tools: add option --unique to capable.py

Some processes can do a lot of security capability checks, generating a
lot of ouput. In this case, the --unique option is useful to only print
once the same set of capability, pid (or cgroup if --cgroupmap is used)
and kernel/user stacks (if -K or -U are used).

  # ./capable.py -K -U --unique

Documentation (man page and example text) updated.

man/man8/capable.8

@@ -1,8 +1,9 @@
-.TH capable 8 "2020-03-06" "USER COMMANDS"
+.TH capable 8 "2020-03-08" "USER COMMANDS"
 .SH NAME
 capable \- Trace security capability checks (cap_capable()).
 .SH SYNOPSIS
 .B capable [\-h] [\-v] [\-p PID] [\-K] [\-U] [\-x] [\-\-cgroupmap MAPPATH]
+ [--unique]
 .SH DESCRIPTION
 This traces security capability checks in the kernel, and prints details for
 each call. This can be useful for general debugging, and also security
@@ -31,6 +32,9 @@ Show extra fields in TID and INSETID columns.
 .TP
 \-\-cgroupmap MAPPATH
 Trace cgroups in this BPF map only (filtered in-kernel).
+.TP
+\-\-unique
+Don't repeat stacks for the same PID or cgroup.
 .SH EXAMPLES
 .TP
 Trace all capability checks system-wide:

tools/capable.py

@@ -27,6 +27,7 @@
  ./capable -K # add kernel stacks to trace
  ./capable -U # add user-space stacks to trace
  ./capable -x # extra fields: show TID and INSETID columns
+ ./capable --unique # don't repeat stacks for the same pid or cgroup
  ./capable --cgroupmap ./mappath # only trace cgroups in this BPF map
 """
 parser = argparse.ArgumentParser(
@@ -45,6 +46,8 @@
  help="show extra fields in TID and INSETID columns")
 parser.add_argument("--cgroupmap",
  help="trace cgroups in this BPF map only")
+parser.add_argument("--unique", action="store_true",
+ help="don't repeat stacks for the same pid or cgroup")
 args = parser.parse_args()
 debug = 0
 
@@ -125,6 +128,23 @@ def __getattr__(self, name):
 
 BPF_PERF_OUTPUT(events);
 
+#if UNIQUESET
+struct repeat_t {
+ int cap;
+ u32 tgid;
+#if CGROUPSET
+ u64 cgroupid;
+#endif
+#ifdef KERNEL_STACKS
+ int kernel_stack_id;
+#endif
+#ifdef USER_STACKS
+ int user_stack_id;
+#endif
+};
+BPF_HASH(seen, struct repeat_t, u64);
+#endif
+
 #if CGROUPSET
 BPF_TABLE_PINNED("hash", u64, u64, cgroupset, 1024, "CGROUPPATH");
 #endif
@@ -168,6 +188,28 @@ def __getattr__(self, name):
 #ifdef USER_STACKS
  data.user_stack_id = stacks.get_stackid(ctx, BPF_F_USER_STACK);
 #endif
+
+#if UNIQUESET
+ struct repeat_t repeat = {0,};
+ repeat.cap = cap;
+#if CGROUPSET
+ repeat.cgroupid = bpf_get_current_cgroup_id(),
+#else
+ repeat.tgid = tgid;
+#endif
+#ifdef KERNEL_STACKS
+ repeat.kernel_stack_id = data.kernel_stack_id;
+#endif
+#ifdef USER_STACKS
+ repeat.user_stack_id = data.user_stack_id;
+#endif
+ if (seen.lookup(&repeat) != NULL) {
+ return 0;
+ }
+ u64 zero = 0;
+ seen.update(&repeat, &zero);
+#endif
+
  bpf_get_current_comm(&data.comm, sizeof(data.comm));
  events.perf_submit(ctx, &data, sizeof(data));
 
@@ -192,6 +234,10 @@ def __getattr__(self, name):
  bpf_text = bpf_text.replace('CGROUPPATH', args.cgroupmap)
 else:
  bpf_text = bpf_text.replace('CGROUPSET', '0')
+if args.unique:
+ bpf_text = bpf_text.replace('UNIQUESET', '1')
+else:
+ bpf_text = bpf_text.replace('UNIQUESET', '0')
 if debug:
  print(bpf_text)
 

tools/capable_example.txt

@@ -88,6 +88,13 @@ TIME UID PID COMM CAP NAME AUDIT
 Similarly, it is possible to include user-space stack with -U (or they can be
 used both at the same time to include user and kernel stack).
 
+Some processes can do a lot of security capability checks, generating a lot of
+ouput. In this case, the --unique option is useful to only print once the same
+set of capability, pid (or cgroup if --cgroupmap is used) and kernel/user
+stacks (if -K or -U are used).
+
+# ./capable.py -K -U --unique
+
 The --cgroupmap option filters based on a cgroup set. It is meant to be used
 with an externally created map.
 
@@ -100,6 +107,7 @@ USAGE:
 
 # ./capable.py -h
 usage: capable.py [-h] [-v] [-p PID] [-K] [-U] [-x] [--cgroupmap CGROUPMAP]
+ [--unique]
 
 Trace security capability checks
 
@@ -112,6 +120,7 @@ optional arguments:
  -x, --extra show extra fields in TID and INSETID columns
  --cgroupmap CGROUPMAP
  trace cgroups in this BPF map only
+ --unique don't repeat stacks for the same pid or cgroup
 
 examples:
  ./capable # trace capability checks
@@ -120,4 +129,5 @@ examples:
  ./capable -K # add kernel stacks to trace
  ./capable -U # add user-space stacks to trace
  ./capable -x # extra fields: show TID and INSETID columns
+ ./capable --unique # don't repeat stacks for the same pid or cgroup
  ./capable --cgroupmap ./mappath # only trace cgroups in this BPF map