FM / examples

/usr/share/doc/bpftrace/examples

Name	Size	Mode	Actions
bashreadline_example.txt	722	0644	edit dl rm
biolatency_example.txt	1790	0644	edit dl rm
biosnoop_example.txt	2056	0644	edit dl rm
biostacks_example.txt	1914	0644	edit dl rm
bitesize_example.txt	3003	0644	edit dl rm
capable_example.txt	2659	0644	edit dl rm
cpuwalk_example.txt	4919	0644	edit dl rm
dcsnoop_example.txt	4612	0644	edit dl rm
execsnoop_example.txt	1535	0644	edit dl rm
gethostlatency_example.txt	923	0644	edit dl rm
killsnoop_example.txt	846	0644	edit dl rm
loads_example.txt	864	0644	edit dl rm
mdflush_example.txt	1866	0644	edit dl rm
naptime_example.txt	844	0644	edit dl rm
oomkill_example.txt	1668	0644	edit dl rm
opensnoop_example.txt	2528	0644	edit dl rm
pidpersec_example.txt	1504	0644	edit dl rm
runqlat_example.txt	8632	0644	edit dl rm
runqlen_example.txt	980	0644	edit dl rm
setuids_example.txt	2441	0644	edit dl rm
ssllatency_example.txt	4510	0644	edit dl rm
sslsnoop_example.txt	1916	0644	edit dl rm
statsnoop_example.txt	2738	0644	edit dl rm
swapin_example.txt	549	0644	edit dl rm
syncsnoop_example.txt	541	0644	edit dl rm
syscount_example.txt	1144	0644	edit dl rm
tcpaccept_example.txt	1350	0644	edit dl rm
tcpconnect_example.txt	1085	0644	edit dl rm
tcpdrop_example.txt	1256	0644	edit dl rm
tcplife_example.txt	1597	0644	edit dl rm
tcpretrans_example.txt	1153	0644	edit dl rm
tcpsynbl_example.txt	940	0644	edit dl rm
threadsnoop_example.txt	1182	0644	edit dl rm
undump_example.txt	680	0644	edit dl rm
vfscount_example.txt	1199	0644	edit dl rm
vfsstat_example.txt	929	0644	edit dl rm
writeback_example.txt	1962	0644	edit dl rm
xfsdist_example.txt	3419	0644	edit dl rm

Edit: /usr/share/doc/bpftrace/examples/setuids_example.txt (2441B)

Demonstrations of setuids, the Linux bpftrace/eBPF version.

This tool traces privilege escalation via setuid syscalls (setuid(2),
setfsuid(2), retresuid(2)). For example, here are the setuid calls during an
ssh login:

# ./setuids.bt
Attaching 7 probes...
Tracing setuid(2) family syscalls. Hit Ctrl-C to end.
TIME     PID    COMM             UID    SYSCALL   ARGS (RET)
14:28:22 21785  ssh              1000   setresuid ruid=-1 euid=1000 suid=-1 (0)
14:28:22 21787  sshd             0      setresuid ruid=122 euid=122 suid=122 (0)
14:28:22 21787  sshd             122    setuid    uid=0 (-1)
14:28:22 21787  sshd             122    setresuid ruid=-1 euid=0 suid=-1 (-1)
14:28:24 21786  sshd             0      setresuid ruid=-1 euid=1000 suid=-1 (0)
14:28:24 21786  sshd             0      setresuid ruid=-1 euid=0 suid=-1 (0)
14:28:24 21786  sshd             0      setresuid ruid=-1 euid=1000 suid=-1 (0)
14:28:24 21786  sshd             0      setresuid ruid=-1 euid=0 suid=-1 (0)
14:28:24 21786  sshd             0      setfsuid  uid=1000 (prevuid=0)
14:28:24 21786  sshd             0      setfsuid  uid=1000 (prevuid=1000)
14:28:24 21786  sshd             0      setfsuid  uid=0 (prevuid=1000)
14:28:24 21786  sshd             0      setfsuid  uid=0 (prevuid=0)
14:28:24 21786  sshd             0      setfsuid  uid=1000 (prevuid=0)
14:28:24 21786  sshd             0      setfsuid  uid=1000 (prevuid=1000)
14:28:24 21786  sshd             0      setfsuid  uid=0 (prevuid=1000)
14:28:24 21786  sshd             0      setfsuid  uid=0 (prevuid=0)
14:28:24 21786  sshd             0      setfsuid  uid=1000 (prevuid=0)
14:28:24 21786  sshd             0      setfsuid  uid=1000 (prevuid=1000)
14:28:24 21786  sshd             0      setfsuid  uid=0 (prevuid=1000)
14:28:24 21786  sshd             0      setfsuid  uid=0 (prevuid=0)
14:28:24 21851  sshd             0      setresuid ruid=1000 euid=1000 suid=1000 (0)
14:28:24 21851  sshd             1000   setuid    uid=0 (-1)
14:28:24 21851  sshd             1000   setresuid ruid=-1 euid=0 suid=-1 (-1)

Why does sshd make so many calls? I don't know! Nevertheless, this shows what
this tool can do: it shows the caller details (PID, COMM, and UID), the syscall
(SYSCALL), and the syscall arguments (ARGS) and return value (RET). You can
modify this tool to print user stack traces for each call, which will show the
code path in sshd (provided it is compiled with frame pointers).

Demonstrations of setuids, the Linux bpftrace/eBPF version. This tool traces privilege escalation via setuid syscalls (setuid(2), setfsuid(2), retresuid(2)). For example, here are the setuid calls during an ssh login: # ./setuids.bt Attaching 7 probes... Tracing setuid(2) family syscalls. Hit Ctrl-C to end. TIME PID COMM UID SYSCALL ARGS (RET) 14:28:22 21785 ssh 1000 setresuid ruid=-1 euid=1000 suid=-1 (0) 14:28:22 21787 sshd 0 setresuid ruid=122 euid=122 suid=122 (0) 14:28:22 21787 sshd 122 setuid uid=0 (-1) 14:28:22 21787 sshd 122 setresuid ruid=-1 euid=0 suid=-1 (-1) 14:28:24 21786 sshd 0 setresuid ruid=-1 euid=1000 suid=-1 (0) 14:28:24 21786 sshd 0 setresuid ruid=-1 euid=0 suid=-1 (0) 14:28:24 21786 sshd 0 setresuid ruid=-1 euid=1000 suid=-1 (0) 14:28:24 21786 sshd 0 setresuid ruid=-1 euid=0 suid=-1 (0) 14:28:24 21786 sshd 0 setfsuid uid=1000 (prevuid=0) 14:28:24 21786 sshd 0 setfsuid uid=1000 (prevuid=1000) 14:28:24 21786 sshd 0 setfsuid uid=0 (prevuid=1000) 14:28:24 21786 sshd 0 setfsuid uid=0 (prevuid=0) 14:28:24 21786 sshd 0 setfsuid uid=1000 (prevuid=0) 14:28:24 21786 sshd 0 setfsuid uid=1000 (prevuid=1000) 14:28:24 21786 sshd 0 setfsuid uid=0 (prevuid=1000) 14:28:24 21786 sshd 0 setfsuid uid=0 (prevuid=0) 14:28:24 21786 sshd 0 setfsuid uid=1000 (prevuid=0) 14:28:24 21786 sshd 0 setfsuid uid=1000 (prevuid=1000) 14:28:24 21786 sshd 0 setfsuid uid=0 (prevuid=1000) 14:28:24 21786 sshd 0 setfsuid uid=0 (prevuid=0) 14:28:24 21851 sshd 0 setresuid ruid=1000 euid=1000 suid=1000 (0) 14:28:24 21851 sshd 1000 setuid uid=0 (-1) 14:28:24 21851 sshd 1000 setresuid ruid=-1 euid=0 suid=-1 (-1) Why does sshd make so many calls? I don't know! Nevertheless, this shows what this tool can do: it shows the caller details (PID, COMM, and UID), the syscall (SYSCALL), and the syscall arguments (ARGS) and return value (RET). You can modify this tool to print user stack traces for each call, which will show the code path in sshd (provided it is compiled with frame pointers).