A file operation tracking method, device and equipment based on eBPF

Abstract

The present invention relates to the technical field of operating system kernel monitoring, and discloses a file operation tracking method, device and equipment based on eBPF. The method includes: responding to a real-time tracking request, traversing all processes, historical file descriptors opened by the processes and historical working directories corresponding to the processes, and determining the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process; obtaining the relative path of the file opened in real time by the current process; determining the absolute path of the file opened in real time according to the historical file descriptors of the current process and the relative path of the file opened in real time, or according to the historical working directory of the current process and the relative path of the file opened in real time. The present invention avoids the performance loss caused by frequent data exchange between user space and kernel space, has minimal impact on business performance, has strong real-time performance, improves tracking efficiency and accuracy, collects system call parameters to track process file operations, and has more flexible monitoring functions.

Description

Technical Field

[0001] The present invention relates to the technical field of operating system kernel monitoring, and in particular to an eBPF-based file operation tracking method, device, and equipment. Background Art

[0002] With the advancement of information technology, operating systems are becoming increasingly complex in handling file operations. Real-time tracking of system file operations has become a significant technical challenge for security monitoring, system debugging, and performance analysis. Traditional file operation monitoring tools (such as inotify and auditd) require frequent context switching between user and kernel modes, resulting in high system overhead and limited monitoring flexibility. Summary of the Invention

[0003] In view of this, the present invention provides a file operation tracking method, device and equipment based on eBPF to solve the problems of high system overhead and inflexible monitoring functions of traditional file operation monitoring tools.

[0004] In a first aspect, the present invention provides a file operation tracking method based on eBPF, the method comprising:

[0005] In response to a real-time tracking request, traverse all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process;

[0006] Get the relative path of the file opened in real time by the current process;

[0007] The absolute path of the real-time open file is determined according to the history file descriptor of the current process and the relative path of the real-time open file, or according to the history working directory of the current process and the relative path of the real-time open file.

[0008] The eBPF-based file operation tracking method provided by the present invention utilizes the eBPF program in the kernel to achieve real-time tracking of file operations, avoiding the performance loss caused by frequent data exchange between user space and kernel space, and having minimal impact on business performance. The eBPF tracking program is executed in the kernel, which has strong real-time performance and improves tracking efficiency and accuracy. By collecting system call parameters, any and all process file operations can be tracked, and the monitoring function is more flexible.

[0009] In an optional implementation, traversing all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes includes:

[0010] Traverse all processes according to the process control character, and collect the historical file descriptors and corresponding historical working directories opened by all processes;

[0011] Each process identifier and the corresponding historical working directory are stored as the first historical information in the first hash map, and each process control symbol, the corresponding opened historical file descriptor and the corresponding historical opened file path are stored as the second historical information in the second hash map.

[0012] The eBPF-based file operation tracking provided by the present invention stores different historical information through two hash map structures, and can quickly locate the target path according to the process control symbol or file descriptor, thereby improving the tracking and search efficiency. At the same time, it can avoid the performance degradation caused by the large amount of data, thereby ensuring the system performance of file operation tracking.

[0013] In an optional embodiment, determining the absolute path of the file opened in real time based on the historical file descriptor of the current process and the relative path of the file opened in real time, or based on the historical working directory of the current process and the relative path of the file opened in real time, includes:

[0014] If the current process is a first system call function, the first history information and the relative path of the file opened in real time are stored as first path information parameters in the event hash map, where the first system call function is used to indicate that the file is opened under an absolute path or a relative path based on the current working directory of the current process;

[0015] If the current process is a second system call function, the second history information and the relative path of the file opened in real time are stored as second path information parameters in the event hash map, where the second system call function is used to indicate that the file is opened under a relative path or an absolute path based on the file descriptor of the current process;

[0016] The absolute path of the file to be opened in real time is determined according to the first path storage information or the second path storage information in the event hash map.

[0017] The eBPF-based file operation tracking method provided by the present invention uses a separate event hash map to store information during the monitoring process, determines the file tracking strategy according to the system call function type of the current process, can handle operations on files by multiple system call functions, and the file tracking method is more flexible.

[0018] In an optional embodiment, the method further includes:

[0019] If the type of the current process is to read and write files, the first system call function or the second system call function is used to perform a read and write system call;

[0020] When the current process enters the read-write system call, the path information parameters of the file opened by the current process are collected according to the process control symbol of the current process;

[0021] When the current process exits the read / write system call, the return value and corresponding path information parameters are collected according to the process control symbol of the current process and sent to the user layer.

[0022] In an optional implementation, when the return value is a positive number, it indicates that the file under the current process can be opened, and the return value is stored in the second hash map.

[0023] The eBPF-based file operation tracking method provided by the present invention monitors the two tracking points of system call entry and exit, collects parameters into event_hashmap, and obtains the return value. It determines whether the file can be opened based on the return value, and implements real-time tracking of file operations based on the collected parameters. The entire process is returned to the user layer after completion at the kernel layer, reducing the interaction between the kernel layer and the user layer, saving resources, and improving system performance and tracking efficiency.

[0024] In an optional embodiment, if the type of the current process is to change the root directory of an open file, a path change system call is performed using a third system call function or a fourth system call function, the third system call function is used to pass a new specified working directory to change the working directory of the current process, and the fourth system call function is used to pass a file descriptor to change the working directory of the current process;

[0025] When the current process enters the path change system call, the new specified working directory parameters of the current process are collected according to the process control symbol of the current process;

[0026] When the current process exits the path change system call, the return value is collected and whether the path change system call is successful is determined based on the return value;

[0027] If the call is successful, the first hash map is updated.

[0028] The eBPF-based file operation tracking method provided by the present invention can change the first hash map through the third system call function or the fourth system call function to change the program working directory, allowing the program to dynamically select the working directory according to the runtime conditions, thereby improving the flexibility of the system call.

[0029] In a second aspect, the present invention provides a file operation tracking device based on eBPF, the device comprising:

[0030] A historical operation traversal module is used to traverse all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes in response to real-time tracking requests, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process;

[0031] Relative path acquisition module, used to obtain the relative path of the file opened in real time by the current process;

[0032] The real-time tracking module is used to determine the absolute path of the real-time opened file based on the historical file descriptor of the current process and the relative path of the real-time opened file, or based on the historical working directory of the current process and the relative path of the real-time opened file.

[0033] In a third aspect, the present invention provides a computer device comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0034] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the method of the first aspect or any corresponding embodiment thereof.

[0035] In a fifth aspect, the present invention provides a computer program product comprising computer instructions for causing a computer to execute the method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] In order to more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the specific embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0037] Figure 1 2 is a flow chart of a method for tracing file operations based on eBPF according to an embodiment of the present invention;

[0038] Figure 2 is a flowchart of another eBPF-based file operation tracing method according to an embodiment of the present invention;

[0039] Figure 3 is a structural block diagram of a file operation tracking device based on eBPF according to an embodiment of the present invention;

[0040] Figure 4Schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0041] To make the purpose, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts shall fall within the scope of protection of the present invention.

[0042] Traditional file operation tracking methods, such as auditd and inotify, require frequent context switches between user and kernel modes, resulting in high system overhead. To address this issue, embodiments of the present invention provide an eBPF-based file operation tracking method. By directly executing user-defined eBPF programs in kernel mode, this method reduces the number of context switches, lowering CPU load and memory usage, thereby achieving efficient real-time monitoring of file operations.

[0043] A system call is an interface between an application and the operating system kernel. It allows user-space applications to request the kernel to perform certain privileged operations or services, such as file reading and writing, memory allocation, process control, and network communication. The operating system manages hardware resources (such as the CPU, memory, and storage devices) in a secure and abstract manner, preventing applications from directly accessing these resources. Therefore, if an application needs to interact with hardware, it must request the kernel to do so through a system call. Ordinary applications in the application layer must also use system calls to access any hardware, such as the screen display or opening a file.

[0044] According to an embodiment of the present invention, an embodiment of a file operation tracing method based on eBPF is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0045] In this embodiment, a file operation tracking method based on eBPF is provided, which can be used in the above-mentioned computer system. Figure 1 : is a flowchart of a file operation tracking method based on eBPF according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0046] Step S101 , in response to a real-time tracking request, traverse all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process.

[0047] Specifically, in response to real-time tracing requests from the user layer, some processes may have already been started before the eBPF tracing program is launched. Before real-time tracing of the operating file is performed, it is necessary to traverse all processes, the historical file descriptors opened by the processes, and the historical working directories corresponding to the processes, and store the traversed information according to the process identifier. When a process is created, the operating system automatically assigns a unique, non-duplicate process identifier (PID) to the process. When the process terminates, the corresponding PID is released and can be reused. Therefore, when traversing all processes, the PID can be used to distinguish different processes, and the historical file descriptors and historical working directories of the current process can be determined from the traversal results based on the PID of the current process. The kernel uses file descriptors (fd) to access files. When opening an existing file or creating a new file, the kernel returns a file descriptor. Reading and writing files also requires using file descriptors to specify the file to be read or written. The historical working directory of the current process refers to the historical working directory of the files operated by the current process in the historical working process. For example, the historical working directory of a process may include: / root, / root / q, / users, which is only used as an example but not limited to this.

[0048] Step S102, obtaining the relative path of the file opened in real time by the current process.

[0049] Specifically, the relative path of the file opened in real time by the current process is obtained. For example, the relative path of the file opened in real time by the current process is " / a", which refers to the relative path of the file relative to the current working directory of the current process. If the current working directory of the current process is " / root", then the absolute path of the file opened in real time by the current process is " / root / a". If the current working directory of the current process is " / root / q", then the absolute path of the file opened in real time by the current process is " / root / q / a". This is just an example, but not limited to this.

[0050] Step S103, determining the absolute path of the file opened in real time according to the historical file descriptor of the current process and the relative path of the file opened in real time, or according to the historical working directory of the current process and the relative path of the file opened in real time.

[0051] Specifically, the current process operates on files in various ways. For opening files, the system call functions open or openat may be used. The open system call can only resolve absolute paths or paths relative to the current working directory. The open system call is the earliest interface for opening files. It accepts a path name and flags (and an optional permission mode) and returns a file descriptor (which can be used for subsequent read and write operations). openat adds a parameter (file descriptor fd) to open, allowing it to resolve paths relative to any file descriptor, providing greater flexibility and being particularly useful when dealing with symbolic links and multi-threaded programs.

[0052] For example, if the current working directory of a program process is " / root", to open the " / root / a" file in the process, you can use the following methods:

[0053] (1) open(" / root / a"): At this time, you can directly get the full path of the file you want to open.

[0054] (2) open("a"), this time it opens the "a" file in the current directory "root" in a relative path manner. At this time, the current working directory of the current program must be known in advance.

[0055] (3) First use open(" / root") to open the "root" folder, and get the file descriptor fd = open(" / root") of the root folder, where fd is a non-negative integer. Then use openat(fd,"a"), that is, use the relative directory in the root folder to find the " / root / a" file.

[0056] Regardless of whether you use open / openat to open the file, after obtaining a number for the file descriptor fd, the rest of the operations such as reading and writing files can be performed using the fd number.

[0057] If the system call function of the current process is openat, the absolute path of the file opened in real time can be determined based on the historical file descriptor of the current process and the relative path of the file opened in real time; if the current system call function is open, the absolute path of the file opened in real time can be determined based on the historical working directory of the current process and the relative path of the file opened in real time, so as to realize automatic tracking of file operations.

[0058] The eBPF-based file operation tracking method provided in this embodiment uses the eBPF program in the kernel to achieve real-time tracking of file operations, avoiding the performance loss caused by frequent data exchange between user space and kernel space, and having minimal impact on business performance. The eBPF tracking program is executed in the kernel, which has strong real-time performance and improves tracking efficiency and accuracy. By collecting system call parameters, any and all process file operations can be tracked, and the monitoring function is more flexible.

[0059] In this embodiment, a file operation tracking method based on eBPF is provided, which can be used in the above-mentioned computer system. Figure 2 : is a flowchart of a file operation tracking method based on eBPF according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0060] Step S201 , in response to a real-time tracking request, traverse all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process.

[0061] Specifically, the above step S201 includes:

[0062] Step S2011, traverse all processes according to the process control symbol, and collect the historical file descriptors and corresponding historical working directories opened by all processes.

[0063] Step S2012, each process identifier and the corresponding historical working directory are stored as the first historical information in the first hash map, and each process control symbol, the corresponding opened historical file descriptor and the corresponding historical opened file path are stored as the second historical information in the second hash map.

[0064] Specifically, before launching the tracking program, it collects information about each launched process based on its process control symbol: all open folders and historical working directories. By accessing all open folders for each process, it can obtain multiple historical file descriptors for each process. Two hash maps, hash_map structures, are used to store this information. These hash_map structures can transfer information between user mode and the kernel mode of the tracking program. The hash_map structures contain key-value pairs for storing data: key and value.

[0065] The first hash map is recorded as cwd_hashmap, in which the information stored is the first historical information. Its key is the process control symbol pid, which is the task ID in Linux. Each thread or process has a unique ID, namely pid; the value is the historical working directory (Current Working Directory, cwd) corresponding to the process, which is obtained by reading the cwd file of all task IDs under / proc before startup. " / proc" represents the interface provided to the user layer in the Linux system for querying process information, in the form of a virtual file, not a real file.

[0066] The second hash map is denoted as fds_hashmap, and the information stored therein is the second historical information. Its key is a 64-bit integer, with the first 32 bits used to store the process control identifier (pid) of the current process, and the last 32 bits used to store the file descriptor (fd) of the file opened by the current process. Both pid and fd are 32-bit integers; the value is the full file path of the file descriptor (fd) opened by pid. For example, if the file descriptor of a file opened by pid is 1, and the file descriptor (fd) is "0", the open file path is " / dev / null". This is for example only and is not intended to be limiting.

[0067] The eBPF-based file operation tracking method provided in this embodiment stores different historical information through two hash map structures, and can quickly locate the target path according to the process control symbol or file descriptor, thereby improving the tracking and search efficiency. At the same time, it can avoid the performance degradation caused by the large amount of data, thereby ensuring the system performance of file operation tracking.

[0068] Step S202: Get the relative path of the file opened in real time by the current process. Figure 1 Step S102 of the illustrated embodiment will not be described in detail here.

[0069] Step S203, determining the absolute path of the file opened in real time according to the historical file descriptor of the current process and the relative path of the file opened in real time, or according to the historical working directory of the current process and the relative path of the file opened in real time.

[0070] Specifically, the above step S203 includes:

[0071] In step S2021, if the current process is the first system call function, the first historical information and the relative path of the file opened in real time are stored as the first path information parameter in the event hash map. The first system call function is used to represent opening a file under an absolute path or a relative path based on the current working directory of the current process.

[0072] In step S2022, if the current process is a second system call function, the second history information and the relative path of the file opened in real time are stored as second path information parameters in the event hash map. The second system call function is used to represent opening a file under a relative path or an absolute path based on the file descriptor of the current process.

[0073] Step S2023: Determine the absolute path of the file to be opened in real time according to the first path storage information or the second path storage information in the event hash map.

[0074] Specifically, in the process of monitoring file operations, a hash_map structure is used separately to store the information to be collected (such as the path opened by a process, the two parameters of the open function, etc.), which is recorded as the event hash map event_hashmap. The key of the event hash map is the process control symbol pid, and the value is the information collected when the system call enters. It can be the file path information opened by the system call. This is only an example, but not limited to this.

[0075] Since the system call has two functions: open and openat, when using event hash mapping to collect information, if the monitored process opens a file using the open function, the first historical information and the real-time opened file relative path are stored in the event hash mapping as the first path information parameter; if the monitored process opens a file using the openat function, the second historical information and the real-time opened file relative path are stored in the event hash mapping as the second path information parameter.

[0076] When the first path information parameter is stored in the event hash map, the root directory of the file opened by the current process is determined according to the file descriptor fd of openat, and then the absolute path of the file opened in real time is determined in combination with the real-time relative path of the file; when the second path information parameter is stored in the event hash map, the absolute path of the file opened in real time is determined according to the historical working directory of the current process and the relative path of the file opened in real time.

[0077] The eBPF-based file operation tracking method provided in this embodiment uses a separate event hash map to store information during the monitoring process, determines the file tracking strategy according to the system call function type of the current process, and can handle operations on files by various system call functions. The file tracking method is more flexible.

[0078] In some optional embodiments, the method further comprises:

[0079] If the type of the current process is to read and write files, the first system call function or the second system call function is used to perform a read and write system call;

[0080] When the current process enters the read / write system call, the path information parameters of the file opened by the current process are collected according to the process control symbol of the current process.

[0081] When the current process exits the read / write system call, the return value and corresponding path information parameters are collected according to the process control symbol of the current process and sent to the user layer.

[0082] Specifically, eBPF traces any system call into two trace points: call entry and call exit. These two points require hooking and using additional methods to pass information. In Linux, tracepoints are a kernel debugging and performance analysis tool. Tracepoints are markers in kernel code, typically embedded in critical kernel code paths. When the kernel reaches these markers, corresponding handlers are triggered to record or analyze events. These markers are defined during kernel compilation, but can be enabled or disabled dynamically at runtime without restarting the system or recompiling the kernel.

[0083] Static tracepoints are manually inserted by kernel developers at key code locations, such as those for process scheduling, I / O operations, and memory management. Dynamic tracepoints can be added or removed by users without modifying the kernel code. Common tools such as kprobe and uprobe can dynamically add or remove tracepoints.

[0084] For file operations such as reading and writing, use the first system call function open or the second system call function openat to perform read and write system calls to track the read and write operations of the file. When entering the read and write system call, collect the parameters to event_hashmap, and when exiting the open / openat system call, collect the return value and send it to the user layer together with the event_hashmap.

[0085] In some optional implementations, when the return value is a positive number, it indicates that the file under the current process can be opened, and the return value is stored in the second hash map.

[0086] Specifically, file opening is monitored. For the open / openat system calls, parameters are collected into the event_hashmap upon system call entry, such as the file path to be opened and the mode used (read-only, read-write, etc.). When the file system open call exits, the return value is obtained. If the return value is positive, indicating that the file can be opened, it is recorded in the fds_hashmap structure. Regardless of success or failure, the return value fd, the information collected upon call entry, and the current working directory (cwd) obtained from the cwd_hashmap are sent to the user layer.

[0087] The eBPF-based file operation tracking method provided in this embodiment monitors the two tracking points of system call entry and exit, collects parameters into event_hashmap, and obtains the return value. It determines whether the file can be opened based on the return value, and implements real-time tracking of file operations based on the collected parameters. The entire process is returned to the user layer after completion at the kernel layer, reducing the interaction between the kernel layer and the user layer, saving resources, and improving system performance and tracking efficiency.

[0088] In some optional embodiments, if the type of the current process is to change the working directory, the third system call function or the fourth system call function is used to perform a path change system call. The third system call function is used to pass the new specified working directory to change the working directory of the current process, and the fourth system call function is used to pass the file descriptor to change the working directory of the current process.

[0089] When the current process enters the path change system call, the new specified working directory parameter of the current process is collected according to the process control symbol of the current process.

[0090] When the current process exits the change path system call, the return value is collected and whether the change path call is successful is determined based on the return value.

[0091] If the call is successful, the first hash map is updated.

[0092] Specifically, under normal circumstances, when a program starts, it inherits the working directory of the parent process. All file paths are resolved relative to the working directory of the parent process. If the working directory of the current process needs to be changed due to runtime requirements, the third system call function chdir or the fourth system call function fchdir can be used to change the working directory of the current process. The third system call function chdir is used to pass a new specified working directory to change the working directory of the current process, and the fourth system call function fchdir is used to pass a file descriptor to change the working directory of the current process.

[0093] The chdir / fchdir system call collects information when entering and determines whether the call is successful when exiting. If successful, it updates cwd_hashmap.

[0094] The eBPF-based file operation tracing method provided in this embodiment can change the first hash map through the third system call chdir function or the fourth system call fchdir function to change the program working directory of the current process, allowing the program to dynamically select the working directory according to runtime conditions, thereby improving the flexibility of system calls.

[0095] In a specific embodiment, the user layer processes the system call parameters and return values ​​as they are received by the user layer and displays them. When opening a file, there are several situations as follows:

[0096] Case 1: open(" / xxx") means directly opening the file starting with ' / ', that is, the absolute path. This path is the tracked file path and can be directly displayed at the user level.

[0097] Case 2: open("xxx"), the first character is not ' / ', indicating a relative path, and the real absolute path is obtained by combining it with cwd.

[0098] Case 3: openat(cwd,"xxx), like case 2 above, gets the real absolute path by combining it with cwd.

[0099] Case 4: openat(fd,"xxx"), get the folder of fd by reading fds_hashmap, and then combine it with the path to get the absolute path.

[0100] The user layer separately maintains the real absolute paths of all file descriptors opened by the process, which are used for display in subsequent read and write calls.

[0101] For other reading and writing operations, the real path of the file descriptor and fds_hashmap recorded above are used to obtain the path of fd, and then the specific operations are directly displayed.

[0102] In this embodiment, a file operation tracking device based on eBPF is also provided. The device is used to implement the above-mentioned embodiments and preferred implementation modes. The details that have been explained will not be repeated here. As used below, the term "module" can be a combination of software and / or hardware that implements a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, implementation in hardware, or a combination of software and hardware, is also possible and conceivable.

[0103] This embodiment provides a file operation tracking device based on eBPF, such as Figure 3 Shown, including:

[0104] The historical operation traversal module 301 is used to traverse all processes, historical file descriptors opened by processes and historical working directories corresponding to processes in response to real-time tracking requests, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process.

[0105] The relative path acquisition module 302 is used to obtain the relative path of the file opened in real time by the current process.

[0106] The real-time tracking module 303 is used to determine the absolute path of the real-time opened file based on the historical file descriptor of the current process and the relative path of the real-time opened file, or based on the historical working directory of the current process and the relative path of the real-time opened file.

[0107] In some optional implementations, the historical operation traversal module 301 includes:

[0108] The process traversal unit is used to traverse all processes according to the process control character and collect the historical file descriptors and corresponding historical working directories opened by all processes.

[0109] The historical information hash mapping unit is used to store each process identifier and the corresponding historical working directory as the first historical information in the first hash map, and to store each process control symbol, the corresponding opened historical file descriptor and the corresponding historical opened file path as the second historical information in the second hash map.

[0110] In some optional implementations, the real-time tracking module 303 includes:

[0111] The first event hash mapping unit is used to store the first historical information and the relative path of the file opened in real time as the first path information parameter in the event hash mapping if the current process is the first system call function, and the first system call function is used to represent opening a file under an absolute path or a relative path based on the current working directory of the current process.

[0112] The second event hash mapping unit is used to store the second historical information and the relative path of the file opened in real time as the second path information parameter in the event hash mapping if the current process is a second system call function, and the second system call function is used to represent the opening of a file under a relative path or an absolute path based on the file descriptor of the current process.

[0113] The file tracking unit is used to determine the absolute path of the real-time open file according to the first path storage information or the second path storage information in the event hash map.

[0114] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0115] The eBPF-based file operation tracking device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0116] The embodiment of the present invention also provides a computer device having the above Figure 3 The eBPF-based file operation tracking device shown.

[0117] See also Figure 4 , Figure 4 is a structural diagram of a computer device provided by an optional embodiment of the present invention, such as Figure 4 As shown, the computer device includes: one or more processors 10, memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components utilize different buses to communicate with each other and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in the memory or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Equally, multiple computer devices can be connected, and each device provides part of the necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 4 A processor 10 is taken as an example.

[0118] The processor 10 may be a central processing unit, a network processor, or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit, a programmable logic device, or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic, or any combination thereof.

[0119] The memory 20 stores instructions that can be executed by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0120] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and application programs required for at least one function; the data storage area may store data created based on the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely located relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0121] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0122] The computer device further includes a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0123] The embodiment of the present invention also provides a computer-readable storage medium. The above-mentioned method according to the embodiment of the present invention can be implemented in hardware, firmware, or implemented as a computer code that can be recorded in a storage medium, or implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and downloaded through a network and will be stored in a local storage medium, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state drive, etc.; further, the storage medium can also include a combination of the above-mentioned types of memory. It can be understood that a computer, a processor, a microprocessor controller or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor or hardware, the method shown in the above embodiment is implemented.

[0124] A portion of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the form in which the computer program instruction exists in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc. Accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium that can be accessed by the computer.

[0125] Although the embodiments of the present invention have been described with reference to the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention. Such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A file operation tracking method based on eBPF, characterized in that: The method comprises: In response to a real-time tracking request, traverse all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process; Get the relative path of the file opened in real time by the current process; Determine the absolute path of the file opened in real time according to the historical file descriptor of the current process and the relative path of the file opened in real time, or according to the historical working directory of the current process and the relative path of the file opened in real time; If the type of the current process is to read and write files, the first system call function or the second system call function is used to perform a read and write system call; When the current process enters the read-write system call, the path information parameters of the file opened by the current process are collected according to the process control symbol of the current process; When the current process exits the read / write system call, the return value and corresponding path information parameters are collected according to the process control symbol of the current process and sent to the user layer.

2. The method according to claim 1, characterized in that Traverse all processes, the historical file descriptors opened by the processes, and the historical working directories corresponding to the processes, including: Traverse all processes according to the process control character, and collect the historical file descriptors and corresponding historical working directories opened by all processes; Each process identifier and the corresponding historical working directory are stored as the first historical information in the first hash map, and each process control symbol, the corresponding opened historical file descriptor and the corresponding historical opened file path are stored as the second historical information in the second hash map.

3. The method according to claim 2, characterized in that Determining the absolute path of the file opened in real time according to the historical file descriptor of the current process and the relative path of the file opened in real time, or according to the historical working directory of the current process and the relative path of the file opened in real time, includes: If the current process is a first system call function, storing the first historical information and the relative path of the file opened in real time as a first path information parameter in the event hash map, wherein the first system call function is used to indicate that the file is opened under an absolute path or a relative path based on the current working directory of the current process; If the current process is a second system call function, storing the second history information and the relative path of the file opened in real time as a second path information parameter in the event hash map, wherein the second system call function is used to indicate that the file is opened under a relative path or an absolute path based on the file descriptor of the current process; The absolute path of the file to be opened in real time is determined according to the first path storage information or the second path storage information in the event hash map.

4. The method according to claim 1, wherein When the return value is a positive number, it indicates that the file under the current process can be opened, and the return value is stored in the second hash map.

5. The method according to claim 2, characterized in that If the type of the current process is to change the working directory, a third system call function or a fourth system call function is used to perform a path change system call, wherein the third system call function is used to pass a new specified working directory to change the working directory of the current process, and the fourth system call function is used to pass a file descriptor to change the working directory of the current process; When the current process enters the path change system call, the new specified working directory parameters of the current process are collected according to the process control symbol of the current process; When the current process exits the path change system call, the return value is collected and whether the path change system call is successful is determined based on the return value; If the call is successful, the first hash map is updated.

6. A file operation tracking device based on eBPF, characterized in that: The device comprises: A historical operation traversal module is used to traverse all processes, historical file descriptors opened by the processes, and historical working directories corresponding to the processes in response to real-time tracking requests, and determine the historical file descriptors and historical working directories of the current process according to the process control symbol of the current process; Relative path acquisition module, used to obtain the relative path of the file opened in real time by the current process; A real-time tracking module is used to determine the absolute path of the real-time opened file based on the historical file descriptor of the current process and the relative path of the real-time opened file, or based on the historical working directory of the current process and the relative path of the real-time opened file; If the type of the current process is to read and write files, the first system call function or the second system call function is used to perform a read and write system call; When the current process enters the read-write system call, the path information parameters of the file opened by the current process are collected according to the process control symbol of the current process; When the current process exits the read / write system call, the return value and corresponding path information parameters are collected according to the process control symbol of the current process and sent to the user layer.

7. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the method according to any one of claims 1 to 5 by executing the computer instructions.

8. A computer-readable storage medium, characterized in that The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 5.

9. A computer program product, characterized in that The method comprises computer instructions for causing a computer to execute the method according to any one of claims 1 to 5.

Images