File operation tracking method, device and equipment based on eBPF

Abstract

The invention relates to the technical field of operating system kernel monitoring, and discloses an eBPF-based file operation tracking method, device and equipment, and the method comprises the steps: responding to a real-time tracking request, traversing all processes, historical file descriptors opened by the processes, and historical work directories corresponding to the processes, determining a historical file descriptor and a historical work directory of the current process according to the process control character of the current process; obtaining a file relative path opened in real time by the current process; and according to the historical file descriptor of the current process and the relative path of the file opened in real time, or according to the historical work directory of the current process and the relative path of the file opened in real time, determining an absolute path of the file opened in real time. According to the method, the performance loss caused by frequent data exchange between the user space and the kernel space is avoided, the influence on the service performance is extremely small, the real-time performance is high, the tracking efficiency and accuracy are improved, parameters called by the system are collected to track the process file operation, and the monitoring function is more flexible.

Description

Technical Field

[0001] The present invention relates to the technical field of operating system kernel monitoring, and in particular to a file operation tracking method, device and equipment based on eBPF. Background Art

[0002] With the development of information technology, operating systems have become increasingly complex in handling file operations. Real-time tracking of system file operations has become an important technical challenge for security monitoring, system debugging, and performance analysis. Traditional file operation monitoring tools (such as inotify and auditd) require frequent context switching between user mode and kernel mode, resulting in high system overhead and insufficient flexibility in monitoring functions. Summary of the invention

[0003] In view of this, the present invention provides a file operation tracking method, device and equipment based on eBPF to solve the problems of high system overhead and inflexible monitoring function of traditional file operation monitoring tools.

[0004] In a first aspect, the present invention provides a file operation tracking method based on eBPF, the method comprising:

[0005] In response to the real-time tracking request, traverse all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process;

[0006] Get the relative path of the file opened in real time by the current process;

[0007] The absolute path of the real-time open file is determined according to the historical file descriptor of the current process and the relative path of the real-time open file, or according to the historical working directory of the current process and the relative path of the real-time open file.

[0008] The eBPF-based file operation tracking method provided by the present invention utilizes the eBPF program in the kernel to achieve real-time tracking of file operations, thereby avoiding the performance loss caused by frequent data exchange between the user space and the kernel space, and having little impact on business performance. The eBPF tracking program is executed in the kernel, which has strong real-time performance and improves tracking efficiency and accuracy. By collecting system call parameters, any and all process file operations can be tracked, and the monitoring function is more flexible.

[0009] In an optional implementation, traversing all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes includes:

[0010] Traverse all processes according to the process control symbol, and collect the corresponding opened historical file descriptors and corresponding historical working directories of all processes;

[0011] Each process identifier and the corresponding historical working directory are stored in the first hash map as the first historical information, and each process control symbol, the corresponding opened historical file descriptor and the corresponding historical opened file path are stored in the second hash map as the second historical information.

[0012] The eBPF-based file operation tracking provided by the present invention stores different historical information through two hash mapping structures, can quickly locate the target path according to the process control symbol or file descriptor, improve the tracking and search efficiency, and at the same time avoid the performance degradation caused by the large amount of data, thereby ensuring the system performance of file operation tracking.

[0013] In an optional implementation, determining the absolute path of the real-time open file according to the historical file descriptor of the current process and the relative path of the file opened in real time, or according to the historical working directory of the current process and the relative path of the file opened in real time, includes:

[0014] If the current process is a first system call function, the first history information and the relative path of the file opened in real time are stored as a first path information parameter in the event hash map, and the first system call function is used to represent opening a file under an absolute path or a relative path based on a current working directory of the current process;

[0015] If the current process is a second system call function, the second history information and the relative path of the file opened in real time are stored in the event hash map as a second path information parameter, and the second system call function is used to represent opening a file under a relative path or an absolute path based on a file descriptor of the current process;

[0016] The absolute path of the real-time open file is determined according to the first path storage information or the second path storage information in the event hash map.

[0017] The eBPF-based file operation tracking method provided by the present invention utilizes a separate event hash map to store information in the monitoring process, determines the file tracking strategy according to the type of the current process system call function, can handle operations on files by various system call functions, and the file tracking method is more flexible.

[0018] In an optional embodiment, the method further includes:

[0019] If the type of the current process is to read and write files, the first system call function or the second system call function is used to perform a read and write system call;

[0020] When the current process enters the read-write system call, the path information parameters of the file opened by the current process are collected according to the process control symbol of the current process;

[0021] When the current process exits the read / write system call, the return value and the corresponding path information parameters are collected according to the process control symbol of the current process and sent to the user layer.

[0022] In an optional implementation, when the return value is a positive number, it indicates that the file under the current process can be opened, and the return value is stored in the second hash map.

[0023] The eBPF-based file operation tracking method provided by the present invention collects parameters into event_hashmap and obtains a return value by monitoring two tracking points of system call entry and exit, determines whether the file can be opened according to the return value, and implements real-time tracking of file operations according to the collected parameters. The whole process is returned to the user layer after completion at the kernel layer, thereby reducing the interaction between the kernel layer and the user layer, saving resources, and improving system performance and tracking efficiency.

[0024] In an optional implementation, if the type of the current process is to change the root directory of an open file, a path change system call is performed using a third system call function or a fourth system call function, the third system call function is used to pass a new specified working directory to change the working directory of the current process, and the fourth system call function is used to pass a file descriptor to change the working directory of the current process;

[0025] When the current process enters the path change system call, the new specified working directory parameters of the current process are collected according to the process control symbol of the current process;

[0026] When the current process exits the path change system call, the return value is collected and whether the path change system call is successful is determined according to the return value;

[0027] If the call is successful, the first hash map is updated.

[0028] The eBPF-based file operation tracking method provided by the present invention can change the first hash map through the third system call function or the fourth system call function to change the program working directory, allowing the program to dynamically select the working directory according to the runtime conditions, thereby improving the flexibility of the system call.

[0029] In a second aspect, the present invention provides a file operation tracking device based on eBPF, the device comprising:

[0030] A historical operation traversal module is used to respond to a real-time tracking request, traverse all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process;

[0031] Relative path acquisition module, used to obtain the relative path of the file opened in real time by the current process;

[0032] The real-time tracking module is used to determine the absolute path of the real-time opened file according to the historical file descriptor of the current process and the relative path of the real-time opened file, or according to the historical working directory of the current process and the relative path of the real-time opened file.

[0033] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0034] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to cause a computer to execute the method of the first aspect or any corresponding embodiment thereof.

[0035] In a fifth aspect, the present invention provides a computer program product, comprising computer instructions for causing a computer to execute the method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0037] Figure 1 is a flowchart of a method for tracing file operations based on eBPF according to an embodiment of the present invention;

[0038] Figure 2 is a flowchart of another eBPF-based file operation tracking method according to an embodiment of the present invention;

[0039] Figure 3 is a structural block diagram of a file operation tracking device based on eBPF according to an embodiment of the present invention;

[0040] Figure 4It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0042] Traditional file operation tracking methods, such as auditd and inotify, require frequent context switching between user mode and kernel mode, resulting in high system overhead. To solve the above problem, an embodiment of the present invention provides a file operation tracking method based on eBPF, which directly executes user-defined eBPF programs in kernel mode to reduce the number of context switches, reduce CPU load and memory usage, and achieve the effect of efficient real-time monitoring of file operations.

[0043] System call is the interface between the application and the operating system kernel, which allows the application in the user space to request the operating system kernel to perform certain privileged operations or services, such as file reading and writing, memory allocation, process control, network communication, etc. The operating system manages hardware resources (such as CPU, memory, storage devices, etc.) in a secure and abstract way, and the application cannot directly access these resources. Therefore, if the application needs to interact with the hardware, it must request the kernel through a system call to complete it. Ordinary applications at the application layer must use system calls to use any hardware, such as screen display and file opening.

[0044] According to an embodiment of the present invention, an embodiment of a file operation tracing method based on eBPF is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0045] In this embodiment, a file operation tracking method based on eBPF is provided, which can be used in the above-mentioned computer system. Figure 1 is a flowchart of a file operation tracking method based on eBPF according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0046] Step S101, in response to a real-time tracking request, traverse all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process.

[0047] Specifically, in response to the real-time tracing request of the user layer, before starting the eBPF tracing program, some processes may have been started. Before real-time tracing of the operation file, it is necessary to traverse all processes, the historical file descriptors opened by the process, and the historical working directory corresponding to the process, and store the traversed information according to the process control symbol. When a process is created, the operating system automatically assigns a unique, non-repetitive process control symbol (Process Identifier, pid) to the process. When the process terminates, the corresponding pid will be released and can be reused. Therefore, when traversing all processes, pid can be used to distinguish different processes, and the historical file descriptor and historical working directory of the current process can be determined from the traversal results according to the pid of the current process. The kernel uses file descriptors (filedescriptor, fd) to access files. When opening an existing file or creating a new file, the kernel will return a file descriptor. Reading and writing files also requires using file descriptors to specify the files to be read and written. The historical working directory of the current process refers to the historical working directory of the files operated by the current process in the historical working process. For example, the historical working directory of a process may include: / root, / root / q, / users, which is only used as an example but not limited to this.

[0048] Step S102, obtaining the relative path of the file opened in real time by the current process.

[0049] Specifically, the relative path of the file opened in real time by the current process is obtained. For example, the relative path of the file opened in real time by the current process is " / a", which refers to the relative path of the file relative to the current working directory of the current process. If the current working directory of the current process is " / root", then the absolute path of the file opened in real time by the current process is " / root / a"; if the current working directory of the current process is " / root / q", then the absolute path of the file opened in real time by the current process is " / root / q / a". This is only an example, but is not limited to this.

[0050] Step S103, determining the absolute path of the file opened in real time according to the historical file descriptor of the current process and the relative path of the file opened in real time, or according to the historical working directory of the current process and the relative path of the file opened in real time.

[0051] Specifically, the current process operates on files in various forms. To open a file, the system call function open or openat may be used. open can only resolve absolute paths or paths relative to the current working directory. The open system call is the earliest interface for opening files. It can accept a path name and flags (and optional permission mode), and then return a file descriptor (this file descriptor can be used for subsequent read and write operations); openat adds a parameter (file descriptor fd) to open, so it can resolve paths relative to any file descriptor, providing greater flexibility, especially useful when dealing with symbolic links and multi-threaded programs.

[0052] For example, if the current working directory of a program process is " / root", if you want to open the " / root / a" file in the process, you can use the following methods:

[0053] (1) open(" / root / a"): At this time, you can directly get the full path of the file you want to open.

[0054] (2) open("a"), this is to open the "a" file in the current directory "root" in relative path format. At this time, the current working directory of the current program must be known in advance.

[0055] (3) First, use open(" / root") to open the "root" folder and obtain the file descriptor of the root folder fd = open(" / root"), where fd is a non-negative integer. Then, use openat(fd,"a"), that is, use the relative directory in the root folder to find the " / root / a" file.

[0056] Regardless of whether you use open or openat to open the file, after obtaining a number for the file descriptor fd, the rest of the operations such as reading and writing files can be performed using the fd number.

[0057] If the system call function of the current process is openat, the absolute path of the file opened in real time can be determined based on the historical file descriptor of the current process and the relative path of the file opened in real time; if the current system call function is open, the absolute path of the file opened in real time can be determined based on the historical working directory of the current process and the relative path of the file opened in real time, so as to realize automatic tracking of file operations.

[0058] The eBPF-based file operation tracking method provided in this embodiment uses the eBPF program in the kernel to achieve real-time tracking of file operations, avoiding the performance loss caused by frequent data exchange between the user space and the kernel space, and having little impact on business performance. The eBPF tracking program is executed in the kernel with strong real-time performance, improving tracking efficiency and accuracy. By collecting system call parameters, any and all process file operations can be tracked, and the monitoring function is more flexible.

[0059] In this embodiment, a file operation tracking method based on eBPF is provided, which can be used in the above-mentioned computer system. Figure 2 is a flowchart of a file operation tracking method based on eBPF according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0060] Step S201, in response to a real-time tracking request, traverse all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process.

[0061] Specifically, the above step S201 includes:

[0062] Step S2011, traverse all processes according to the process control symbol, and collect the corresponding historical file descriptors and corresponding historical working directories opened by all processes.

[0063] Step S2012, each process identifier and the corresponding historical working directory are stored as the first historical information in the first hash map, and each process control symbol, the corresponding opened historical file descriptor and the corresponding historical opened file path are stored as the second historical information in the second hash map.

[0064] Specifically, before the tracking program is started, it is necessary to collect relevant information of each started process according to the process control symbol: all opened folders of each process, and the historical working directory of each process. Through all the opened folders of each process, multiple historical file descriptors of each process can be obtained. Two hash maps hash_map structures are used to store relevant information of each process. hash_map can transfer information between user state and kernel state of the tracking program. The hash_map structure includes key-value pairs for storing data: key and value.

[0065] The first hash map is recorded as cwd_hashmap, in which the information stored is the first historical information. Its key is the process control symbol pid, which is the task id in Linux. Each thread or process has a unique id, namely pid; the value is the historical working directory (Current Working Directory, cwd) corresponding to the process, which is obtained by reading the cwd file of all task ids under / proc before startup. " / proc" means the interface provided to the user layer in the Linux system for querying process information, in the form of a virtual file, not a real file.

[0066] The second hash map is recorded as fds_hashmap, in which the information stored is the second historical information. Its key is a 64-bit integer, the first 32 bits are used to store the process control symbol pid of the current process, and the last 32 bits are used to store the file descriptor fd of the file opened by the current process. Both pid and fd are 32-bit integers; value is the complete file path of the file descriptor fd opened by pid. For example, the file descriptor of a file opened by pid 1, the file descriptor fd is "0" indicating that the open file path is " / dev / null", which is only an example, but not limited to this.

[0067] The eBPF-based file operation tracking method provided in this embodiment stores different historical information through two hash mapping structures, and can quickly locate the target path according to the process control symbol or file descriptor, thereby improving the tracking and search efficiency. At the same time, it can avoid the performance degradation caused by the large amount of data, thereby ensuring the system performance of file operation tracking.

[0068] Step S202, obtain the relative path of the file opened in real time by the current process. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0069] Step S203, determining the absolute path of the file opened in real time according to the historical file descriptor of the current process and the relative path of the file opened in real time, or according to the historical working directory of the current process and the relative path of the file opened in real time.

[0070] Specifically, the above step S203 includes:

[0071] Step S2021, if the current process is the first system call function, the first historical information and the relative path of the file opened in real time are stored as the first path information parameter in the event hash map, and the first system call function is used to represent the opening of the file under an absolute path or a relative path based on the current working directory of the current process.

[0072] Step S2022, if the current process is the second system call function, the second history information and the relative path of the file opened in real time are stored as the second path information parameter in the event hash map, and the second system call function is used to represent the opening of the file under a relative path or an absolute path based on the file descriptor of the current process.

[0073] Step S2023: Determine the absolute path of the file to be opened in real time according to the first path storage information or the second path storage information in the event hash map.

[0074] Specifically, in the process of monitoring file operations, a hash_map structure is used separately to store the information to be collected (such as the path opened by a process, two parameters of the open function, etc.), which is recorded as the event hash map event_hashmap. The key of the event hash map is the process control symbol pid, and the value is the information collected when the system call enters, which can be the file path information opened by the system call. This is just an example, but not limited to this.

[0075] Since the system call has two functions: open and openat, when using event hash mapping to collect information, if the monitored process opens the file using the open function, the first historical information and the real-time opened file relative path are stored in the event hash mapping as the first path information parameter; if the monitored process opens the file using the openat function, the second historical information and the real-time opened file relative path are stored in the event hash mapping as the second path information parameter.

[0076] When the first path information parameter is stored in the event hash map, the root directory of the file opened by the current process is determined according to the file descriptor fd of openat, and then the absolute path of the file opened in real time is determined in combination with the real-time relative path of the file; when the second path information parameter is stored in the event hash map, the absolute path of the file opened in real time is determined according to the historical working directory of the current process and the relative path of the file opened in real time.

[0077] The eBPF-based file operation tracking method provided in this embodiment uses a separate event hash map to store information in the monitoring process, determines the file tracking strategy according to the system call function type of the current process, and can handle file operations on multiple system call functions. The file tracking method is more flexible.

[0078] In some optional embodiments, the method further comprises:

[0079] If the type of the current process is to read and write files, the first system call function or the second system call function is used to perform a read and write system call;

[0080] When the current process enters the read-write system call, the path information parameters of the file opened by the current process are collected according to the process control symbol of the current process.

[0081] When the current process exits the read / write system call, the return value and the corresponding path information parameters are collected according to the process control symbol of the current process and sent to the user layer.

[0082] Specifically, eBPF tracks any system call into two tracking points: call entry and call exit. They need to be hooked separately and use additional methods to pass information. In Linux systems, tracepoints are a kernel debugging and performance analysis tool. Tracepoints are markers in kernel code, usually embedded in the kernel's key code paths. When the kernel runs to these markers, the corresponding handlers can be triggered to record or analyze events. They are defined when the kernel is compiled, but they can be dynamically enabled or disabled at runtime without restarting the system or recompiling the kernel.

[0083] Static tracepoints are manually inserted by kernel developers at key code locations, such as process scheduling, I / O operations, memory management, etc. Dynamic tracepoints are dynamically added or deleted by users without modifying kernel code. Commonly used tools such as kprobe and uprobe can be used to dynamically add or delete tracepoints.

[0084] For the file operation process such as reading and writing, use the first system call function open or the second system call function openat to perform the read and write system call to realize the tracking of the read and write operations of the file, collect the parameters to event_hashmap when entering the read and write system call, and collect the return value when exiting the open / openat system call, and send it to the user layer together with the event_hashmap.

[0085] In some optional implementations, when the return value is a positive number, it indicates that the file under the current process can be opened, and the return value is stored in the second hash map.

[0086] Specifically, monitor open files. For open / openat system calls, collect parameters to event_hashmap when the system call enters, such as the path of the file to be opened, the mode of opening the file (read-only, read-write, etc.), etc. When the call to open the file system exits, obtain the return value. If the return value is a positive number, it means that the file can be opened, and record it in the fds_hashmap structure. At the same time, regardless of whether it is successful or not, send the return value fd and the information collected when entering the call and the current working directory (current word dir, cwd) obtained from cwd_hashmap to the user layer.

[0087] The eBPF-based file operation tracking method provided in this embodiment monitors the two tracking points of system call entry and exit, collects parameters into event_hashmap, and obtains the return value, determines whether the file can be opened according to the return value, and implements real-time tracking of file operations according to the collected parameters. The entire process is returned to the user layer after completion at the kernel layer, reducing the interaction between the kernel layer and the user layer, saving resources, and improving system performance and tracking efficiency.

[0088] In some optional embodiments, if the type of the current process is to change the working directory, the third system call function or the fourth system call function is used to perform a path change system call, the third system call function is used to pass a new specified working directory to change the working directory of the current process, and the fourth system call function is used to pass a file descriptor to change the working directory of the current process.

[0089] When the current process enters the path change system call, the new specified working directory parameter of the current process is collected according to the process control symbol of the current process.

[0090] When the current process exits the change path system call, the return value is collected and whether the change path call is successful is determined based on the return value.

[0091] If the call is successful, the first hash map is updated.

[0092] Specifically, usually, when a program is started, it inherits the working directory of the parent process, and all file paths are resolved relative to the working directory of the parent process. If the working directory of the current process needs to be changed due to operation requirements, the working directory of the current process can be changed by using the third system call function chdir or the fourth system call function fchdir. The third system call function chdir is used to pass a new specified working directory to change the working directory of the current process, and the fourth system call function fchdir is used to pass a file descriptor to change the working directory of the current process.

[0093] The chdir / fchdir system call collects information when entering and determines whether the call is successful when exiting. If successful, it updates cwd_hashmap.

[0094] The eBPF-based file operation tracking method provided in this embodiment can change the first hash map through the third system call chdir function or the fourth system call fchdir function to change the program working directory of the current process, allowing the program to dynamically select the working directory according to the runtime conditions, thereby improving the flexibility of the system call.

[0095] In a specific embodiment, the user layer processes: when the user layer receives the parameters and return values ​​of the system call, it can display them. When opening a file, there are multiple situations as follows:

[0096] Case 1: open(" / xxx"), which means directly opening the file starting with ' / ', that is, the absolute path. This path is the tracked file path and can be directly displayed at the user level.

[0097] Case 2: open("xxx"), the first character is not ' / ', indicating a relative path, and the real absolute path is obtained by combining it with cwd.

[0098] Case 3: openat(cwd,"xxx), same as case 2 above, gets the real absolute path by combining with cwd.

[0099] Case 4: openat(fd,"xxx"), get the folder of fd by reading fds_hashmap, and then combine it with the path to get the absolute path.

[0100] The user layer separately maintains the real absolute paths of all file descriptors opened by the process for display in subsequent read and write calls.

[0101] For other reading and writing operations, the real path of the file descriptor recorded above and fds_hashmap are used to obtain the path of fd, and then the specific operations are directly displayed.

[0102] In this embodiment, a file operation tracking device based on eBPF is also provided, which is used to implement the above embodiments and preferred implementation modes, and will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0103] This embodiment provides a file operation tracking device based on eBPF, such as Figure 3 As shown, including:

[0104] The historical operation traversal module 301 is used to respond to the real-time tracking request, traverse all processes, historical file descriptors opened by the process and historical working directories corresponding to the process, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process.

[0105] The relative path acquisition module 302 is used to acquire the relative path of the file opened in real time by the current process.

[0106] The real-time tracking module 303 is used to determine the absolute path of the real-time opened file according to the historical file descriptor of the current process and the relative path of the file opened in real time, or according to the historical working directory of the current process and the relative path of the file opened in real time.

[0107] In some optional implementations, the historical operation traversal module 301 includes:

[0108] The process traversal unit is used to traverse all processes according to the process control character, and collect the corresponding historical file descriptors and corresponding historical working directories opened by all processes.

[0109] The historical information hash mapping unit is used to store each process identifier and the corresponding historical working directory as the first historical information in the first hash map, and to store each process control symbol, the corresponding opened historical file descriptor and the corresponding historical opened file path as the second historical information in the second hash map.

[0110] In some optional implementations, the real-time tracking module 303 includes:

[0111] The first event hash mapping unit is used to store the first historical information and the relative path of the file opened in real time as the first path information parameter in the event hash mapping if the current process is the first system call function, and the first system call function is used to represent the opening of the file under an absolute path or a relative path based on the current working directory of the current process.

[0112] The second event hash mapping unit is used to store the second historical information and the relative path of the file opened in real time as the second path information parameter in the event hash mapping if the current process is a second system call function, and the second system call function is used to represent the opening of the file under a relative path or an absolute path based on the file descriptor of the current process.

[0113] The file tracking unit is used to determine the absolute path of the real-time open file according to the first path storage information or the second path storage information in the event hash map.

[0114] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0115] The eBPF-based file operation tracking device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0116] The embodiment of the present invention also provides a computer device having the above Figure 3 The eBPF-based file operation tracking device is shown.

[0117] See also Figure 4 , Figure 4 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 4 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 4 A processor 10 is taken as an example.

[0118] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0119] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0120] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0121] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0122] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0123] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0124] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0125] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A file operation tracking method based on eBPF, characterized in that: The method comprises: In response to the real-time tracking request, traverse all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process; Get the relative path of the file opened in real time by the current process; The absolute path of the file opened in real time is determined according to the historical file descriptor of the current process and the relative path of the file opened in real time, or according to the historical working directory of the current process and the relative path of the file opened in real time.

2. The method according to claim 1, characterized in that Traverse all processes, the historical file descriptors opened by the processes, and the historical working directories corresponding to the processes, including: Traverse all processes according to the process control symbol, and collect the corresponding opened historical file descriptors and corresponding historical working directories of all processes; Each process identifier and the corresponding historical working directory are stored in the first hash map as the first historical information, and each process control symbol, the corresponding opened historical file descriptor and the corresponding historical opened file path are stored in the second hash map as the second historical information.

3. The method according to claim 2, characterized in that Determining the absolute path of the real-time open file according to the historical file descriptor of the current process and the relative path of the file opened in real time, or according to the historical working directory of the current process and the relative path of the file opened in real time, including: If the current process is a first system call function, the first history information and the relative path of the file opened in real time are stored as a first path information parameter in the event hash map, wherein the first system call function is used to represent opening a file under an absolute path or a relative path based on a current working directory of the current process; If the current process is a second system call function, the second history information and the relative path of the file opened in real time are stored as second path information parameters in the event hash map, wherein the second system call function is used to represent opening a file under a relative path or an absolute path based on a file descriptor of the current process; The absolute path of the file to be opened in real time is determined according to the first path storage information or the second path storage information in the event hash map.

4. The method according to claim 1, characterized in that The method further comprises: If the type of the current process is to read and write files, the first system call function or the second system call function is used to perform a read and write system call; When the current process enters the read-write system call, the path information parameters of the file opened by the current process are collected according to the process control symbol of the current process; When the current process exits the read / write system call, the return value and the corresponding path information parameters are collected according to the process control symbol of the current process and sent to the user layer.

5. The method according to claim 4, characterized in that When the return value is a positive number, it indicates that the file under the current process can be opened, and the return value is stored in the second hash map.

6. The method according to claim 2, characterized in that If the type of the current process is to change the working directory, the third system call function or the fourth system call function is used to perform a path change system call, wherein the third system call function is used to transfer a new specified working directory to change the working directory of the current process, and the fourth system call function is used to transfer a file descriptor to change the working directory of the current process; When the current process enters the path change system call, the new specified working directory parameters of the current process are collected according to the process control symbol of the current process; When the current process exits the path change system call, the return value is collected and whether the path change system call is successful is determined according to the return value; If the call is successful, the first hash map is updated.

7. A file operation tracking device based on eBPF, characterized in that: The device comprises: A historical operation traversal module is used to respond to a real-time tracking request, traverse all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process; Relative path acquisition module, used to obtain the relative path of the file opened in real time by the current process; The real-time tracking module is used to determine the absolute path of the real-time opened file according to the historical file descriptor of the current process and the relative path of the file opened in real time, or according to the historical working directory of the current process and the relative path of the file opened in real time.

8. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 6 by executing the computer instructions.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 6.

10. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the method according to any one of claims 1 to 6.

Images