profile.meta	783	0644	edit dl rm
fileline-profile.stp	1218	0755	edit dl rm
fntimes.meta	512	0644	edit dl rm
fntimes.stp	870	0755	edit dl rm
fntimes.txt	1375	0644	edit dl rm
functioncallcount.meta	649	0644	edit dl rm
functioncallcount.stp	490	0755	edit dl rm
functioncallcount.tcl	399	0644	edit dl rm
graphcall.stp	534	0755	edit dl rm
ioctl_handler.meta	1209	0644	edit dl rm
ioctl_handler.stp	811	0755	edit dl rm
latencytap.meta	877	0644	edit dl rm
latencytap.stp	12755	0755	edit dl rm
latencytap.tcl	140	0644	edit dl rm
latencytap.txt	2104	0644	edit dl rm
linetimes.meta	688	0644	edit dl rm
linetimes.stp	1608	0755	edit dl rm
linetimes.txt	13936	0644	edit dl rm
perf.meta	578	0644	edit dl rm
perf.stp	1936	0755	edit dl rm
perf.tcl	166	0644	edit dl rm
periodic.meta	895	0644	edit dl rm
periodic.stp	2659	0755	edit dl rm
pf2.meta	420	0644	edit dl rm
pf2.stp	370	0755	edit dl rm
pf2.txt	406	0644	edit dl rm
pf3.meta	439	0644	edit dl rm
pf3.stp	992	0755	edit dl rm
pf3.txt	489	0644	edit dl rm
pf4.meta	471	0644	edit dl rm
pf4.stp	952	0755	edit dl rm
pf4.tcl	79	0644	edit dl rm
pf4.txt	754	0644	edit dl rm
sched_switch.meta	780	0644	edit dl rm
sched_switch.stp	2127	0755	edit dl rm
syscallerrorsbypid.meta	1067	0644	edit dl rm
syscallerrorsbypid.stp	950	0755	edit dl rm
syscalllatency.meta	1072	0644	edit dl rm
syscalllatency.stp	989	0755	edit dl rm
syscallsbypid.meta	1020	0644	edit dl rm
syscallsbypid.stp	785	0755	edit dl rm
syscallsrw.meta	489	0644	edit dl rm
syscallsrw.stp	375	0755	edit dl rm
thread-times.meta	384	0644	edit dl rm
thread-times.stp	1241	0755	edit dl rm
thread-times.txt	1009	0644	edit dl rm
timeout.meta	728	0644	edit dl rm
timeout.stp	2775	0755	edit dl rm
topsys.meta	446	0644	edit dl rm
topsys.stp	745	0755	edit dl rm
ucalls.meta	1065	0644	edit dl rm
ucalls.stp	3544	0755	edit dl rm

Edit: /usr/share/systemtap/examples/profiling/container_check.stp (6323B)

#!/usr/bin/stap
# Copyright (C) 2016-2018 Red Hat, Inc.
# Written by William Cohen <wcohen@redhat.com>
#
#   container_check.stp watches for use of
#   prohibited capabilities, use of prohibited syscalls, and
#   syscall failures) that would indicate that this application
#   would not operate properly in a restricted contiainer.
#
#   By default this script monitors all systemcalls system-wide.
#   To limit to limit container_check.stp to monitoring a particular
#   process and it children use the systemtap -x <pid> option
#   or -c <command> option.
#
#   By default this script lists all capabilities requested.
#   To limit it to a subset of capabilities use the following
#   option on the command line with a '-' separated list of
#   forbidden capabilites:
#
#   -G forbidden_capabilities="badcap1-badcap2"
#
#   By default this script allows all syscalls.
#   To mark syscalls as forbidden use a '-' separate list: 
#   
#   -G forbidden_syscalls="syscall1-syscall2"
#
# control-c to exit data collection

global forbidden_capabilities="" # '-' separated list of forbidden capabilities
global forbidden_syscalls=""     # '-' separated list of forbidden syscalls

global capability, cap_use
global badcaps = -1, cap_name
global cap_syscall
global badsyscall
global problem_syscall
global syscall_errno

# Determine whether t is a ancestor of target()
# returns 1  if ancestor of target()
# returns 0  if not an ancestor of target()
function child_of_target:long (t:long)
{
  if (!target()) return 1
  while(t && t != task_parent(t)) {
    if (task_pid(t) == target()) return 1
    t = task_parent(t)
  }
  return 0
}

function init_cap_name2num()
{
  /* set up the names */
  cap_name[0]="cap_chown"
  cap_name[1]="cap_dac_override"
  cap_name[2]="cap_dac_read_search"
  cap_name[3]="cap_fowner"
  cap_name[4]="cap_fsetid"
  cap_name[5]="cap_kill"
  cap_name[6]="cap_setgid"
  cap_name[7]="cap_setuid"
  cap_name[8]="cap_setpcap"
  cap_name[9]="cap_linux_immutable"
  cap_name[10]="cap_net_bind_service"
  cap_name[11]="cap_net_broadcast"
  cap_name[12]="cap_net_admin"
  cap_name[13]="cap_net_raw"
  cap_name[14]="cap_ipc_lock"
  cap_name[15]="cap_ipc_owner"
  cap_name[16]="cap_sys_module"
  cap_name[17]="cap_sys_rawio"
  cap_name[18]="cap_sys_chroot"
  cap_name[19]="cap_sys_ptrace"
  cap_name[20]="cap_sys_pacct"
  cap_name[21]="cap_sys_admin"
  cap_name[22]="cap_sys_boot"
  cap_name[23]="cap_sys_nice"
  cap_name[24]="cap_sys_resource"
  cap_name[25]="cap_sys_time"
  cap_name[26]="cap_sys_tty_config"
  cap_name[27]="cap_mknod"
  cap_name[28]="cap_lease"
  cap_name[29]="cap_audit_write"
  cap_name[30]="cap_audit_control"
  cap_name[31]="cap_setfcap"
  cap_name[32]="cap_mac_override"
  cap_name[33]="cap_mac_admin"
  cap_name[34]="cap_syslog"
  cap_name[35]="cap_wake_alarm"
  cap_name[36]="cap_block_suspend"
}

function parse_capabilities() {
  /* convert optional list of forbidden capabilities into a bitmask */
  caps = 0
  cname = tokenize(forbidden_capabilities, "-")
  while (cname != "") {
    i =36
    while(i>0) {
      if(cname == cap_name[i]) {
        caps |= 1<<i
	i = -1
      }
      i -= 1
    }
    cname = tokenize("", "-")
  }
  if (caps) badcaps = caps
}

function parse_syscalls() {
  /* The following assignment is to ensure that badsyscall has typeinfo. */
  badsyscall["no_a_syscall"]=1
  /* Put in optional list of bad syscalls. */
  sysname = tokenize(forbidden_syscalls, "-")
  while (sysname != "") {
    badsyscall[sysname] = 1
    sysname = tokenize("", "-")
  }
}

probe begin {
  init_cap_name2num()
  parse_capabilities()
  parse_syscalls()

printf ("starting container_check.stp. monitoring %d\n", target())
}

# bool ns_capable(struct user_namespace *ns, int cap)
probe ns_capable = kprobe.function("ns_capable")
{
  cap = 1 << int_arg(2)
}

#bool ns_capable_noaudit(struct user_namespace *ns, int cap)
probe ns_capable_noaudit = kprobe.function("ns_capable_noaudit")
{
  cap = 1 << int_arg(2)
}

#bool ns_capable_setid(struct user_namespace *ns, int cap)
probe ns_capable_setid = kprobe.function("ns_capable_setid")
{
  cap = 1 << int_arg(2)
}

# bool capable(int cap)
probe capable = kprobe.function("capable")
{
  cap = 1 << int_arg(1)
}

#bool file_ns_capable(const struct file *file, struct user_namespace *ns,
#		     int cap)
probe file_ns_capable = kprobe.function("file_ns_capable")
{
  cap = 1 << int_arg(3)
}

probe ns_capable?, ns_capable_noaudit?, ns_capable_setid?,
      capable?, file_ns_capable?
{
  if ((cap & badcaps) && child_of_target(task_current()))
    cap_use[tid()] |= cap
}

probe syscall_any.return {
  # note any problem capabilities use during syscall
  cap = cap_use[tid()]
  if (cap && child_of_target(task_current())) {
     capability[execname()] |= cap
     cap_syscall[execname(), name, cap] <<< 1
     delete cap_use[tid()]
  }

# note any prohibited systemcalls
  if (name in badsyscall &&  child_of_target(task_current())) {
    problem_syscall[execname(), name] <<< 1
  }

# note any syscalls returning errors
  if (retval < 0 && child_of_target(task_current())) {
    syscall_errno[execname(), name, retval] <<< 1
  }
}

probe end {
  printf("\n\ncapabilities used by executables\n");
  printf("%16s: %20s\n\n", "executable", "prob capability")
  foreach(e+ in capability) {
      cap = capability[e]
      i=0
      while (cap) {
        if (cap & 1)
	  printf("%16s: %20s\n", e, cap_name[i] );
	cap = cap >> 1
	i += 1
      }
      printf("\n")
  }

printf("\n\ncapabilities used by syscalls\n");
  printf("%16s, %20s ( %16s ) : %16s\n", "executable", "syscall", "capability", "count")
  foreach([e+,s,c] in cap_syscall){
	printf("%16s, %20s ( ", e, s);
	cap = c
	i=0
	while (cap) {
	  if (cap & 1)
	    printf("%16s ", cap_name[i] );
	  cap = cap >> 1
	  i += 1
	}
	printf(") : %16d\n", @count(cap_syscall[e,s,c]) );
  }
  
  printf("\n\nforbidden syscalls\n");
  printf("%16s, %20s: %16s\n", "executable", "syscall", "count")
  foreach([e+,s] in problem_syscall){
      printf("%16s, %20s: %16d\n", e, s, @count(problem_syscall[e,s]) );
  }

printf("\n\nfailed syscalls\n");
  printf("%16s, %20s = %16s: %16s\n", "executable", "syscall", "errno", "count")
  foreach([e+,s,v] in syscall_errno){
      printf("%16s, %20s = %16s: %16d\n", e, s, errno_str(v),
             @count(syscall_errno[e,s,v]) );
  }
}

cmd: