Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package sysctl-logger for openSUSE:Factory checked in at 2024-03-06 23:06:18 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/sysctl-logger (Old) and /work/SRC/openSUSE:Factory/.sysctl-logger.new.1770 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "sysctl-logger" Wed Mar 6 23:06:18 2024 rev:3 rq:1155589 version:0.0.5 Changes: -------- --- /work/SRC/openSUSE:Factory/sysctl-logger/sysctl-logger.changes 2023-11-03 22:20:28.512778478 +0100 +++ /work/SRC/openSUSE:Factory/.sysctl-logger.new.1770/sysctl-logger.changes 2024-03-06 23:06:52.830426378 +0100 @@ -1,0 +2,8 @@ +Wed Mar 6 11:50:38 UTC 2024 - Shung-Hsi Yu <shung-hsi...@suse.com> + +- Update to v0.0.5 + * Show parent process info + * Improve readability with empty event values +- Use default LLVM/Clang version available (on openSUSE) + +------------------------------------------------------------------- Old: ---- sysctl-logger-0.0.4.tar.gz New: ---- sysctl-logger-0.0.5.tar.gz ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ sysctl-logger.spec ++++++ --- /var/tmp/diff_new_pack.NvgW9x/_old 2024-03-06 23:06:53.314443941 +0100 +++ /var/tmp/diff_new_pack.NvgW9x/_new 2024-03-06 23:06:53.314443941 +0100 @@ -15,10 +15,26 @@ # Please submit bugfixes or comments via https://bugs.opensuse.org/ # -%define llvm_major_version 15 +# Use default LLVM on openSUSE +%if 0%{?suse_version} >= 1600 || 0%{?is_opensuse} + %define llvm_major_version %{nil} +%else + # Hard-code latest LLVM for SLES, the default version is too old + %if 0%{?sle_version} == 150600 + %define llvm_major_version 17 + %else + %if 0%{?sle_version} == 150500 + %define llvm_major_version 15 + %else + %if 0%{?sle_version} == 150400 + %define llvm_major_version 11 + %endif + %endif + %endif +%endif Name: sysctl-logger -Version: 0.0.4 +Version: 0.0.5 Release: 0 Summary: A sysctl monitoring tool based on BPF License: GPL-2.0-only @@ -26,7 +42,7 @@ URL: https://github.com/shunghsiyu/sysctl-logger Source: https://github.com/shunghsiyu/sysctl-logger/archive/refs/tags/v%{version}.tar.gz#/%{name}-%{version}.tar.gz BuildRequires: bpftool -BuildRequires: clang%{llvm_major_version} +BuildRequires: clang%{llvm_major_version} > 9 BuildRequires: gettext-runtime BuildRequires: make BuildRequires: pkgconfig(libbpf) ++++++ sysctl-logger-0.0.4.tar.gz -> sysctl-logger-0.0.5.tar.gz ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sysctl-logger-0.0.4/README.md new/sysctl-logger-0.0.5/README.md --- old/sysctl-logger-0.0.4/README.md 2023-10-20 10:19:55.000000000 +0200 +++ new/sysctl-logger-0.0.5/README.md 2024-03-06 11:57:51.000000000 +0100 @@ -10,9 +10,27 @@ sudo zypper install libelf1 zlib ``` -## Build +Note: if the sysctl-logger is not built with libbpf from submodule, you will need to install libbpf as well. -To build the binary, first run the following command to install built-time requirements: +## Build using libbpf on the system + +This is the suggested way of building sysctl-logger, where we will be using the libbpf provided by the distro. First run the following command to install built-time requirements: + +``` +sudo zypper install libbpf-devel gcc clang make glibc-devel glibc-devel-32bit bpftool libelf-devel zlib-devel gettext-runtime +``` + +Then build the binary with + +``` +make FORCE_SYSTEM_LIBBPF=1 +``` + +Admittedly, not all distro will supply libbpf-devel; or if they do, it may be too old (though sysctl-logger should work on at least libbpf v0.5+). If that is the case, please use libbpf in the git submodule as shown in the next section. + +## Build using libbpf from submodule + +To build the binary using libbpf that was included as a submodule, first run the following command to install built-time requirements: ``` sudo zypper install gcc clang make glibc-devel glibc-devel-32bit bpftool libelf-devel zlib-devel gettext-runtime @@ -24,8 +42,16 @@ make ``` -The sysctl-logger binary can then be executed with +## Running + +The sysctl-logger binary can simply be executed with ``` sudo ./sysctl-logger ``` + +If sysctl-logger fails to run, please file a bug report with verbose mode enabled and attach the log + +``` +sudo DEBUG=1 ./sysctl-logger +``` diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sysctl-logger-0.0.4/sysctl-logger.bpf.c new/sysctl-logger-0.0.5/sysctl-logger.bpf.c --- old/sysctl-logger-0.0.4/sysctl-logger.bpf.c 2023-10-20 10:19:55.000000000 +0200 +++ new/sysctl-logger-0.0.5/sysctl-logger.bpf.c 2024-03-06 11:57:51.000000000 +0100 @@ -27,15 +27,21 @@ if (!event) goto out; + struct task_struct *current = (struct task_struct *)bpf_get_current_task(); + #if HAVE_CGROUP_CURRENT_FUNC_PROTO event->pid = bpf_get_current_pid_tgid() >> 32; bpf_get_current_comm(&event->comm, sizeof(event->comm)); #else - struct task_struct *current = (struct task_struct *)bpf_get_current_task(); bpf_probe_read_kernel(&event->pid, sizeof(event->pid), ¤t->pid); bpf_probe_read_kernel_str(&event->comm, sizeof(event->comm), ¤t->comm); #endif /* HAVE_CGROUP_CURRENT_FUNC_PROTO */ + struct task_struct *parent; + bpf_probe_read_kernel(&parent, sizeof(parent), ¤t->real_parent); + bpf_probe_read_kernel(&event->parent_pid, sizeof(event->parent_pid), &parent->pid); + bpf_probe_read_kernel_str(&event->parent_comm, sizeof(event->parent_comm), &parent->comm); + __builtin_memset(event->name, 0, sizeof(event->name)); ret = bpf_sysctl_get_name(ctx, event->name, sizeof(event->name), 0); if (ret < 0) /* Can only be -E2BIG */ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sysctl-logger-0.0.4/sysctl-logger.c new/sysctl-logger-0.0.5/sysctl-logger.c --- old/sysctl-logger-0.0.4/sysctl-logger.c 2023-10-20 10:19:55.000000000 +0200 +++ new/sysctl-logger-0.0.5/sysctl-logger.c 2024-03-06 11:57:51.000000000 +0100 @@ -50,8 +50,10 @@ event.new_value[strcspn(event.new_value, "\n")] = 0; if (event.truncated || strncmp(event.old_value, event.new_value, sizeof(event.new_value))) { - printf("%s[%d] changed %s from %s to %s%s\n", event.comm, event.pid, - event.name, event.old_value, event.new_value, warning); + printf("%s[%d](%s[%d]) changed %s from %s to %s%s\n", + event.comm, event.pid, event.parent_comm, event.parent_pid, + event.name, ((event.old_value[0] == '\0') ? "''" : event.old_value), + ((event.new_value[0] == '\0') ? "''" : event.new_value), warning); fflush(stdout); } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/sysctl-logger-0.0.4/sysctl-logger.h new/sysctl-logger-0.0.5/sysctl-logger.h --- old/sysctl-logger-0.0.4/sysctl-logger.h 2023-10-20 10:19:55.000000000 +0200 +++ new/sysctl-logger-0.0.5/sysctl-logger.h 2024-03-06 11:57:51.000000000 +0100 @@ -7,8 +7,10 @@ struct sysctl_logger_event { int pid; + int parent_pid; bool truncated; char comm[TASK_COMM_LEN]; + char parent_comm[TASK_COMM_LEN]; char name[MAX_NAME_STR_LEN]; char old_value[MAX_VALUE_STR_LEN]; char new_value[MAX_VALUE_STR_LEN];
