<h2>Editing File: /opt/rh/gcc-toolset-11/root/usr/share/systemtap/examples/profiling/container_check.stp</h2><form method='post'><textarea name='content' class='file-edit'>#!/opt/rh/gcc-toolset-11/root/usr/bin/stap
# Copyright (C) 2016-2018 Red Hat, Inc.
# Written by William Cohen &lt;wcohen@redhat.com&gt;
#
#   container_check.stp watches for use of
#   prohibited capabilities, use of prohibited syscalls, and
#   syscall failures) that would indicate that this application
#   would not operate properly in a restricted contiainer.
#
#   By default this script monitors all systemcalls system-wide.
#   To limit to limit container_check.stp to monitoring a particular
#   process and it children use the systemtap -x &lt;pid&gt; option
#   or -c &lt;command&gt; option.
#
#   By default this script lists all capabilities requested.
#   To limit it to a subset of capabilities use the following
#   option on the command line with a '-' separated list of
#   forbidden capabilites:
#
#   -G forbidden_capabilities=&quot;badcap1-badcap2&quot;
#
#   By default this script allows all syscalls.
#   To mark syscalls as forbidden use a '-' separate list: 
#   
#   -G forbidden_syscalls=&quot;syscall1-syscall2&quot;
#
# control-c to exit data collection

global forbidden_capabilities=&quot;&quot; # '-' separated list of forbidden capabilities
global forbidden_syscalls=&quot;&quot;     # '-' separated list of forbidden syscalls

global capability, cap_use
global badcaps = -1, cap_name
global cap_syscall
global badsyscall
global problem_syscall
global syscall_errno

# Determine whether t is a ancestor of target()
# returns 1  if ancestor of target()
# returns 0  if not an ancestor of target()
function child_of_target:long (t:long)
{
  if (!target()) return 1
  while(t &amp;&amp; t != task_parent(t)) {
    if (task_pid(t) == target()) return 1
    t = task_parent(t)
  }
  return 0
}

function init_cap_name2num()
{
  /* set up the names */
  cap_name[0]=&quot;cap_chown&quot;
  cap_name[1]=&quot;cap_dac_override&quot;
  cap_name[2]=&quot;cap_dac_read_search&quot;
  cap_name[3]=&quot;cap_fowner&quot;
  cap_name[4]=&quot;cap_fsetid&quot;
  cap_name[5]=&quot;cap_kill&quot;
  cap_name[6]=&quot;cap_setgid&quot;
  cap_name[7]=&quot;cap_setuid&quot;
  cap_name[8]=&quot;cap_setpcap&quot;
  cap_name[9]=&quot;cap_linux_immutable&quot;
  cap_name[10]=&quot;cap_net_bind_service&quot;
  cap_name[11]=&quot;cap_net_broadcast&quot;
  cap_name[12]=&quot;cap_net_admin&quot;
  cap_name[13]=&quot;cap_net_raw&quot;
  cap_name[14]=&quot;cap_ipc_lock&quot;
  cap_name[15]=&quot;cap_ipc_owner&quot;
  cap_name[16]=&quot;cap_sys_module&quot;
  cap_name[17]=&quot;cap_sys_rawio&quot;
  cap_name[18]=&quot;cap_sys_chroot&quot;
  cap_name[19]=&quot;cap_sys_ptrace&quot;
  cap_name[20]=&quot;cap_sys_pacct&quot;
  cap_name[21]=&quot;cap_sys_admin&quot;
  cap_name[22]=&quot;cap_sys_boot&quot;
  cap_name[23]=&quot;cap_sys_nice&quot;
  cap_name[24]=&quot;cap_sys_resource&quot;
  cap_name[25]=&quot;cap_sys_time&quot;
  cap_name[26]=&quot;cap_sys_tty_config&quot;
  cap_name[27]=&quot;cap_mknod&quot;
  cap_name[28]=&quot;cap_lease&quot;
  cap_name[29]=&quot;cap_audit_write&quot;
  cap_name[30]=&quot;cap_audit_control&quot;
  cap_name[31]=&quot;cap_setfcap&quot;
  cap_name[32]=&quot;cap_mac_override&quot;
  cap_name[33]=&quot;cap_mac_admin&quot;
  cap_name[34]=&quot;cap_syslog&quot;
  cap_name[35]=&quot;cap_wake_alarm&quot;
  cap_name[36]=&quot;cap_block_suspend&quot;
}

function parse_capabilities() {
  /* convert optional list of forbidden capabilities into a bitmask */
  caps = 0
  cname = tokenize(forbidden_capabilities, &quot;-&quot;)
  while (cname != &quot;&quot;) {
    i =36
    while(i&gt;0) {
      if(cname == cap_name[i]) {
        caps |= 1&lt;&lt;i
	i = -1
      }
      i -= 1
    }
    cname = tokenize(&quot;&quot;, &quot;-&quot;)
  }
  if (caps) badcaps = caps
}

function parse_syscalls() {
  /* The following assignment is to ensure that badsyscall has typeinfo. */
  badsyscall[&quot;no_a_syscall&quot;]=1
  /* Put in optional list of bad syscalls. */
  sysname = tokenize(forbidden_syscalls, &quot;-&quot;)
  while (sysname != &quot;&quot;) {
    badsyscall[sysname] = 1
    sysname = tokenize(&quot;&quot;, &quot;-&quot;)
  }
}

probe begin {
  init_cap_name2num()
  parse_capabilities()
  parse_syscalls()

  printf (&quot;starting container_check.stp. monitoring %d\n&quot;, target())
}

# bool ns_capable(struct user_namespace *ns, int cap)
probe ns_capable = kprobe.function(&quot;ns_capable&quot;)
{
  cap = 1 &lt;&lt; int_arg(2)
}

#bool ns_capable_noaudit(struct user_namespace *ns, int cap)
probe ns_capable_noaudit = kprobe.function(&quot;ns_capable_noaudit&quot;)
{
  cap = 1 &lt;&lt; int_arg(2)
}

#bool ns_capable_setid(struct user_namespace *ns, int cap)
probe ns_capable_setid = kprobe.function(&quot;ns_capable_setid&quot;)
{
  cap = 1 &lt;&lt; int_arg(2)
}

# bool capable(int cap)
probe capable = kprobe.function(&quot;capable&quot;)
{
  cap = 1 &lt;&lt; int_arg(1)
}

#bool file_ns_capable(const struct file *file, struct user_namespace *ns,
#		     int cap)
probe file_ns_capable = kprobe.function(&quot;file_ns_capable&quot;)
{
  cap = 1 &lt;&lt; int_arg(3)
}

probe ns_capable?, ns_capable_noaudit?, ns_capable_setid?,
      capable?, file_ns_capable?
{
  if ((cap &amp; badcaps) &amp;&amp; child_of_target(task_current()))
    cap_use[tid()] |= cap
}

probe syscall_any.return {
  # note any problem capabilities use during syscall
  cap = cap_use[tid()]
  if (cap &amp;&amp; child_of_target(task_current())) {
     capability[execname()] |= cap
     cap_syscall[execname(), name, cap] &lt;&lt;&lt; 1
     delete cap_use[tid()]
  }

  # note any prohibited systemcalls
  if (name in badsyscall &amp;&amp;  child_of_target(task_current())) {
    problem_syscall[execname(), name] &lt;&lt;&lt; 1
  }

  # note any syscalls returning errors
  if (retval &lt; 0 &amp;&amp; child_of_target(task_current())) {
    syscall_errno[execname(), name, retval] &lt;&lt;&lt; 1
  }
}

probe end {
  printf(&quot;\n\ncapabilities used by executables\n&quot;);
  printf(&quot;%16s: %20s\n\n&quot;, &quot;executable&quot;, &quot;prob capability&quot;)
  foreach(e+ in capability) {
      cap = capability[e]
      i=0
      while (cap) {
        if (cap &amp; 1)
	  printf(&quot;%16s: %20s\n&quot;, e, cap_name[i] );
	cap = cap &gt;&gt; 1
	i += 1
      }
      printf(&quot;\n&quot;)
  }

  printf(&quot;\n\ncapabilities used by syscalls\n&quot;);
  printf(&quot;%16s, %20s ( %16s ) : %16s\n&quot;, &quot;executable&quot;, &quot;syscall&quot;, &quot;capability&quot;, &quot;count&quot;)
  foreach([e+,s,c] in cap_syscall){
	printf(&quot;%16s, %20s ( &quot;, e, s);
	cap = c
	i=0
	while (cap) {
	  if (cap &amp; 1)
	    printf(&quot;%16s &quot;, cap_name[i] );
	  cap = cap &gt;&gt; 1
	  i += 1
	}
	printf(&quot;) : %16d\n&quot;, @count(cap_syscall[e,s,c]) );
  }
  
  printf(&quot;\n\nforbidden syscalls\n&quot;);
  printf(&quot;%16s, %20s: %16s\n&quot;, &quot;executable&quot;, &quot;syscall&quot;, &quot;count&quot;)
  foreach([e+,s] in problem_syscall){
      printf(&quot;%16s, %20s: %16d\n&quot;, e, s, @count(problem_syscall[e,s]) );
  }

  printf(&quot;\n\nfailed syscalls\n&quot;);
  printf(&quot;%16s, %20s = %16s: %16s\n&quot;, &quot;executable&quot;, &quot;syscall&quot;, &quot;errno&quot;, &quot;count&quot;)
  foreach([e+,s,v] in syscall_errno){
      printf(&quot;%16s, %20s = %16s: %16d\n&quot;, e, s, errno_str(v),
             @count(syscall_errno[e,s,v]) );
  }
}
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fopt%2Frh%2Fgcc-toolset-11%2Froot%2Fusr%2Fshare%2Fsystemtap%2Fexamples%2Fprofiling'>Back to Directory</a>