add execve-counter examples

Author: bigwhite

ebpf-examples/execve-counter-go/Makefile

@@ -0,0 +1,13 @@
+CLANG ?= clang-10
+CFLAGS ?= -O2 -g -Wall -Werror
+
+LIBEBPF_TOP = /home/tonybai/go/src/github.com/cilium/ebpf
+EXAMPLES_HEADERS = $(LIBEBPF_TOP)/examples/headers
+
+all: generate
+
+generate: export BPF_CLANG=$(CLANG)
+generate: export BPF_CFLAGS=$(CFLAGS)
+generate: export BPF_HEADERS=$(EXAMPLES_HEADERS)
+generate:
+	go generate ./...

ebpf-examples/execve-counter-go/bpf_bpfeb.go

@@ -0,0 +1,27 @@
+
+#include "common.h"
+
+typedef __u64 u64;
+typedef char stringkey[64];
+
+struct {
+    __uint(type, BPF_MAP_TYPE_HASH);
+    __uint(max_entries, 128);
+	stringkey* key;
+    __type(value, u64);
+} execve_counter SEC(".maps");
+
+SEC("tracepoint/syscalls/sys_enter_execve")
+int bpf_prog(void *ctx) {
+  stringkey key = "execve_counter";
+  u64 *v = NULL;
+  v = bpf_map_lookup_elem(&execve_counter, &key);
+  if (v != NULL) {
+    *v += 1;
+    //bpf_map_update_elem(&execve_counter, &key, v, BPF_ANY);
+    //bpf_printk("map value: %d\n", *v);
+  }
+  return 0;
+}
+
+char LICENSE[] SEC("license") = "Dual BSD/GPL";

ebpf-examples/execve-counter-go/bpf_bpfel.go

@@ -0,0 +1,68 @@
+//go:build linux
+// +build linux
+
+package main
+
+import (
+	"log"
+	"os"
+	"os/signal"
+	"syscall"
+	"time"
+
+	"github.com/cilium/ebpf/link"
+	"github.com/cilium/ebpf/rlimit"
+)
+
+// $BPF_CLANG, $BPF_CFLAGS and $BPF_HEADERS are set by the Makefile.
+//go:generate bpf2go -cc $BPF_CLANG -cflags $BPF_CFLAGS -target bpfel,bpfeb bpf execve_counter.bpf.c -- -I $BPF_HEADERS
+func main() {
+	stopper := make(chan os.Signal, 1)
+	signal.Notify(stopper, os.Interrupt, syscall.SIGTERM)
+
+	// Allow the current process to lock memory for eBPF resources.
+	if err := rlimit.RemoveMemlock(); err != nil {
+		log.Fatal(err)
+	}
+
+	// Load pre-compiled programs and maps into the kernel.
+	objs := bpfObjects{}
+	if err := loadBpfObjects(&objs, nil); err != nil {
+		log.Fatalf("loading objects: %s", err)
+	}
+	defer objs.Close()
+
+	// init the map element
+	var key [64]byte
+	copy(key[:], []byte("execve_counter"))
+	var val int64 = 0
+	if err := objs.bpfMaps.ExecveCounter.Put(key, val); err != nil {
+		log.Fatalf("init map key error: %s", err)
+	}
+
+	// attach to xxx
+	kp, err := link.Tracepoint("syscalls", "sys_enter_execve", objs.BpfProg, nil)
+	if err != nil {
+		log.Fatalf("opening tracepoint: %s", err)
+	}
+	defer kp.Close()
+
+	ticker := time.NewTicker(5 * time.Second)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ticker.C:
+			if err := objs.bpfMaps.ExecveCounter.Lookup(key, &val); err != nil {
+				log.Fatalf("reading map error: %s", err)
+			}
+			log.Printf("execve_counter: %d\n", val)
+
+		case <-stopper:
+			// Wait for a signal and close the perf reader,
+			// which will interrupt rd.Read() and make the program exit.
+			log.Println("Received signal, exiting program..")
+			return
+		}
+	}
+}

ebpf-examples/execve-counter-go/execve_counter.bpf.c

@@ -0,0 +1,32 @@
+CLANG ?= clang-10
+LLVM_STRIP ?= llvm-strip-10
+ARCH := $(shell uname -m | sed 's/x86_64/x86/' | sed 's/aarch64/arm64/' | sed 's/ppc64le/powerpc/' | sed 's/mips.*/mips/')
+BPFTOOL ?= /usr/local/sbin/bpftool
+ARCH := $(shell uname -m | sed 's/x86_64/x86/' | sed 's/aarch64/arm64/' | sed 's/ppc64le/powerpc/' | sed 's/mips.*/mips/')
+
+LIBBPF_TOP = /home/tonybai/test/ebpf/libbpf
+
+LIBBPF_UAPI_INCLUDES = -I $(LIBBPF_TOP)/include/uapi
+LIBBPF_INCLUDES = -I /usr/local/bpf/include
+LIBBPF_LIBS = -L /usr/local/bpf/lib64 -lbpf
+
+INCLUDES=$(LIBBPF_UAPI_INCLUDES) $(LIBBPF_INCLUDES)
+
+CLANG_BPF_SYS_INCLUDES = $(shell $(CLANG) -v -E - </dev/null 2>&1 | sed -n '/<...> search starts here:/,/End of search list./{ s| \(/.*\)|-idirafter \1|p }')
+
+
+all: build
+
+build: execve_counter
+
+execve_counter.bpf.o: execve_counter.bpf.c
+	$(CLANG)  -g -O2 -target bpf -D__TARGET_ARCH_$(ARCH) $(INCLUDES) $(CLANG_BPF_SYS_INCLUDES) -c execve_counter.bpf.c 
+
+execve_counter.skel.h: execve_counter.bpf.o
+	$(BPFTOOL) gen skeleton execve_counter.bpf.o > execve_counter.skel.h
+
+execve_counter: execve_counter.skel.h execve_counter.c
+	$(CLANG)  -g -O2 -D__TARGET_ARCH_$(ARCH) $(INCLUDES) $(CLANG_BPF_SYS_INCLUDES) -o execve_counter execve_counter.c $(LIBBPF_LIBS) -lbpf -lelf -lz
+
+clean:
+	rm -fr execve_counter.bpf.o execve_counter