iovisor / iovisor/bcc

add sigqueue instrumentation to killsnoop-bpfcc

Open
#3,520 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

As noted in https://stackoverflow.com/a/62434615/11582827 the `killsnoop-bpfcc` does not capture signals sent via the `sigqueue` library call, i.e. using the `rt_sigqueueinfo` system call.

Running https://github.com/devnull-cz/unix-linux-prog-in-c-src/blob/701db3599460ab03ed1aa45a8bc7e1dccb462588/signals/sigqueue.c will send the signal via `sigqueue(3)`:
```
$ cc sigqueue.c
$ ./a.out
2043940 sleeping
2043941 waiting
2043940 sending SIGINT signal to 2043941
2043941 exiting with received 42
```
and using the `killsnoop-bpfcc` program with simple modification to instrument the `rt_sigqueueinfo` syscall, it now displays the signal:
```
$ sudo ./killsnoop-bpfcc
TIME PID COMM SIG TPID RESULT
15:33:44 2043940 a.out 2 2043941 0
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the killsnoop-bpfcc entry point and inspect how it instruments signal-related system calls. Compile and run the referenced sigqueue.c example, then run killsnoop-bpfcc while it sends SIGINT through sigqueue. Done means the rt_sigqueueinfo signal appears in the tool output with the target PID and result.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
observability-sre, operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.