Re: How to get correct filename in probe.execve

[Arkady <larytet at gmail dot com>]

... and another question. What are pros and cons of using probe
kprocess.exec vs probe kernel.function("do_execve") ?
Thanks

On Sun, Jan 22, 2017 at 1:11 PM, Arkady <larytet@gmail.com> wrote:
> This is what I did
>
> global ARRAY_EXEC_DOEXECVE_FILENAME%
> global ARRAY_EXEC_DOEXECVE_ARGSTR%
>
> probe kprocess.exec
> {
>   tid = tid()
>   if (stringat(filename,0) == 0x22) // filename starts with a quotation mark
>   {
>       argstr = sprintf("%s, %s", filename, args)
>       pid = pid()
>       printf("pid=%d filename='%s', args='%s' kprocess.exec\n", pid,
> filename, argstr);
>   }
>   else  // failed to recog the filename, trigger do_execve
>   {
>      ARRAY_EXEC_DOEXECVE_FILENAME[tid] = @choose_defined($filename, $name)
>      ARRAY_EXEC_DOEXECVE_ARGSTR[tid] = @choose_defined($__argv, $argv)
>   }
> }
>
> probe kernel.function("do_execve")
> {
>   tid = tid()
>   if (tid in ARRAY_EXEC_DOEXECVE_FILENAME)  // unlikely
>   {
>      filename = user_string_quoted(ARRAY_EXEC_DOEXECVE_FILENAME[tid])
>      args = __get_argv(ARRAY_EXEC_DOEXECVE_ARGSTR[tid], 0)
>      argstr = sprintf("%s, %s", filename, args)
>      delete ARRAY_EXEC_DOEXECVE_FILENAME[tid]
>      delete ARRAY_EXEC_DOEXECVE_ARGSTR[tid]
>
>      pid = pid()
>      printf("pid=%d filename='%s', args='%s' do_execve\n", pid,
> filename, argstr);
>   }
> }
>
>
> Does it make sense?
> Is there a better way than "if (stringat(filename,0) == 0x22)" to
> figure out that fetching a failename from the user space failed?
> I am dropping the env_str by "argstr = sprintf("%s, %s", filename,
> args)". Is it the best way to get the string of arguments?
>
> Thanks
>
> On Sat, Jan 21, 2017 at 4:02 PM, Frank Ch. Eigler <fche@redhat.com> wrote:
>>
>> larytet wrote:
>>
>>> [...]
>>> I am trying to ensure that I keep an integer in the EXEC_FILENAME.
>>> If I do
>>> EXEC_FILENAME=filename
>>> SystemTap assumes a (zero terminated) string. [...]
>>
>> BTW, you could still use $filename (the context variable, which is an
>> integer/char*) instead of filename (the script level variable, which is
>> a string).
>>
>>
>> - FChE