1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
|
// SPDX-License-Identifier: GPL-2.0
#include <errno.h>
#include <inttypes.h>
#include <api/fs/tracing_path.h>
#include <linux/err.h>
#include <linux/string.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include "thread_map.h"
#include "evsel.h"
#include "debug.h"
#include "tests.h"
#include "util/counts.h"
static int test__openat_syscall_event(struct test_suite *test __maybe_unused,
int subtest __maybe_unused)
{
int err = TEST_FAIL, fd;
struct evsel *evsel;
unsigned int nr_openat_calls = 111, i;
struct perf_thread_map *threads = thread_map__new(-1, getpid(), UINT_MAX);
char sbuf[STRERR_BUFSIZE];
char errbuf[BUFSIZ];
if (threads == NULL) {
pr_debug("thread_map__new\n");
return TEST_FAIL;
}
evsel = evsel__newtp("syscalls", "sys_enter_openat");
if (IS_ERR(evsel)) {
tracing_path__strerror_open_tp(errno, errbuf, sizeof(errbuf), "syscalls", "sys_enter_openat");
pr_debug("%s\n", errbuf);
err = TEST_SKIP;
goto out_thread_map_delete;
}
if (evsel__open_per_thread(evsel, threads) < 0) {
pr_debug("failed to open counter: %s, "
"tweak /proc/sys/kernel/perf_event_paranoid?\n",
str_error_r(errno, sbuf, sizeof(sbuf)));
err = TEST_SKIP;
goto out_evsel_delete;
}
for (i = 0; i < nr_openat_calls; ++i) {
fd = openat(0, "/etc/passwd", O_RDONLY);
close(fd);
}
if (evsel__read_on_cpu(evsel, 0, 0) < 0) {
pr_debug("evsel__read_on_cpu\n");
goto out_close_fd;
}
if (perf_counts(evsel->counts, 0, 0)->val != nr_openat_calls) {
pr_debug("evsel__read_on_cpu: expected to intercept %d calls, got %" PRIu64 "\n",
nr_openat_calls, perf_counts(evsel->counts, 0, 0)->val);
goto out_close_fd;
}
err = TEST_OK;
out_close_fd:
perf_evsel__close_fd(&evsel->core);
out_evsel_delete:
evsel__delete(evsel);
out_thread_map_delete:
perf_thread_map__put(threads);
return err;
}
static struct test_case tests__openat_syscall_event[] = {
TEST_CASE_REASON("Detect openat syscall event",
openat_syscall_event,
"permissions"),
{ .name = NULL, }
};
struct test_suite suite__openat_syscall_event = {
.desc = "Detect openat syscall event",
.test_cases = tests__openat_syscall_event,
};
|
