A Linux host command auditing method, system and device based on eBPF

Abstract

The present invention relates to the technical field of command line auditing, and provides a Linux host command auditing method, system and device based on eBPF, including: sending a control message to a user-state Agent deployed on a Linux host through a control module; when the control message contains an instruction to start command line auditing, the user-state Agent calls a kernel-state Agent by setting an eBPF uprobe plug-in in a bash binary program to write a command line operation log into a Perf Buffer, receiving the command line operation log from the Perf Buffer for data enrichment and sending it to an audit module for auditing; when the control message contains an instruction to close command line auditing, the user-state Agent clears the eBPF uprobe plug-in in the bash binary program and uninstalls the kernel-state Agent. The present invention can achieve low intrusion, high fidelity, low overhead, high adaptability and high security of command line auditing.

Description

Technical Field

[0001] The present invention relates to the technical field of command line auditing, and in particular to a Linux host command auditing method, system and device based on eBPF. Background Art

[0002] The core of Linux host command line audit is to obtain command line operations on Linux hosts, especially servers where sensitive services are located, and detect whether the command line operations are compliant. Among them, the core technology is how to obtain command line operations on Linux hosts, which are currently divided into two main technical solutions: invasive and non-invasive.

[0003] The invasive technical solution captures command line operations by directly modifying or replacing Linux system components (usually bash programs). The solution specifically includes: developers modify the source code of bash, add the command line operation recording function, and then recompile the source code to generate a new bash executable file. This new executable file will replace the existing bash program on the Linux host; overwrite the relevant functions in the bash program through binary editing technology or use custom hooks, thereby indirectly introducing the command line operation recording function. In practical applications, the main disadvantages of the invasive technical solution include: 1. High invasiveness, requiring modification or replacement of key system components, which may reduce system stability and security; 2. Complex maintenance. In response to different architectures and versions of Linux systems, modifications to the bash program need to be adapted accordingly, which increases the difficulty of maintenance; 3. High performance overhead. The added command line operation recording function may introduce additional performance burden 4. Unable to record the complete context information of command line operations.

[0004] The non-intrusive solution is designed to capture command line operations through external monitoring without modifying existing system components. Specific methods include: checking the user's ~ / .bash_history file regularly or in real time to record and review command line operations; by setting the PROMPT_COMMAND environment variable, each time the command prompt returns, execute a specific command or script to record command line operations. In actual applications, the main disadvantages of the non-intrusive solution include: 1. It is easy to be bypassed. Users can clear or modify the command line history, or bypass monitoring by clearing the PROMPT_COMMAND environment variable; 2. Lack of core data, unable to record the complete context information of command line operations, such as process number, execution user, login terminal, login IP address, etc., this information is crucial for a comprehensive security audit;

[0005] Therefore, how to make up for the shortcomings of traditional invasive and non-invasive command line auditing methods, and provide a Linux host command line auditing method that can reduce system intrusion, improve security as well as scalability and real-time performance, deeply capture command line operations on Linux hosts, especially sensitive business servers, and record their execution context to detect whether command line operations are compliant, and have minimal impact on system performance, has become a technical problem that needs to be solved urgently. Summary of the invention

[0006] In view of this, in order to overcome the deficiencies of the prior art, the present invention aims to provide a Linux host command auditing method, system and device based on eBPF.

[0007] According to a first aspect of the present invention, a Linux host command auditing method based on eBPF is provided, the method comprising:

[0008] Send control messages to the user-mode Agent deployed on the Linux host through the control module;

[0009] When the control message contains an instruction to enable command line auditing, the user-state agent sets the eBPF uprobe stub in the bash binary program to call the kernel-state agent to write the command line operation log into the Perf Buffer, receives the command line operation log from the Perf Buffer, enriches the data, and sends it to the audit module for auditing;

[0010] When the control message contains an instruction to turn off command line auditing, the user-mode agent clears the eBPF uprobe instrumentation in the bash binary and uninstalls the kernel-mode agent.

[0011] Preferably, in the Linux host command auditing method based on eBPF of the present invention, when the control message contains an instruction to enable command line auditing, the user state agent calls the kernel state agent to write the command line operation log into the Perf Buffer by setting the eBPF uprobe plug-in in the bash binary program, including:

[0012] When the received control message contains the command to enable command line auditing, the user-mode agent sets up the eBPF uprobe stub in the bash binary and loads the kernel-mode agent into the kernel;

[0013] When a user executes a command in the Linux system, the bash binary program executes the readline function to read the command line content entered by the user. Before the readline function returns the execution result, the kernel-state Agent is called according to the eBPF uprobe stub set in the bash binary program to obtain the command line operation log of the current bash binary program, and the obtained command line operation log is written to the Perf Buffer.

[0014] Preferably, in the Linux host command auditing method based on eBPF of the present invention, the user state agent sets the eBPF uprobe stub in the bash binary program, including: the user state agent calculates the offset of the readline function in the bash binary program, and sets the eBPF uprobe stub in the bash binary program according to the offset of the readline function in the bash binary program.

[0015] Preferably, in the Linux host command auditing method based on eBPF of the present invention, the command line operation log includes process PID, process name, process path, parent process PID, execution user, execution time and command line information.

[0016] Preferably, in the Linux host command audit method based on eBPF of the present invention, command line operation logs are received from Perf Buffer for data enrichment and sent to the audit module for auditing, including:

[0017] The user-state agent continuously receives command line operation logs from the Perf Buffer, enriches the command line operation logs, and sends the enriched command line operation logs to the audit module.

[0018] The audit module continuously receives the data-enriched command line operation log sent by the user-state Agent, matches the received data-enriched command line operation log with malicious rules, and when the received data-enriched command line operation log matches the malicious rules, sends the data-enriched command line operation log to the alarm module.

[0019] Preferably, in the Linux host command auditing method based on eBPF of the present invention, the command line operation log after data enrichment includes: process PID, process name, process path, parent process PID, execution user, execution time, command line information, process tree, login terminal and login IP address.

[0020] Preferably, in the Linux host command auditing method based on eBPF of the present invention, malicious rule matching includes regular rule matching and Flink model matching.

[0021] Preferably, in the Linux host command auditing method based on eBPF of the present invention, when the alarm module receives the command line operation log that has been enriched with data and matches the malicious rules sent by the audit module, the alarm module generates alarm information for the received command line operation log according to the alarm template, and sends the alarm information to the configured operation and maintenance user.

[0022] According to a second aspect of the present invention, there is provided a Linux host command audit system based on eBPF, the system comprising an audit server, the audit server being used for: sending a control message to a user-state Agent deployed on a Linux host through a control module; when the control message contains an instruction for enabling command line auditing, the user-state Agent calls a kernel-state Agent by setting an eBPF uprobe stub in a bash binary program to write a command line operation log into a Perf Buffer, receives the command line operation log from the Perf Buffer for data enrichment and sends it to the audit module for auditing; when the control message contains an instruction for disabling command line auditing, the user-state Agent clears the eBPF uprobe stub in the bash binary program and uninstalls the kernel-state Agent.

[0023] According to a third aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method described in the first aspect of the present invention when executing the program.

[0024] The eBPF-based Linux host command auditing method, system and device of the present invention have the following beneficial technical effects:

[0025] 1. Based on the eBPF technology, the execution of bash binary program commands is monitored at the kernel layer. The execution of the readline function in the bash binary is accurately intercepted and the monitoring code is implanted, which avoids the impact of traditional user space monitoring on system performance, improves monitoring efficiency and accuracy, and ensures the real-time monitoring.

[0026] 2. A two-layer agent design based on user-state agent and kernel-state agent. The user-state agent is used for configuration management and data enrichment, while the kernel-state agent is used to efficiently capture data, thus achieving flexibility and efficiency in monitoring.

[0027] 3. Through the user-state Agent, the captured command line data is enriched, such as adding process tree, login terminal and IP address information, which enriches the information content of the audit log and facilitates in-depth analysis and tracking;

[0028] 4. Based on the matching algorithm of regular expressions and Flink models, intelligent auditing of captured logs is realized to timely discover potential threats. Based on flexible alarm templates, relevant personnel are quickly alerted through various channels to realize intelligent auditing and alarm mechanisms.

[0029] 5. It has the characteristics of low intrusion, high fidelity, low overhead, high adaptability and high security. It can perform efficient auditing without changing any existing system components or Shell configurations. It can record command execution in real time and capture key execution context information. eBPF minimizes performance overhead when the kernel is running and reduces the impact on system performance. eBPF is tightly integrated with the Linux kernel version and is compatible with Linux systems of different architectures and versions. eBPF programs running with kernel permissions are invisible to users to avoid being bypassed or closed by ordinary users. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0031] Figure 1 An example diagram of a Linux host command audit system based on eBPF according to an embodiment of the present invention;

[0032] Figure 2 A schematic diagram of the technical principle of a Linux host command auditing method based on eBPF according to an embodiment of the present invention;

[0033] Figure 3 A schematic diagram of the structure of the device provided by the present invention. DETAILED DESCRIPTION

[0034] The embodiments of the present invention are described in detail below with reference to the accompanying drawings.

[0035] It should be noted that the following embodiments and features in the embodiments may be combined with each other in the absence of conflict; and, based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in the field without making any creative work are within the scope of protection of the present disclosure.

[0036] It should be noted that various aspects of the embodiments within the scope of the appended claims are described below. It should be apparent that the aspects described herein may be embodied in a wide variety of forms, and any specific structure and / or function described herein is merely illustrative. Based on the present disclosure, it should be understood by those skilled in the art that an aspect described herein may be implemented independently of any other aspect, and two or more of these aspects may be combined in various ways. For example, any number of aspects described herein may be used to implement the device and / or practice the method. In addition, other structures and / or functionalities other than one or more of the aspects described herein may be used to implement this device and / or practice this method.

[0037] Figure 1 FIG. 4 is an example diagram of a Linux host command audit system based on eBPF according to an embodiment of the present invention, as shown in FIG. Figure 1 As shown, the system may include an audit server 101, a communication network 102 and / or one or more audit clients 103. Figure 1 The example shown is multiple audit clients 103.

[0038] The eBPF in this embodiment is the abbreviation of extended Berkeley Packet Filter, which is a flexible and efficient virtual machine-like component in the Linux kernel, and can safely execute bytecodes at many kernel hook points.

[0039] The audit server 101 can be any suitable server for storing information, data, programs and / or any other suitable type of content. In some embodiments, the audit server 101 can perform appropriate functions. For example, in some embodiments, the audit server 101 can be used to audit Linux host commands based on eBPF. As an optional example, in some embodiments, the audit server 101 can be used to implement Linux host command auditing based on eBPF by deploying an Agent on the host. For example, the audit server 101 can be used to: send a control message to a user-state Agent deployed on a Linux host through a control module; when the control message contains an instruction to turn on command line auditing, the user-state Agent calls the kernel-state Agent by setting an eBPF uprobe plug-in in the bash binary program to write the command line operation log into the PerfBuffer, receive the command line operation log from the Perf Buffer for data enrichment and send it to the audit module for auditing; when the control message contains an instruction to turn off command line auditing, the user-state Agent clears the eBPFuprobe plug-in in the bash binary program and uninstalls the kernel-state Agent.

[0040] As another example, in some embodiments, the audit server 101 may send the eBPF-based Linux host command audit method to the audit client 103 for user use based on the request of the audit client 103 .

[0041] As an optional example, in some embodiments, the audit client 103 is used to provide a visual audit interface, which is used to receive a user's selection input operation for auditing Linux host commands based on eBPF, and, in response to the selection input operation, obtain an audit interface corresponding to the option selected by the selection input operation from the audit server 101 and display the audit interface, wherein the audit interface at least displays information on auditing Linux host commands based on eBPF and operation options for the information on auditing Linux host commands based on eBPF.

[0042] In some embodiments, the communication network 102 can be any suitable combination of one or more wired and / or wireless networks. For example, the communication network 102 can include any one or more of the following: the Internet, an intranet, a wide area network (WAN), a local area network (LAN), a wireless network, a digital subscriber line (DSL) network, a frame relay network, an asynchronous transfer mode (ATM) network, a virtual private network (VPN), and / or any other suitable communication network. The audit client 103 can be connected to the communication network 102 via one or more communication links (e.g., communication link 104), and the communication network 102 can be linked to the audit service end 101 via one or more communication links (e.g., communication link 105). The communication link can be any communication link suitable for transmitting data between the audit client 103 and the audit service end 101, such as a network link, a dial-up link, a wireless link, a hard-wired link, any other suitable communication link, or any suitable combination of such links.

[0043] The audit client 103 may include any one or more clients that present an interface related to the Linux host command audit based on eBPF in an appropriate form for use and operation by a user. In some embodiments, the audit client 103 may include any suitable type of device. For example, in some embodiments, the audit client 103 may include a mobile device, a tablet computer, a laptop computer, a desktop computer, and / or any other suitable type of client device.

[0044] Although the audit server 101 is illustrated as one device, in some embodiments, any suitable number of devices may be used to perform the functions performed by the audit server 101. For example, in some embodiments, multiple devices may be used to implement the functions performed by the audit server 101. Alternatively, the functions of the audit server 101 may be implemented using a cloud service.

[0045] Based on the above system, an embodiment of the present invention provides a Linux host command auditing method based on eBPF, which is described below through the following embodiments.

[0046] Figure 2 FIG. 1 is a schematic diagram of the technical principle of the Linux host command audit method based on eBPF according to an embodiment of the present invention; Figure 2 As shown, the Linux host command audit method based on eBPF of this embodiment can be executed on the audit server, and the Linux host command audit method based on eBPF includes:

[0047] In the method of this embodiment, a control message is sent to the user-mode Agent deployed on the Linux host through the control module.

[0048] When the control message contains an instruction to enable command line auditing, the user-state Agent calls the kernel-state Agent by setting the eBPF uprobe plug-in in the bash binary program to write the command line operation log into the Perf Buffer. In the method of this embodiment, the bash binary program is a command line environment Shell program in Unix and Linux systems that provides dialogue with users, which is used to receive commands entered by users, send the commands to the operating system for execution, and return the results to the user. Uprobe is a user space probe that allows dynamic plug-in in user space programs. The plug-in locations include: function entry, specific offset, and function return. When the user defines uprobe, the kernel will create a fast breakpoint instruction on the attached instruction. When the program executes the instruction, the kernel will trigger an event, the program will fall into the kernel state, and call the probe function as a callback function. After executing the probe function, it will return to the user state to continue executing the subsequent instructions. Perf Buffer is a high-performance mechanism for exchanging data between the kernel and user space. It is used to safely and efficiently transmit data collected by eBPF programs to user space. It is based on the Performance Events (Perf Events) subsystem in the Linux kernel and provides a way for eBPF programs to pass events or other data to processes running in user space.

[0049] As an optional example, in the method of this embodiment, when the received control message contains an instruction to enable command line auditing, the user-state Agent sets the eBPF uprobe plug-in in the bash binary program and loads the kernel-state Agent into the kernel; when the user executes a command in the Linux system, the bash binary program executes the readline function to read the command line content entered by the user, and before the readline function returns the execution result, the kernel-state Agent is called according to the eBPFuprobe plug-in set in the bash binary program to obtain the command line operation log of the current bash binary program, and the obtained command line operation log is written into the Perf Buffer, and the command line operation log includes process PID, process name, process path, parent process PID, execution user, execution time, and command line information. It should be noted that in the method of this embodiment, the user-state Agent calculates the offset of the readline function in the bash binary program, and sets the eBPF uprobe plug-in in the bash binary program according to the offset of the readline function in the bash binary program.

[0050] After the kernel-state Agent writes the command line operation log into the Perf Buffer, the user-state Agent receives the command line operation log from the Perf Buffer for data enrichment and sends it to the audit module for auditing.

[0051] As an optional example, the user-state Agent continuously receives the command line operation log from the Perf Buffer, enriches the command line operation log, and sends the enriched command line operation log to the audit module, wherein the enriched command line operation log includes: process PID, process name, process path, parent process PID, execution user, execution time, command line information, process tree, login terminal, and login IP address; the audit module continuously receives the enriched command line operation log sent by the user-state Agent, performs malicious rule matching on the received enriched command line operation log, and when the received enriched command line operation log matches the malicious rule, the enriched command line operation log is sent to the alarm module. The malicious rule matching of the method of this embodiment includes regular rule matching and Flink model matching. In actual applications, those skilled in the art can select other appropriate algorithms and models to perform malicious rule matching on the enriched command line operation log according to the actual application scenario, and this embodiment does not limit this.

[0052] When the alarm module receives the data-enriched command line operation log that matches the malicious rule sent by the audit module, the alarm module generates alarm information for the received command line operation log according to the alarm template and sends the alarm information to the configured operation and maintenance user.

[0053] When the control message contains an instruction to turn off command line auditing, the user-mode agent clears the eBPF uprobe instrumentation in the bash binary and uninstalls the kernel-mode agent.

[0054] The eBPF-based Linux host command auditing method and system according to the embodiments of the present invention have the following beneficial technical effects:

[0055] 1. Based on the eBPF technology, the execution of bash binary program commands is monitored at the kernel layer. The execution of the readline function in the bash binary is accurately intercepted and the monitoring code is implanted, which avoids the impact of traditional user space monitoring on system performance, improves monitoring efficiency and accuracy, and ensures the real-time monitoring.

[0056] 2. A two-layer agent design based on user-state agent and kernel-state agent. The user-state agent is used for configuration management and data enrichment, while the kernel-state agent is used to efficiently capture data, thus achieving flexibility and efficiency in monitoring.

[0057] 3. Through the user-state Agent, the captured command line data is enriched, such as adding process tree, login terminal and IP address information, which enriches the information content of the audit log and facilitates in-depth analysis and tracking;

[0058] 4. Based on the matching algorithm of regular expressions and Flink models, intelligent auditing of captured logs is realized to timely discover potential threats. Based on flexible alarm templates, relevant personnel are quickly alerted through various channels to realize intelligent auditing and alarm mechanisms.

[0059] 5. It has the characteristics of low intrusion, high fidelity, low overhead, high adaptability and high security. It can perform efficient auditing without changing any existing system components or Shell configurations. It can record command execution in real time and capture key execution context information. eBPF minimizes performance overhead when the kernel is running and reduces the impact on system performance. eBPF is tightly integrated with the Linux kernel version and is compatible with Linux systems of different architectures and versions. eBPF programs running with kernel permissions are invisible to users to avoid being bypassed or closed by ordinary users.

[0060] like Figure 3As shown, the present invention also provides a device, including a processor 310, a communication interface 320, a memory 330 for storing a processor executable computer program, and a communication bus 340. The processor 310, the communication interface 320, and the memory 330 communicate with each other through the communication bus 340. The processor 310 implements the above-mentioned Linux host command auditing method based on eBPF by running the executable computer program.

[0061] Among them, the computer program in the memory 330 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the various embodiments of the present application. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk and other media that can store program codes.

[0062] The system embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, i.e., they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected based on actual needs to achieve the purpose of the solution of this embodiment. Those of ordinary skill in the art may understand and implement it without creative effort.

[0063] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods of each embodiment or some parts of the embodiment.

[0064] The above is only a specific embodiment of the present invention, but the protection scope of the present invention is not limited thereto. Any changes or substitutions that can be easily thought of by a person skilled in the art within the technical scope disclosed by the present invention should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A Linux host command auditing method based on eBPF, characterized in that: The method comprises: Send control messages to the user-mode Agent deployed on the Linux host through the control module; When the control message contains an instruction to enable command line auditing, the user-mode agent sets the eBPF uprobe stub in the bash binary program to call the kernel-mode agent to write the command line operation log into the Perf Buffer, receives the command line operation log from the Perf Buffer for data enrichment, and sends it to the audit module for auditing; When the control message contains an instruction to turn off command line auditing, the user-mode agent clears the eBPFuprobe plug-in in the bash binary program and uninstalls the kernel-mode agent; When the control message contains an instruction to enable command line auditing, the user-mode agent calls the kernel-mode agent by setting the eBPF uprobe stub in the bash binary program to write the command line operation log to the Perf Buffer, including: When the control message received contains the command to enable command line auditing, the user-mode agent sets up the eBPF uprobe stub in the bash binary and loads the kernel-mode agent into the kernel. When a user executes a command in the Linux system, the bash binary program executes the readline function to read the command line content entered by the user. Before the readline function returns the execution result, the kernel-state Agent is called according to the eBPF uprobe stub set in the bash binary program to obtain the command line operation log of the current bash binary program, and the obtained command line operation log is written to the Perf Buffer.

2. The eBPF-based Linux host command auditing method according to claim 1, characterized in that: The user-state agent sets the eBPF uprobe stub in the bash binary program, including: the user-state agent calculates the offset of the readline function in the bash binary program, and sets the eBPF uprobe stub in the bash binary program according to the offset of the readline function in the bash binary program.

3. The Linux host command auditing method based on eBPF according to claim 1, characterized in that: The command line operation log includes process PID, process name, process path, parent process PID, execution user, execution time, and command line information.

4. The Linux host command auditing method based on eBPF according to claim 1, characterized in that: Receive command line operation logs from PerfBuffer for data enrichment and send to the audit module for auditing, including: The user-state agent continuously receives command line operation logs from the Perf Buffer, enriches the command line operation logs, and sends the enriched command line operation logs to the audit module. The audit module continuously receives the data-enriched command line operation log sent by the user-state Agent, matches the received data-enriched command line operation log with malicious rules, and sends the data-enriched command line operation log to the alarm module when the received data-enriched command line operation log matches the malicious rules.

5. The eBPF-based Linux host command auditing method according to claim 4, characterized in that: The enriched command line operation logs include: process PID, process name, process path, parent process PID, execution user, execution time, command line information, process tree, login terminal, and login IP address.

6. The Linux host command auditing method based on eBPF according to claim 4 is characterized in that: Malicious rule matching includes regular rule matching and Flink model matching.

7. The Linux host command auditing method based on eBPF according to claim 4 is characterized in that: When the alarm module receives the data-enriched command line operation log that matches the malicious rule sent by the audit module, the alarm module generates alarm information for the received command line operation log according to the alarm template and sends the alarm information to the configured operation and maintenance user.

8. A Linux host command audit system based on eBPF, characterized in that: The system includes an audit server, which is used to: send a control message to a user-state agent deployed on a Linux host through a control module; when the control message contains an instruction to turn on command line auditing, the user-state agent calls the kernel-state agent by setting the eBPF uprobe plug-in in the bash binary program to write the command line operation log into the Perf Buffer, receives the command line operation log from the Perf Buffer for data enrichment and sends it to the audit module for auditing; when the control message contains an instruction to turn off command line auditing, the user-state agent clears the eBPF uprobe plug-in in the bash binary program and uninstalls the kernel-state agent; wherein, when the control message contains an instruction to turn on command line auditing, the user-state agent calls the kernel-state agent by setting the eBPF uprobe plug-in in the bash binary program to write the command line operation log into the Perf Buffer, including: when the received control message contains an instruction to turn on command line auditing, the user-state agent sets the eBPF uprobe plug-in in the bash binary program and loads the kernel-state agent into the kernel; when the user is in Linux When executing commands in the system, the bash binary program executes the readline function to read the command line content entered by the user. Before the readline function returns the execution result, the kernel-state Agent is called according to the eBPF uprobe stub set in the bash binary program to obtain the command line operation log of the current bash binary program, and the obtained command line operation log is written to the Perf Buffer.

9. A computer device, characterized in that: The computer device comprises a memory, a processor and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the method according to any one of claims 1 to 7 when executing the program.

Images