Re: arm64 execve/clone sys_exit tracepoints

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]


----- On Mar 8, 2022, at 5:11 AM, Federico Di Pierro nierro92@xxxxxxxxx wrote:

> Hi everyone,
> While testing Falco on arm64 my team and I encountered some weird
> issues; basically, it seems like execve() exit tracepoint is never
> called.
> Moreover, the clone() exit tracepoint referred to the child process is
> also missing.
> The issue is present on both the kmod and eBPF probe.
> I tested on amznlinux2 with kernel 5.10.96-90.460.amzn2.aarch64, but
> other team members tested on other kernel versions too (down to
> 4.14.X).
> I was also able to reproduce the problem using bpftrace tool: hooking
> on tracepoint:syscalls:sys_exit_execve; no event is received:
> bpftrace -e 'tracepoint:syscalls:sys_exit_execve { printf("execve!\n"); }'
> Since sys_enter tracepoints are indeed called, we'd expect the
> sys_exit ones to be called too, just like it happens on x86.
> The question is: are we missing anything obvious here?

I'm not sure about your clone issue, but wrt execve, I know there
may be some discrepancy when exec turns a non-compat executable into
a compat one and vice-versa. Do you exec a binary with a different
bitness, and therefore a different syscall table, on return from exec ?



> Thank you very much for your time,
> Regards
> Federico

Mathieu Desnoyers
EfficiOS Inc.

[Index of Archives]     [Linux USB Development]     [Linux USB Development]     [Linux Audio Users]     [Yosemite Hiking]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux