[pull] main from aquasecurity:main

.github/actions/build-dependencies/action.yaml

@@ -21,6 +21,8 @@ runs:
         sudo apt-get install --yes llvm-14 clang-14 clang-format-14
         sudo apt-get install --yes libelf-dev libzstd-dev zlib1g-dev
         sudo apt-get install --yes virtme-ng
+        sudo apt-get install --yes gcc-multilib
+        sudo apt-get install --yes systemtap-sdt-dev
         for tool in "clang" "clang-format" "llc" "llvm-strip"
         do
           sudo rm -f /usr/bin/$tool

.github/workflows/codeql.yaml

@@ -31,7 +31,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
     - name: Install dependencies
       run: |

.github/workflows/pr.yaml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-24.04
     steps:
       - name: Checkout Code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install Dependencies
         uses: ./.github/actions/build-dependencies
       - name: Lint
@@ -60,7 +60,7 @@ jobs:
         go-version: [ '1.18', '1.19', '1.20', '1.21', '1.22', '1.23', 'stable' ]
     steps:
       - name: Checkout Code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install Dependencies
         uses: ./.github/actions/build-dependencies
         with:
@@ -76,7 +76,7 @@ jobs:
         go-version: [ '1.18', '1.19', '1.20', '1.21', '1.22', '1.23', 'stable' ]
     steps:
       - name: Checkout Code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install Dependencies
         uses: ./.github/actions/build-dependencies
         with:
@@ -92,7 +92,7 @@ jobs:
         go-version: [ '1.18', '1.19', '1.20', '1.21', '1.22', '1.23', 'stable' ]
     steps:
       - name: Checkout Code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
       - name: Install Dependencies
         uses: ./.github/actions/build-dependencies
         with:

.gitignore

@@ -3,7 +3,7 @@ selftest/*/*.o
 selftest/*/*.skel.h
 selftest/*/*-static
 selftest/*/*-dynamic
-selftest/uprobe/ctest
-selftest/uprobe/gotest
+selftest/*/ctest
+selftest/*/gotest
 testing/tracee
 .vagrant*

Makefile

@@ -171,13 +171,15 @@ selftest-clean:
 helpers-test-run: helpers-test-static-run
 
 helpers-test-static-run: libbpfgo-static
-	CC=$(CLANG) \
+	cd $(HELPERS) && \
+		CC=$(CLANG) \
 		CGO_CFLAGS=$(CGO_CFLAGS_STATIC) \
 		CGO_LDFLAGS=$(CGO_LDFLAGS_STATIC) \
-		sudo -E env PATH=$(PATH) $(GO) test -v $(HELPERS)/...
+		sudo -E env PATH=$(PATH) $(GO) test -v ./...
 
 helpers-test-dynamic-run: libbpfgo-dynamic
-	sudo $(GO) test -v $(HELPERS)/...
+	cd $(HELPERS) && \
+		sudo $(GO) test -v ./...
 
 # vagrant
 

go.mod

@@ -3,13 +3,13 @@ module github.com/aquasecurity/libbpfgo
 go 1.21
 
 require (
-	github.com/stretchr/testify v1.10.0
-	kernel.org/pub/linux/libs/security/libcap/cap v1.2.75
+	github.com/stretchr/testify v1.11.1
+	kernel.org/pub/linux/libs/security/libcap/cap v1.2.76
 )
 
 require (
 	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/pmezard/go-difflib v1.0.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
-	kernel.org/pub/linux/libs/security/libcap/psx v1.2.76-rc1 // indirect
+	kernel.org/pub/linux/libs/security/libcap/psx v1.2.76 // indirect
 )

go.sum

@@ -2,14 +2,13 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
-github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
+github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-kernel.org/pub/linux/libs/security/libcap/cap v1.2.75 h1:f78VOelVeTl82xITLNCvtOQ6yHbrsL2X8lSs2kJ6laE=
-kernel.org/pub/linux/libs/security/libcap/cap v1.2.75/go.mod h1:/0v7MsGCcYOmU5VrtrvcjgqCar2mdCr/STymAGfd57A=
-kernel.org/pub/linux/libs/security/libcap/psx v1.2.75/go.mod h1:+l6Ee2F59XiJ2I6WR5ObpC1utCQJZ/VLsEbQCD8RG24=
-kernel.org/pub/linux/libs/security/libcap/psx v1.2.76-rc1 h1:Tq5hYNtVgkIUTv+5BtOZjC5JB4s8TutijJE5vBaoW84=
-kernel.org/pub/linux/libs/security/libcap/psx v1.2.76-rc1/go.mod h1:+l6Ee2F59XiJ2I6WR5ObpC1utCQJZ/VLsEbQCD8RG24=
+kernel.org/pub/linux/libs/security/libcap/cap v1.2.76 h1:mrdLPj8ujM6eIKGtd1PkkuCIodpFFDM42Cfm0YODkIM=
+kernel.org/pub/linux/libs/security/libcap/cap v1.2.76/go.mod h1:7V2BQeHnVAQwhCnCPJ977giCeGDiywVewWF+8vkpPlc=
+kernel.org/pub/linux/libs/security/libcap/psx v1.2.76 h1:3DyzQ30OHt3wiOZVL1se2g1PAPJIU7+tMUyvfMUj1dY=
+kernel.org/pub/linux/libs/security/libcap/psx v1.2.76/go.mod h1:+l6Ee2F59XiJ2I6WR5ObpC1utCQJZ/VLsEbQCD8RG24=

libbpfgo.c

@@ -43,9 +43,25 @@ void cgo_libbpf_set_print_fn()
     libbpf_set_print(libbpf_print_fn);
 }
 
+struct user_ring_buffer *cgo_init_user_ring_buf(int map_fd)
+{
+    struct user_ring_buffer *rb;
+
+    rb = user_ring_buffer__new(map_fd, NULL);
+    if (!rb) {
+        int saved_errno = errno;
+        fprintf(stderr, "Failed to initialize user ring buffer: %s\n", strerror(errno));
+        errno = saved_errno;
+
+        return NULL;
+    }
+
+    return rb;
+}
+
 struct ring_buffer *cgo_init_ring_buf(int map_fd, uintptr_t ctx)
 {
-    struct ring_buffer *rb = NULL;
+    struct ring_buffer *rb;
 
     rb = ring_buffer__new(map_fd, ringbufferCallback, (void *) ctx, NULL);
     if (!rb) {
@@ -131,6 +147,27 @@ int cgo_bpf_prog_detach_cgroup_legacy(int prog_fd,   // eBPF program file descri
     return syscall(__NR_bpf, BPF_PROG_DETACH, &attr, sizeof(attr));
 }
 
+struct bpf_link *cgo_bpf_program__attach_uprobe_multi(
+    struct bpf_program *prog,
+    pid_t pid,
+    const char *binary_path,
+    const char *func_pattern,
+    const unsigned long *offsets, // bpf_uprobe_multi_opts.offsets
+    const __u64 *cookies,         // bpf_uprobe_multi_opts.cookies
+    size_t cnt,                   // bpf_uprobe_multi_opts.cnt
+    bool retprobe                 // bpf_uprobe_multi_opts.retprobe
+)
+{
+    struct bpf_uprobe_multi_opts opts = {};
+    opts.sz = sizeof(opts);
+    opts.offsets = offsets;
+    opts.cookies = cookies;
+    opts.cnt = cnt;
+    opts.retprobe = retprobe;
+
+    return bpf_program__attach_uprobe_multi(prog, pid, binary_path, func_pattern, &opts);
+}
+
 //
 // struct handlers
 //
@@ -567,4 +604,4 @@ struct bpf_xdp_attach_opts *cgo_bpf_xdp_attach_opts_new(__u32 fd)
 void cgo_bpf_xdp_attach_opts_free(struct bpf_xdp_attach_opts *opts)
 {
     free(opts);
-}
+}

libbpfgo.go

@@ -80,7 +80,7 @@ func SetStrictMode(mode LibbpfStrictMode) {
 
 func BPFProgramTypeIsSupported(progType BPFProgType) (bool, error) {
 	supportedC := C.libbpf_probe_bpf_prog_type(C.enum_bpf_prog_type(int(progType)), nil)
-	if supportedC < 1 {
+	if supportedC < 0 {
 		return false, syscall.Errno(-supportedC)
 	}
 
@@ -89,7 +89,7 @@ func BPFProgramTypeIsSupported(progType BPFProgType) (bool, error) {
 
 func BPFMapTypeIsSupported(mapType MapType) (bool, error) {
 	supportedC := C.libbpf_probe_bpf_map_type(C.enum_bpf_map_type(int(mapType)), nil)
-	if supportedC < 1 {
+	if supportedC < 0 {
 		return false, syscall.Errno(-supportedC)
 	}
 

libbpfgo.h

@@ -22,6 +22,7 @@
 void cgo_libbpf_set_print_fn();
 
 struct ring_buffer *cgo_init_ring_buf(int map_fd, uintptr_t ctx);
+struct user_ring_buffer *cgo_init_user_ring_buf(int map_fd);
 int cgo_add_ring_buf(struct ring_buffer *rb, int map_fd, uintptr_t ctx);
 struct perf_buffer *cgo_init_perf_buf(int map_fd, int page_cnt, uintptr_t ctx);
 
@@ -30,6 +31,15 @@ void cgo_bpf_map__initial_value(struct bpf_map *map, void *value);
 int cgo_bpf_prog_attach_cgroup_legacy(int prog_fd, int target_fd, int type);
 int cgo_bpf_prog_detach_cgroup_legacy(int prog_fd, int target_fd, int type);
 
+struct bpf_link *cgo_bpf_program__attach_uprobe_multi(struct bpf_program *prog,
+                                                      pid_t pid,
+                                                      const char *binary_path,
+                                                      const char *func_pattern,
+                                                      const unsigned long *offsets,
+                                                      const __u64 *cookies,
+                                                      size_t count,
+                                                      bool retprobe);
+
 //
 // struct handlers
 //

link.go

@@ -34,6 +34,7 @@ const (
 	Netns
 	Iter
 	StructOps
+	USDT
 )
 
 //

module.go

@@ -21,12 +21,13 @@ import (
 //
 
 type Module struct {
-	obj      *C.struct_bpf_object
-	links    []*BPFLink
-	perfBufs []*PerfBuffer
-	ringBufs []*RingBuffer
-	elf      *elf.File
-	loaded   bool
+	obj          *C.struct_bpf_object
+	links        []*BPFLink
+	perfBufs     []*PerfBuffer
+	ringBufs     []*RingBuffer
+	userRingBufs []*UserRingBuffer
+	elf          *elf.File
+	loaded       bool
 }
 
 //
@@ -187,6 +188,9 @@ func (m *Module) Close() {
 	for _, rb := range m.ringBufs {
 		rb.Close()
 	}
+	for _, rb := range m.userRingBufs {
+		rb.Close()
+	}
 	for _, link := range m.links {
 		if link.link != nil {
 			link.Destroy()
@@ -327,6 +331,30 @@ func (m *Module) GetProgram(progName string) (*BPFProg, error) {
 	}, nil
 }
 
+func (m *Module) InitUserRingBuf(mapName string, eventsChan chan []byte) (*UserRingBuffer, error) {
+	bpfMap, err := m.GetMap(mapName)
+	if err != nil {
+		return nil, err
+	}
+
+	if eventsChan == nil {
+		return nil, fmt.Errorf("events channel can not be nil")
+	}
+
+	rbC, errno := C.cgo_init_user_ring_buf(C.int(bpfMap.FileDescriptor()))
+	if rbC == nil {
+		return nil, fmt.Errorf("failed to initialize user ring buffer: %w", errno)
+	}
+
+	ringBuf := &UserRingBuffer{
+		rb:     rbC,
+		bpfMap: bpfMap,
+		w:      eventsChan,
+	}
+	m.userRingBufs = append(m.userRingBufs, ringBuf)
+	return ringBuf, nil
+}
+
 func (m *Module) InitRingBuf(mapName string, eventsChan chan []byte) (*RingBuffer, error) {
 	bpfMap, err := m.GetMap(mapName)
 	if err != nil {