Clever Geek Handbook

Can eBPF change the return value or system call parameters?

In order to simulate some kind of behavior, I would like to bind the probe to syscall and change the return value when certain parameters are passed. Alternatively, it would also be sufficient to change the function parameters before they become processes.

Is this possible with BPF?

+3


source to share


2 answers


I suppose binding eBPF to kprobes / kretprobes gives you access to function arguments and return values, but you cannot tamper with them. I am NOT 100% sure; Good places to request confirmation would be the IO Visor project mailing list or IRC channel (#iovisor at irc.oftc.net).

As an alternative solution, I know that you can at least change the return value of syscall with strace with -e

. Quoting the man page :

-e inject=set[:error=errno|:retval=value][:signal=sig][:when=expr]
       Perform syscall tampering for the specified set of syscalls.


In addition, there was a presentation about this and the error injection in Fosdem 2017 if that interests you. Here's an example of a command from the slides:

strace -P precious.txt -efault=unlink:retval=0 unlink precious.txt

Edit: As Ben stated, the eBPF on kprobes and checkpoints is definitively readable only for tracking and monitoring use cases. I also got confirmation on this on IRC.

+2


source


Inside the kernel probes (kprobes), the eBPF virtual machine has read-only access to the syscall parameters and return value.

However, the eBPF program will have its own return code. You can use the seccomp profile, which intercepts BPF (NOT eBPF; thanks @qeole) return codes and aborts the system call at runtime.

Allowed runtime modifications:

  • SECCOMP_RET_KILL

    : Immediate destruction with SIGSYS

  • SECCOMP_RET_TRAP

    : SIGSYS

    post an exciting , emulating syscall
  • SECCOMP_RET_ERRNO

    : Force value errno

  • SECCOMP_RET_TRACE

    : output solution for ptracer or install errno

    in-ENOSYS

  • SECCOMP_RET_ALLOW

    : Allow

https://www.kernel.org/doc/Documentation/prctl/seccomp_filter.txt

The method SECCOMP_RET_TRACE

allows you to change the system call being executed, the arguments, or the return value. This is architecture dependent and changing required xrefs may result in an ENOSYS error.

It does this by passing execution to the pending user ptrace, which has the ability to modify the process's monitored memory, registers, and file descriptors.



The tracer needs to call ptrace and then waitpid. Example:

ptrace(PTRACE_SETOPTIONS, tracee_pid, 0, PTRACE_O_TRACESECCOMP);
waitpid(tracee_pid, &status, 0);

http://man7.org/linux/man-pages/man2/ptrace.2.html

When waitpid

returned, depending on the content status

, you can return the return value of seccomp using the PTRACE_GETEVENTMSG

ptrace operation . This will return the seccomp value SECCOMP_RET_DATA

, which is a 16-bit field specified by the BPF program. Example:

ptrace(PTRACE_GETEVENTMSG, tracee_pid, 0, &data);

Syscall parameters can be changed in memory before continuing. You can do a single write or log out with syscall in steps PTRACE_SYSCALL

. Syscall return values ​​can be changed in user space before resuming execution; the main program will not be able to see that the syscall return values ​​have changed.

Example implementation: Filter and modify system calls with seccomp and ptrace

+4


source






More articles:


All Articles