Operating Systems 2022F: Tutorial 7 - Revision history

Soma: /* Getting set up (Running the right kernel) */

2022-11-11T03:52:20Z

Getting set up (Running the right kernel)

← Older revision		Revision as of 03:52, 11 November 2022
Line 17:		Line 17:
	==Getting set up (Running the right kernel)==		==Getting set up (Running the right kernel)==

	[https://bpftrace.org/ bpftrace] is already installed on the class virtual machines. If you are using a different version of Linux, you'll need to install ~~bpftrace~~ yourself. You may be able to use a binary package; however, bpftrace's functionality is very closely tied to the running version of the Linux kernel, thus scripts that work on one system may not work on another. To minimize problems~~, then~~, you should use the COMP 3000 VM if at all possible.		[https://bpftrace.org/ bpftrace] and [https://github.com/iovisor/bcc BCC] are already installed on the class virtual machines. If you are using a different version of Linux, you'll need to install both yourself. You may be able to use a binary package; however, to get the latest version you may have to build from source. Note that bpftrace's functionality is very closely tied to the running version of the Linux kernel, thus scripts that work on one system may not work on another.

			To minimize problems, you should use the COMP 3000 VM if at all possible.

	===Checking bpftrace===		===Checking bpftrace===

Soma at 03:49, 11 November 2022

2022-11-11T03:49:45Z

← Older revision		Revision as of 03:49, 11 November 2022
Line 18:		Line 18:

	[https://bpftrace.org/ bpftrace] is already installed on the class virtual machines. If you are using a different version of Linux, you'll need to install bpftrace yourself. You may be able to use a binary package; however, bpftrace's functionality is very closely tied to the running version of the Linux kernel, thus scripts that work on one system may not work on another. To minimize problems, then, you should use the COMP 3000 VM if at all possible.		[https://bpftrace.org/ bpftrace] is already installed on the class virtual machines. If you are using a different version of Linux, you'll need to install bpftrace yourself. You may be able to use a binary package; however, bpftrace's functionality is very closely tied to the running version of the Linux kernel, thus scripts that work on one system may not work on another. To minimize problems, then, you should use the COMP 3000 VM if at all possible.

	Having said this, there is one problem with the original class VMs: they are running the wrong kernel! The Ubuntu kvm kernel for some reason doesn't have all of the eBPF-related configuration options enabled even though the generic Ubuntu kernel does. So, you'll need to change the kernel that you're running in your VM.

	~~There are two solutions:~~
	~~# Make a new VM with an updated image COMP3000A-2021F-2. This VM has the right kernel installed. (If you do this, please delete your old VM.)~~
	~~# Follow the steps below to install the right kernel and make it the default.~~

	~~===Installing a new kernel in the (old) class VM===~~

	~~Run the following commands: (Note the # indicate comments:)~~

	~~sudo -i # become root~~
	~~apt update # update the package database~~
	~~apt -y dist-upgrade # upgrade all packages~~
	~~apt install linux-virtual # install linux-virtual, which will~~
	~~# install a generic linux kernel~~
	~~apt clean; apt -y autoremove # clean up~~
	~~grub-reboot 1\>4 # on next reboot, select the 2nd~~
	~~# menu item and then the 5th one~~
	~~reboot # reboot!~~

	~~Note the grub-reboot command assumes that you have two kvm kernels installed plus the new generic one. Your installed packages should look something like this:~~

	~~student@comp3000:~$ dpkg --list \| grep "linux-image-5" \| col2~~
	~~linux-image-5.11.0-1015-kvm~~
	~~linux-image-5.11.0-1017-kvm~~
	~~linux-image-5.11.0-37-generic~~

	If it doesn't, you'll need to change the 4 in the 1\>4 to the right number. Every kernel generates two entries with the second of each being a recovery image; thus, the number we want is the base-0 index times two. In other words, to run each of the above kernels we would put in 0, 2, or 4, respectively.

	~~(Note this is all easier if you can see the grub menu when the kernel boots. We will later show you how to navigate this menu; for now the above should get you running the correct kernel.)~~

	===Checking bpftrace===		===Checking bpftrace===

Soma at 14:58, 4 November 2022

2022-11-04T14:58:47Z

← Older revision		Revision as of 14:58, 4 November 2022
Line 1:		Line 1:
	~~'''This tutorial is still being developed.'''~~

	In this tutorial, you will use a variety of bpftrace scripts in order to observe 3000shell and other running programs.		In this tutorial, you will use a variety of bpftrace scripts in order to observe 3000shell and other running programs.

Soma: /* trace_sys_write.py */

2022-11-04T14:56:17Z

trace_sys_write.py

← Older revision		Revision as of 14:56, 4 November 2022
Line 145:		Line 145:
	==Code==		==Code==

	===trace_sys_write.py===		===[https://homeostasis.scs.carleton.ca/~soma/os-2022f/code/trace_sys_write.py trace_sys_write.py]===
	<syntaxhighlight lang="python" line>		<syntaxhighlight lang="python" line>
	#!/usr/bin/python3		#!/usr/bin/python3

Huzaifa: /* Part A: Examining Predefined Linux Kernel Tracepoints */

2022-11-03T04:14:49Z

Part A: Examining Predefined Linux Kernel Tracepoints

← Older revision		Revision as of 04:14, 3 November 2022
Line 89:		Line 89:
	<li> Are any of the lines outputted by tplist used in the implementation of syscount.bt? If so, which line(s)?</li>		<li> Are any of the lines outputted by tplist used in the implementation of syscount.bt? If so, which line(s)?</li>
	<li> tplist uses Python's built-in file IO functions to open a file. Which file does tplist open? Why?</li>		<li> tplist uses Python's built-in file IO functions to open a file. Which file does tplist open? Why?</li>
	<li> A common characteristic of bpftrace tools is its use of of the args struct. For example, in killsnoop.bt, args->pid is used to retrieve the pid of the process that initiated the kill system call. Where can we find the fields of the args struct? Hint: Explore the directory structure you found in the previous question.</li>		<li> A common characteristic of bpftrace tools is its use of of the args struct. For example, in killsnoop.bt, args->pid is used to retrieve the pid of the process that initiated the kill system call. Where can we find the fields of the args struct?

			'''Hint''': Explore the directory structure you found in the previous question.</li>

	<li>The Linux kernel code that partially implements the tracepoint for task creation can be found [https://elixir.bootlin.com/linux/latest/source/include/trace/events/task.h here]: </li>		<li>The Linux kernel code that partially implements the tracepoint for task creation can be found [https://elixir.bootlin.com/linux/latest/source/include/trace/events/task.h here]: </li>

Huzaifa: /* Part A: Examining Predefined Linux Kernel Tracepoints */

2022-11-03T04:13:29Z

Part A: Examining Predefined Linux Kernel Tracepoints

← Older revision		Revision as of 04:13, 3 November 2022
Line 89:		Line 89:
	<li> Are any of the lines outputted by tplist used in the implementation of syscount.bt? If so, which line(s)?</li>		<li> Are any of the lines outputted by tplist used in the implementation of syscount.bt? If so, which line(s)?</li>
	<li> tplist uses Python's built-in file IO functions to open a file. Which file does tplist open? Why?</li>		<li> tplist uses Python's built-in file IO functions to open a file. Which file does tplist open? Why?</li>
	<li> A common characteristic of bpftrace tools is its use of of the args struct. For example, in killsnoop.bt, args->pid is used to retrieve the pid of the process that initiated the kill system call. Where can we find the fields of the args struct?</li>		<li> A common characteristic of bpftrace tools is its use of of the args struct. For example, in killsnoop.bt, args->pid is used to retrieve the pid of the process that initiated the kill system call. Where can we find the fields of the args struct? Hint: Explore the directory structure you found in the previous question.</li>

	<li>The Linux kernel code that partially implements the tracepoint for task creation can be found [https://elixir.bootlin.com/linux/latest/source/include/trace/events/task.h here]: </li>		<li>The Linux kernel code that partially implements the tracepoint for task creation can be found [https://elixir.bootlin.com/linux/latest/source/include/trace/events/task.h here]: </li>

Huzaifa: /* trace_sys_write.py */

2022-11-03T03:55:48Z

trace_sys_write.py

← Older revision		Revision as of 03:55, 3 November 2022
Line 191:		Line 191:


			# Try uncommenting the call to trace_write_syscall() if you want to test trace_open_syscall()
	def main():		def main():
	trace_write_syscall()		trace_write_syscall()

Huzaifa: /* trace_sys_write.py */

2022-11-03T03:53:34Z

trace_sys_write.py

← Older revision		Revision as of 03:53, 3 November 2022
Line 185:		Line 185:


	# TODO		# TODO - Part A: Question 7
	# WRITE YOUR CODE IN THE FUNCTION BELOW:		# WRITE YOUR CODE IN THE FUNCTION BELOW:
	def ~~trace_read_syscall~~():		def trace_open_syscall():
	print("")		print("")

Line 193:		Line 193:
	def main():		def main():
	trace_write_syscall()		trace_write_syscall()
	~~trace_read_syscall~~()		trace_open_syscall()

Huzaifa: Change to sys_open

2022-11-03T03:52:21Z

Change to sys_open

← Older revision		Revision as of 03:52, 3 November 2022
Line 98:		Line 98:
	</ol>		</ol>

	<li> Using the trace_write_syscall() function as a reference, finish the ~~trace_read_syscall~~() function to make it trace the ~~sys_read~~ system call. Make use of every field of the args struct in your implementation. </li>		<li> Using the trace_write_syscall() function as a reference, finish the trace_open_syscall() function to make it trace the sys_open system call. Make use of every field of the args struct in your implementation. </li>
	</ol>		</ol>

Huzaifa: /* The Linux Kernel Tracepoint API */

2022-11-03T03:25:05Z

The Linux Kernel Tracepoint API

← Older revision		Revision as of 03:25, 3 November 2022
Line 5:		Line 5:
	==The Linux Kernel Tracepoint API==		==The Linux Kernel Tracepoint API==

	A tracepoint is a piece of code, which can be used to hook into important sections of the Linux ~~Kernel~~. They can be used by a number of tools like eBPF to allow userspace programs to debug, measure performance, or diagnose problems that exist within the Linux ~~Kernel~~. Tracepoints are defined in a number of header [https://elixir.bootlin.com/linux/latest/source/include/trace/events files] in the Linux ~~Kernel~~ via various macros.		A tracepoint is a piece of code, which can be used to hook into important sections of the Linux kernel. They can be used by a number of tools like eBPF to allow userspace programs to debug, measure performance, or diagnose problems that exist within the Linux kernel. Tracepoints are defined in a number of header [https://elixir.bootlin.com/linux/latest/source/include/trace/events files] in the Linux kernel via various macros.

	==ptrace, eBPF, and bpftrace==		==ptrace, eBPF, and bpftrace==