File: utils.go

package info (click to toggle)
golang-github-evilsocket-ftrace 1.2.0-2.1
  • links: PTS, VCS
  • area: main
  • in suites: bookworm, bullseye, forky, sid, trixie
  • size: 128 kB
  • sloc: sh: 71; makefile: 5
file content (68 lines) | stat: -rw-r--r-- 1,548 bytes parent folder | download | duplicates (2)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
package ftrace

import (
	"fmt"
	"io/ioutil"
	"os"
	"strings"
)

// Available returns true if FTRACE is available on this system, otherwise false.
func Available() bool {
	return trim(readFileOr(enabledStatusFile, "0")) == "1"
}

func trim(s string) string {
	return strings.Trim(s, "\r\n\t ")
}

func readFileOr(filename string, deflt string) string {
	data, err := ioutil.ReadFile(filename)
	if err != nil {
		return deflt
	}
	return string(data)
}

func writeFile(filename string, data string) error {
	return ioutil.WriteFile(filename, []byte(data), 0755)
}

func appendFile(filename string, data string) error {
	fp, err := os.OpenFile(filename, os.O_APPEND|os.O_WRONLY, 0755)
	if err != nil {
		return err
	}
	defer fp.Close()

	_, err = fp.WriteString(data)
	if err != nil {
		return err
	}
	return nil
}

func makeDescriptor(name, syscall string) string {
	d := fmt.Sprintf("p:kprobes/%s %s", name, syscall)
	// command line args will be in %si, we're asking ftrace for them
	for argn := 0; argn < maxArguments; argn++ {
		d += fmt.Sprintf(" arg%d=+0(+%d(%%si)):string", argn, argn*8)
	}
	return d
}

func mapSubevents(subEvents []string) map[string]string {
	m := make(map[string]string)
	if subEvents != nil {
		for _, eventName := range subEvents {
			eventPath := eventName
			// includes a path, like 'sched/sched_process_fork'
			if strings.ContainsRune(eventName, '/') == true {
				parts := strings.SplitN(eventName, "/", 2)
				eventName = parts[1]
			}
			m[eventName] = fmt.Sprintf(eventFileFormat, eventPath)
		}
	}
	return m
}