anolasc13 at gmail.com
Fri Sep 23 17:44:34 UTC 2022
Great idea, I hadn't thought of it, I'll try it out.
On Sat, 24 Sep 2022 at 1:40 AM Dmitry V. Levin <ldv at altlinux.org> wrote:
> On Sat, Sep 24, 2022 at 01:31:55AM +0800, SuHsueyu wrote:
> > The tracee call BPF_MAP_LOOKUP_ELEM with map_fd, and tracer get the
> > Fds are process-scoped. For example, a bpf obj with id 4 would have fd 5
> > tracee process and fd 6 in tracer process. I found that it cannot do some
> > operation with the tracee map_fd like bpf_obj_pin, bpf_obj_get_info_by_fd
> > in tracer process.
> Of course the value of map_fd has its meaning only in the tracee, the
> tracer is most likely doesn't have this descriptor opened at all.
> However, the descriptor is exposed via tracee's /proc, so there is
> a chance it could be found and opened there by the tracer.
> > One of the possible way to solve is use bpf_obj_pin in tracee process.
> I don't think it's a viable option as we don't inject any code into the
> Strace-devel mailing list
> Strace-devel at lists.strace.io
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the Strace-devel