libbpf: prog 'tracepoint__syscalls__sys_enter_accept': failed to create BPF link for perf_event FD 49: -13 (Permission denied
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
My tracepoint for sys_accept is not working for some reason.
Here is the bpf code related to accept
```
#include
#include "dojosnoop.h"
#include
#include
#include "syscalls.h"
static pid_t filter_pid = 0;
static const struct event empty_event = {};
struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 10240);
__type(key, pid_t);
__type(value, struct event);
} accepts SEC(".maps");
SEC("tracepoint/syscalls/sys_enter_accept")
int tracepoint__syscalls__sys_enter_accept(struct trace_event_raw_sys_enter* ctx)
{
struct event* event;
pid_t pid = (pid_t)bpf_get_current_pid_tgid();
// trace only selected pid
if (filter_pid == 0 || pid != filter_pid) {
return 0;
}
if (bpf_map_update_elem(&accepts, &pid, &empty_event, BPF_NOEXIST))
return 0;
event = bpf_map_lookup_elem(&accepts, &pid);
if (!event)
return 0;
event->sysnr = sys_accept;
event->pid = pid;
event->uid = bpf_get_current_uid_gid();
bpf_get_current_comm(&event->comm, sizeof(event->comm));
event->arg0 = ctx->args[0];
bpf_probe_read_user(&event->data, sizeof(struct sockaddr), (const char*)ctx->args[1]);
bpf_probe_read_user(&event->arg2, sizeof(int), (const char*)ctx->args[2]);
event->arg3 = ctx->args[3];
bpf_map_update_elem(&accepts, &pid, event, 0);
return 0;
}
SEC("tracepoint/syscalls/sys_exit_accept")
int tracepoint__syscalls__sys_exit_accept(struct trace_event_raw_sys_exit* ctx)
{
u64 id;
pid_t pid;
u64 ret;
struct event* event;
id = bpf_get_current_pid_tgid();
pid = (pid_t)id;
// trace only selected pid
if (filter_pid == 0 || pid != filter_pid) {
return 0;
}
event = bpf_map_lookup_elem(&accepts, &pid);
if (!event)
return 0;
ret = ctx->ret;
if (ret < 0)
goto cleanup;
event->ret = ret;
bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, event, sizeof(*event));
cleanup:
bpf_map_delete_elem(&accepts, &pid);
return 0;
}
```
Output:
```x3ero0@x3ero0-gen10:~$ sudo bcc/libbpf-tools/syssnoop
libbpf: prog 'tracepoint__syscalls__sys_enter_accept': failed to create BPF link for perf_event FD 33: -13 (Permission denied)
libbpf: prog 'tracepoint__syscalls__sys_enter_accept': failed to attach to tracepoint 'syscalls/sys_enter_accept': Permission denied
libbpf: prog 'tracepoint__syscalls__sys_enter_accept': failed to auto-attach: -13
failed to attach BPF programs
```
``/sys/kernel/debug/tracing/events/syscalls/sys_enter_accept`` certainly exists
All other syscalls work just fine
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the pasted sys_enter_accept and sys_exit_accept entry points, then compare their tracepoint attachment behavior with the working syscall programs. Investigate why syscalls/sys_enter_accept returns permission denied despite existing, and verify completion when the accept tracepoint attaches and captures events without preventing other syscall tracing.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- observability-sre, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100