Daemon part of FD tracking

amosproj · Jan 21, 2025 · 860ea40 · 860ea40
2 parents b9e522f + 5377ce6
commit 860ea40
Show file tree

Hide file tree

Showing 15 changed files with 379 additions and 14 deletions.
diff --git a/frontend/app/src/main/java/de/amosproj3/ziofa/ui/configuration/utils/Constants.kt b/frontend/app/src/main/java/de/amosproj3/ziofa/ui/configuration/utils/Constants.kt
@@ -1,9 +1,10 @@
 // SPDX-FileCopyrightText: 2024 Luca Bretting <[email protected]>
+// SPDX-FileCopyrightText: 2025 Robin Seidl <[email protected]>
 //
 // SPDX-License-Identifier: MIT
 
 package de.amosproj3.ziofa.ui.configuration.utils
 
 import de.amosproj3.ziofa.client.Configuration
 
-val EMPTY_CONFIGURATION = Configuration(null, null, listOf(), null, null, null)
+val EMPTY_CONFIGURATION = Configuration(null, null, listOf(), null, null, null, null)
diff --git a/frontend/client/src/main/java/de/amosproj3/ziofa/client/Client.kt b/frontend/client/src/main/java/de/amosproj3/ziofa/client/Client.kt
@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2024 Felix Hilgers <[email protected]>
-// SPDX-FileCopyrightText: 2024 Robin Seidl <[email protected]>
+// SPDX-FileCopyrightText: 2025 Robin Seidl <[email protected]>
 //
 // SPDX-License-Identifier: MIT
 
@@ -14,6 +14,7 @@ data class Configuration(
     val jniReferences: JniReferencesConfig?,
     val sysSigquit: SysSigquitConfig?,
     val gc: GcConfig?,
+    val sysFdTracking: SysFdTrackingConfig?,
 )
 
 data class VfsWriteConfig(val entries: Map<UInt, ULong>)
@@ -28,6 +29,8 @@ data class SysSigquitConfig(val pids: List<UInt>)
 
 data object GcConfig
 
+data class SysFdTrackingConfig(val pids: List<UInt>)
+
 sealed class Event {
     data class VfsWrite(
         val pid: UInt,
@@ -80,6 +83,18 @@ sealed class Event {
         var freedLosBytes: Long,
         var pauseTimes: List<ULong>,
     ) : Event()
+
+    data class SysFdTracking(
+        val pid: UInt,
+        val tid: UInt,
+        val timeStamp: ULong,
+        val fdAction: SysFdAction?,
+    ) : Event() {
+        enum class SysFdAction {
+            Created,
+            Destroyed,
+        }
+    }
 }
 
 data class Process(val pid: UInt, val ppid: UInt, val state: String, val cmd: Command?)

diff --git a/frontend/client/src/mock/java/de/amosproj3/ziofa/client/RustClient.kt b/frontend/client/src/mock/java/de/amosproj3/ziofa/client/RustClient.kt
@@ -1,6 +1,6 @@
 // SPDX-FileCopyrightText: 2024 Felix Hilgers <[email protected]>
 // SPDX-FileCopyrightText: 2024 Luca Bretting <[email protected]>
-// SPDX-FileCopyrightText: 2024 Robin Seidl <[email protected]>
+// SPDX-FileCopyrightText: 2025 Robin Seidl <[email protected]>
 //
 // SPDX-License-Identifier: MIT
 
@@ -23,6 +23,7 @@ object RustClient : Client {
             jniReferences = JniReferencesConfig(pids = listOf()),
             sysSigquit = SysSigquitConfig(pids = listOf()),
             gc = GcConfig,
+            sysFdTracking = SysFdTrackingConfig(pids = listOf()),
         )
 
     override suspend fun serverCount(): Flow<UInt> = flow {
@@ -143,6 +144,16 @@ object RustClient : Client {
                     )
                 )
             }
+            configuration.sysFdTracking?.pids?.forEach {
+                emit(
+                    Event.SysFdTracking(
+                        pid = it,
+                        tid = 1234u,
+                        timeStamp = 12312412u,
+                        fdAction = Event.SysFdTracking.SysFdAction.Created,
+                    )
+                )
+            }
         }
     }
 

diff --git a/frontend/client/src/real/java/de.amosproj3.ziofa.client/RustClient.kt b/frontend/client/src/real/java/de.amosproj3.ziofa.client/RustClient.kt
@@ -1,5 +1,5 @@
 // SPDX-FileCopyrightText: 2024 Felix Hilgers <[email protected]>
-// SPDX-FileCopyrightText: 2024 Robin Seidl <[email protected]>
+// SPDX-FileCopyrightText: 2025 Robin Seidl <[email protected]>
 //
 // SPDX-License-Identifier: MIT
 
@@ -12,9 +12,11 @@ import kotlinx.coroutines.flow.mapNotNull
 import kotlinx.coroutines.sync.Mutex
 import kotlinx.coroutines.sync.withLock
 import uniffi.client.jniMethodNameFromI32
+import uniffi.client.sysFdActionFromI32
 import uniffi.shared.Cmd
 import uniffi.shared.EventData
 import uniffi.shared.JniMethodName
+import uniffi.shared.SysFdAction
 
 private fun uniffi.shared.Process.into() =
     Process(
@@ -86,6 +88,18 @@ private fun uniffi.shared.Event.into() =
                 freedLosBytes = d.v1.freedLosBytes,
                 pauseTimes = d.v1.pauseTimes,
             )
+        is EventData.SysFdTracking ->
+            Event.SysFdTracking(
+                pid = d.v1.pid,
+                tid = d.v1.tid,
+                timeStamp = d.v1.timeStamp,
+                fdAction =
+                    when (sysFdActionFromI32(d.v1.fdAction)) {
+                        SysFdAction.CREATED -> Event.SysFdTracking.SysFdAction.Created
+                        SysFdAction.DESTROYED -> Event.SysFdTracking.SysFdAction.Destroyed
+                        SysFdAction.UNDEFINED -> null
+                    },
+            )
         null -> null
     }
 
@@ -105,6 +119,7 @@ private fun uniffi.shared.Configuration.into() =
         jniReferences = jniReferences?.let { JniReferencesConfig(pids = it.pids) },
         sysSigquit = sysSigquit?.let { SysSigquitConfig(pids = it.pids) },
         gc = gc?.let { GcConfig },
+        sysFdTracking = sysFdTracking?.let { SysFdTrackingConfig(pids = it.pids) },
     )
 
 private fun Configuration.into() =
@@ -123,6 +138,7 @@ private fun Configuration.into() =
         jniReferences = jniReferences?.let { uniffi.shared.JniReferencesConfig(it.pids) },
         sysSigquit = sysSigquit?.let { uniffi.shared.SysSigquitConfig(it.pids) },
         gc = gc?.let { uniffi.shared.GcConfig() },
+        sysFdTracking = sysFdTracking?.let { uniffi.shared.SysFdTrackingConfig(it.pids) },
     )
 
 private fun uniffi.shared.StringResponse.into() = StringResponse(name)

diff --git a/rust/backend/common/src/lib.rs b/rust/backend/common/src/lib.rs
@@ -4,7 +4,7 @@
 // SPDX-FileCopyrightText: 2024 Felix Hilgers <[email protected]>
 // SPDX-FileCopyrightText: 2024 Luca Bretting <[email protected]>
 // SPDX-FileCopyrightText: 2025 Tom Weisshuhn <[email protected]>
-// SPDX-FileCopyrightText: 2025 Felix Hilgers <felix.hilgers@fau.de>
+// SPDX-FileCopyrightText: 2025 Robin Seidl <robin.seidl@fau.de>
 //
 // SPDX-License-Identifier: MIT
 
@@ -46,6 +46,12 @@ impl TryFromRaw for SysGcCall {
     }
 }
 
+impl TryFromRaw for SysFdActionCall {
+    fn try_from_raw(raw: &[u8]) -> Result<Self, CheckedCastError> {
+        Ok(*bytemuck::checked::try_from_bytes(raw)?)
+    }
+}
+
 #[repr(C)]
 #[derive(Debug, Copy, Clone, AnyBitPattern)]
 pub struct VfsWriteCall {

diff --git a/rust/backend/daemon/src/collector/mod.rs b/rust/backend/daemon/src/collector/mod.rs
@@ -4,10 +4,11 @@
 //
 // SPDX-License-Identifier: MIT
 
-use backend_common::{JNICall, JNIMethodName, SysGcCall, SysSendmsgCall, SysSigquitCall, VfsWriteCall};
-use shared::ziofa::{Event, GcEvent, JniReferencesEvent, SysSendmsgEvent, SysSigquitEvent, VfsWriteEvent};
+use backend_common::{JNICall, JNIMethodName, SysFdActionCall, SysGcCall, SysSendmsgCall, SysSigquitCall, VfsWriteCall, SysFdAction};
+use shared::ziofa::{Event, GcEvent, JniReferencesEvent, SysFdTrackingEvent, SysSendmsgEvent, SysSigquitEvent, VfsWriteEvent};
 use shared::ziofa::event::EventData;
 use shared::ziofa::jni_references_event::JniMethodName;
+use shared::ziofa::sys_fd_tracking_event;
 mod ring_buf;
 mod supervisor;
 mod event_dipatcher;
@@ -97,4 +98,20 @@ impl IntoEvent for SysGcCall {
             }))
         }
     }
+}
+
+impl IntoEvent for SysFdActionCall {
+    fn into_event(self) -> Event {
+        Event {
+            event_data: Some(EventData::SysFdTracking(SysFdTrackingEvent {
+                pid: self.pid,
+                tid: self.tid,
+                time_stamp: self.time_stamp,
+                fd_action: (match self.fd_action {
+                    SysFdAction::Created => sys_fd_tracking_event::SysFdAction::Created,
+                    SysFdAction::Destroyed => sys_fd_tracking_event::SysFdAction::Destroyed,
+                }).into(),
+            }))
+        }
+    }
 }
diff --git a/rust/backend/daemon/src/collector/supervisor.rs b/rust/backend/daemon/src/collector/supervisor.rs
@@ -1,4 +1,5 @@
 // SPDX-FileCopyrightText: 2024 Felix Hilgers <[email protected]>
+// SPDX-FileCopyrightText: 2024 Robin Seidl <[email protected]>
 //
 // SPDX-License-Identifier: MIT
 
@@ -23,6 +24,7 @@ enum CollectorT {
     JniCall,
     SysSigquit,
     Gc,
+    SysFdTracking,
 }
 
 pub struct CollectorSupervisor;
@@ -50,7 +52,7 @@ impl CollectorRefs {
         self.collectors.remove(cell)
     }
     async fn start_all(&mut self, registry: &EbpfEventRegistry, event_actor: &ActorRef<Event>, supervisor: &ActorCell) -> Result<(), ActorProcessingErr> {
-        for who in [CollectorT::VfsWrite, CollectorT::SysSendmsg, CollectorT::JniCall, CollectorT::SysSigquit, CollectorT::Gc] {
+        for who in [CollectorT::VfsWrite, CollectorT::SysSendmsg, CollectorT::JniCall, CollectorT::SysSigquit, CollectorT::Gc, CollectorT::SysFdTracking] {
             self.start(who, registry, event_actor, supervisor).await?;
         }
         Ok(())
@@ -62,6 +64,7 @@ impl CollectorRefs {
             CollectorT::JniCall => start_collector(registry.jni_ref_calls.clone(), event_actor.clone(), supervisor.clone()).await?,
             CollectorT::SysSigquit => start_collector(registry.sys_sigquit_events.clone(), event_actor.clone(), supervisor.clone()).await?,
             CollectorT::Gc => start_collector(registry.gc_events.clone(), event_actor.clone(), supervisor.clone()).await?,
+            CollectorT::SysFdTracking => start_collector(registry.sys_fd_tracking_events.clone(), event_actor.clone(), supervisor.clone()).await?,
         };
         self.collectors.insert(actor_ref.get_cell(), who);
         Ok(())

diff --git a/rust/backend/daemon/src/features/mod.rs b/rust/backend/daemon/src/features/mod.rs
@@ -10,6 +10,7 @@ mod vfs_write_feature;
 mod sys_sendmsg_feature;
 mod sys_sigquit_feature;
 mod garbage_collection_feature;
+mod sys_fd_tracking_feature;
 
 use std::collections::BTreeSet;
 use aya::EbpfError;
@@ -20,6 +21,7 @@ use shared::config::Configuration;
 use sys_sendmsg_feature::SysSendmsgFeature;
 use sys_sigquit_feature::SysSigquitFeature;
 use vfs_write_feature::VfsWriteFeature;
+use sys_fd_tracking_feature::SysFdTrackingFeature;
 
 use crate::{registry::{EbpfRegistry, OwnedHashMap, RegistryGuard}, symbols::actors::SymbolActorMsg};
 
@@ -38,6 +40,7 @@ pub struct Features {
     vfs_write_feature: VfsWriteFeature,
     jni_reference_feature: JNIReferencesFeature,
     gc_feature: GcFeature,
+    sys_fd_tracking_feature: SysFdTrackingFeature,
 }
 
 impl Features {
@@ -48,13 +51,15 @@ impl Features {
         let jni_reference_feature = JNIReferencesFeature::init(registry, Some(symbol_actor_ref));
         let sys_sigquit_feature = SysSigquitFeature::init(registry, None);
         let gc_feature = GcFeature::init(registry, None);
+        let sys_fd_tracking_feature = SysFdTrackingFeature::init(registry, None);
 
         Self {
             sys_sendmsg_feature,
             vfs_write_feature,
             jni_reference_feature,
             sys_sigquit_feature,
             gc_feature,
+            sys_fd_tracking_feature,
         }
     }
 
@@ -68,6 +73,7 @@ impl Features {
         self.jni_reference_feature.apply( &config.jni_references).await?;
         self.sys_sigquit_feature.apply( &config.sys_sigquit).await?;
         self.gc_feature.apply( &config.gc).await?;
+        self.sys_fd_tracking_feature.apply( &config.sys_fd_tracking).await?;
 
         Ok(())
     }