iovisor / iovisor/bcc

libbpf: prog 'tracepoint__syscalls__sys_enter_accept': failed to create BPF link for perf_event FD 49: -13 (Permission denied

Open
#4,241 6 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

My tracepoint for sys_accept is not working for some reason.
Here is the bpf code related to accept
```
#include
#include "dojosnoop.h"
#include
#include
#include "syscalls.h"

static pid_t filter_pid = 0;
static const struct event empty_event = {};

struct {
__uint(type, BPF_MAP_TYPE_HASH);
__uint(max_entries, 10240);
__type(key, pid_t);
__type(value, struct event);
} accepts SEC(".maps");

SEC("tracepoint/syscalls/sys_enter_accept")
int tracepoint__syscalls__sys_enter_accept(struct trace_event_raw_sys_enter* ctx)
{
struct event* event;
pid_t pid = (pid_t)bpf_get_current_pid_tgid();
// trace only selected pid
if (filter_pid == 0 || pid != filter_pid) {
return 0;
}

if (bpf_map_update_elem(&accepts, &pid, &empty_event, BPF_NOEXIST))
return 0;

event = bpf_map_lookup_elem(&accepts, &pid);
if (!event)
return 0;

event->sysnr = sys_accept;
event->pid = pid;
event->uid = bpf_get_current_uid_gid();
bpf_get_current_comm(&event->comm, sizeof(event->comm));
event->arg0 = ctx->args[0];
bpf_probe_read_user(&event->data, sizeof(struct sockaddr), (const char*)ctx->args[1]);
bpf_probe_read_user(&event->arg2, sizeof(int), (const char*)ctx->args[2]);
event->arg3 = ctx->args[3];
bpf_map_update_elem(&accepts, &pid, event, 0);
return 0;
}

SEC("tracepoint/syscalls/sys_exit_accept")
int tracepoint__syscalls__sys_exit_accept(struct trace_event_raw_sys_exit* ctx)
{
u64 id;
pid_t pid;
u64 ret;
struct event* event;

id = bpf_get_current_pid_tgid();
pid = (pid_t)id;
// trace only selected pid
if (filter_pid == 0 || pid != filter_pid) {
return 0;
}

event = bpf_map_lookup_elem(&accepts, &pid);
if (!event)
return 0;
ret = ctx->ret;
if (ret < 0)
goto cleanup;
event->ret = ret;
bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, event, sizeof(*event));
cleanup:
bpf_map_delete_elem(&accepts, &pid);
return 0;
}
```

Output:
```x3ero0@x3ero0-gen10:~$ sudo bcc/libbpf-tools/syssnoop
libbpf: prog 'tracepoint__syscalls__sys_enter_accept': failed to create BPF link for perf_event FD 33: -13 (Permission denied)
libbpf: prog 'tracepoint__syscalls__sys_enter_accept': failed to attach to tracepoint 'syscalls/sys_enter_accept': Permission denied
libbpf: prog 'tracepoint__syscalls__sys_enter_accept': failed to auto-attach: -13
failed to attach BPF programs
```

``/sys/kernel/debug/tracing/events/syscalls/sys_enter_accept`` certainly exists

All other syscalls work just fine

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the pasted sys_enter_accept and sys_exit_accept entry points, then compare their tracepoint attachment behavior with the working syscall programs. Investigate why syscalls/sys_enter_accept returns permission denied despite existing, and verify completion when the accept tracepoint attaches and captures events without preventing other syscall tracing.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
observability-sre, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.