我用cilium-ebpf写了一些简单的监控程序。现在我想使用tracepoint/syscalls/sys_enter_execve来获取argv。但我不喜欢缺少参数
下面是可以复制的代码示例：
task.c

//go:build ignore

#include "common.h"
#include "bpf_helpers.h"

char _license[] SEC("license") = "GPL";

struct execve {
    __u64 unused;
    __u32 nr;
    const char *filename;
    const char *const *argv;
    const char *const *envp;
};

SEC("tracepoint/syscalls/sys_enter_execve")
int sys_enter_execve(struct execve *ctx) {
    for (int i = 0; i < 10; i++) {
        const char *arg = NULL;
        bpf_probe_read_user(&arg, sizeof(arg), &ctx->argv[i]);
        bpf_printk("arg%d: %s ", i, arg);
    }
    bpf_printk("\n");
    return 0;
}

字符串
main.go

package main

import (
    "github.com/cilium/ebpf/link"
    "github.com/cilium/ebpf/rlimit"
    "log"
    "time"
)

//go:generate go run github.com/cilium/ebpf/cmd/bpf2go bpf task.c -- -I../
func main() {

    // Allow the current process to lock memory for eBPF resources.
    if err := rlimit.RemoveMemlock(); err != nil {
        log.Fatal(err)
    }

    objs := bpfObjects{}
    if err := loadBpfObjects(&objs, nil); err != nil {
        log.Fatalf("loading objects: %v", err)
    }
    defer objs.Close()

    tpExecve, err := link.Tracepoint("syscalls", "sys_enter_execve", objs.SysEnterExecve, nil)
    if err != nil {
        log.Fatal(err)
    }
    defer tpExecve.Close()

    // Wait for signals.
    log.Printf("waiting for signals")

    // Read loop reporting the total amount of times the kernel
    // function was entered, once per second.
    ticker := time.NewTicker(2 * time.Second)
    defer ticker.Stop()

    for range ticker.C {
        log.Printf("tick \n")
    }
}

型
你可以看到在task.c中我尝试使用tracepoint/syscalls/sys_enter_execve来获取argv并将它们打印出来。
启动并运行此ebpf程序后，我将在另一台服务器上使用ssh远程执行脚本。要在另一台服务器上执行的命令如下所示：

// hc is the server that run the ebpf program
ssh hc "see_app=be2e4d3d-2dad-4e48-a867-3006433f7e59;sh ./test.sh"

型
理想情况下，bpf_trace_printk的输出应该如下所示：

sh-2127037 [001] d..31 763364.233432: bpf_trace_printk: arg0: bash
sh-2127037 [001] d..31 763364.233441: bpf_trace_printk: arg1: -c
sh-2127037 [001] d..31 763364.233448: bpf_trace_printk: arg2: see_app=be2e4d3d-2dad-4e48-a867-3006433f7e59;sh ./test.sh
sh-2127037 [001] d..31 763364.233460: bpf_trace_printk: arg3:
sh-2127037 [001] d..31 763364.233465: bpf_trace_printk: arg4:
sh-2127037 [001] d..31 763364.233469: bpf_trace_printk: arg5:
sh-2127037 [001] d..31 763364.233473: bpf_trace_printk: arg6:
sh-2127037 [001] d..31 763364.233477: bpf_trace_printk: arg7:
sh-2127037 [001] d..31 763364.233486: bpf_trace_printk: arg8:
sh-2127037 [001] d..31 763364.233495: bpf_trace_printk: arg9:
sh-2127037 [001] d..31 763364.233497: bpf_trace_printk:

型
但是在某些时候，-c参数丢失：

sh-2128777 [001] d..31 763441.999571: bpf_trace_printk: arg0: bash
sh-2128777 [001] d..31 763441.999582: bpf_trace_printk: arg1:
sh-2128777 [001] d..31 763441.999589: bpf_trace_printk: arg2: see_app=be2e4d3d-2dad-4e48-a867-3006433f7e59;sh ./test.sh
sh-2128777 [001] d..31 763441.999597: bpf_trace_printk: arg3:
sh-2128777 [001] d..31 763441.999600: bpf_trace_printk: arg4:
sh-2128777 [001] d..31 763441.999604: bpf_trace_printk: arg5:
sh-2128777 [001] d..31 763441.999607: bpf_trace_printk: arg6:
sh-2128777 [001] d..31 763441.999611: bpf_trace_printk: arg7:
sh-2128777 [001] d..31 763441.999618: bpf_trace_printk: arg8:
sh-2128777 [001] d..31 763441.999625: bpf_trace_printk: arg9:
sh-2128777 [001] d..31 763441.999626: bpf_trace_printk:

型
有没有人遇到过这个问题并解决了呢？
我还尝试使用kprobe/sys_execve，但仍然存在缺少参数的问题