Star0
1
代码
代码
Issues4
Pull Requests3
项目讨论
Wiki
分析
Star0
1
已开启
[sync] PR-49: adapt LOOKUP_CREATE in kernel 6.16 #50
openeuler-ci-bot创建于 9月2日
[sync] PR-49: adapt LOOKUP_CREATE in kernel 6.16 #50
已开启
openeuler-ci-bot创建于 9月2日
从sync-pr49-openEuler-26.09-DevStation-to-master合入到master
共 2 个文件变更+120-2
Aadapt-LOOKUP_CRETE-in-kernel-6.16.patch+113-0
@@ -0,0 +1,113 @@
1+From 2c170e0546df8c688a93754cb4633cba2be1b49f Mon Sep 17 00:00:00 2001
2+From: hongjinghao <hongjinghao@h-partners.com>
3+Date: Tue, 1 Sep 2026 19:33:29 +0800
4+Subject: [PATCH] adapt LOOKUP_CREATE via LINUX_VERSION_CODE
5+ 
6+---
7+ observer_agent/ebpf/CMakeLists.txt | 21 +++++++++++++++++-
8+ observer_agent/ebpf/file_ebpf/CMakeLists.txt | 22 ++++++++++++++++++-
9+ .../ebpf/file_ebpf/file_fentry.bpf.c | 16 ++++++++++++++
10+ 3 files changed, 57 insertions(+), 2 deletions(-)
11+ 
12+diff --git a/observer_agent/ebpf/CMakeLists.txt b/observer_agent/ebpf/CMakeLists.txt
13+index d400c01..4d3d91e 100644
14+--- a/observer_agent/ebpf/CMakeLists.txt
15++++ b/observer_agent/ebpf/CMakeLists.txt
16+@@ -1,10 +1,29 @@
17+ cmake_minimum_required(VERSION 3.22)
18+ project(ebpf)
19+ add_subdirectory(file_ebpf)
20++
21++# See file_ebpf/CMakeLists.txt: inject kernel version for eBPF version-adaptation.
22++
23++if(NOT DEFINED BPF_KERNEL_REL)
24++ message(STATUS "BPF_KERNEL_REL not set, fallback to uname -r (local dev only)")
25++ execute_process(
26++ COMMAND uname -r
27++ OUTPUT_VARIABLE BPF_KERNEL_REL
28++ OUTPUT_STRIP_TRAILING_WHITESPACE
29++ RESULT_VARIABLE _uname_ret
30++ )
31++ if(NOT _uname_ret EQUAL 0)
32++ message(FATAL_ERROR "uname -r failed")
33++ endif()
34++endif()
35++file(READ "/lib/modules/${BPF_KERNEL_REL}/build/include/generated/uapi/linux/version.h" BPF_VERSION_HEADER)
36++string(REGEX MATCH "#define LINUX_VERSION_CODE[ \t]+([0-9]+)" BPF_VER_MATCH "${BPF_VERSION_HEADER}")
37++set(BPF_LINUX_VERSION_CODE "${CMAKE_MATCH_1}")
38++
39+ add_custom_target(ebpf
40+ COMMAND mkdir -p ${CMAKE_CURRENT_BINARY_DIR}/.output
41+ COMMAND bpftool btf dump file /usr/lib/debug/lib/modules/`uname -r`/vmlinux format c > ${CMAKE_CURRENT_BINARY_DIR}/.output/vmlinux.h
42+- COMMAND clang -g -O2 -target bpf -D__TARGET_ARCH_x86 -I${CMAKE_SOURCE_DIR}/include -I${CMAKE_CURRENT_BINARY_DIR}/.output -c ${CMAKE_CURRENT_SOURCE_DIR}/fentry.bpf.c -o ${CMAKE_CURRENT_BINARY_DIR}/.output/fentry.bpf.o
43++ COMMAND clang -g -O2 -target bpf -D__TARGET_ARCH_x86 -DLINUX_VERSION_CODE=${BPF_LINUX_VERSION_CODE} -I${CMAKE_SOURCE_DIR}/include -I${CMAKE_CURRENT_BINARY_DIR}/.output -c ${CMAKE_CURRENT_SOURCE_DIR}/fentry.bpf.c -o ${CMAKE_CURRENT_BINARY_DIR}/.output/fentry.bpf.o
44+ COMMAND bpftool gen skeleton ${CMAKE_CURRENT_BINARY_DIR}/.output/fentry.bpf.o > ${CMAKE_CURRENT_BINARY_DIR}/.output/fentry.skel.h
45+ COMMAND cc -g -Wall -fPIC -I${CMAKE_SOURCE_DIR}/include -I${CMAKE_CURRENT_BINARY_DIR}/.output -I${CMAKE_CURRENT_SOURCE_DIR} -c ${CMAKE_CURRENT_SOURCE_DIR}/fentry.c -o ${CMAKE_CURRENT_BINARY_DIR}/.output/fentry.o
46+ )
47+diff --git a/observer_agent/ebpf/file_ebpf/CMakeLists.txt b/observer_agent/ebpf/file_ebpf/CMakeLists.txt
48+index b8939df..2216b03 100644
49+--- a/observer_agent/ebpf/file_ebpf/CMakeLists.txt
50++++ b/observer_agent/ebpf/file_ebpf/CMakeLists.txt
51+@@ -2,10 +2,30 @@
52+
53+ cmake_minimum_required(VERSION 3.22)
54+ project(file_ebpf)
55++
56++# Read the running kernel's LINUX_VERSION_CODE (from kernel-devel) so the
57++# eBPF program can adapt constants whose values change between kernel
58++# versions (e.g. LOOKUP_OPEN/LOOKUP_CREATE moved to BIT(16)/BIT(17) in 6.16+).
59++if(NOT DEFINED BPF_KERNEL_REL)
60++ message(STATUS "BPF_KERNEL_REL not set, fallback to uname -r (local dev only)")
61++ execute_process(
62++ COMMAND uname -r
63++ OUTPUT_VARIABLE BPF_KERNEL_REL
64++ OUTPUT_STRIP_TRAILING_WHITESPACE
65++ RESULT_VARIABLE _uname_ret
66++ )
67++ if(NOT _uname_ret EQUAL 0)
68++ message(FATAL_ERROR "uname -r failed")
69++ endif()
70++endif()
71++file(READ "/lib/modules/${BPF_KERNEL_REL}/build/include/generated/uapi/linux/version.h" BPF_VERSION_HEADER)
72++string(REGEX MATCH "#define LINUX_VERSION_CODE[ \t]+([0-9]+)" BPF_VER_MATCH "${BPF_VERSION_HEADER}")
73++set(BPF_LINUX_VERSION_CODE "${CMAKE_MATCH_1}")
74++
75+ add_custom_target(file_ebpf
76+ COMMAND mkdir -p ${CMAKE_CURRENT_BINARY_DIR}/.output
77+ COMMAND bpftool btf dump file /usr/lib/debug/lib/modules/`uname -r`/vmlinux format c > ${CMAKE_CURRENT_BINARY_DIR}/.output/vmlinux.h
78+- COMMAND clang -g -O2 -target bpf -D__TARGET_ARCH_x86 -I${CMAKE_SOURCE_DIR}/include -I${CMAKE_CURRENT_BINARY_DIR}/.output -c ${CMAKE_CURRENT_SOURCE_DIR}/file_fentry.bpf.c -o ${CMAKE_CURRENT_BINARY_DIR}/.output/file_fentry.bpf.o
79++ COMMAND clang -g -O2 -target bpf -D__TARGET_ARCH_x86 -DLINUX_VERSION_CODE=${BPF_LINUX_VERSION_CODE} -I${CMAKE_SOURCE_DIR}/include -I${CMAKE_CURRENT_BINARY_DIR}/.output -c ${CMAKE_CURRENT_SOURCE_DIR}/file_fentry.bpf.c -o ${CMAKE_CURRENT_BINARY_DIR}/.output/file_fentry.bpf.o
80+ COMMAND bpftool gen skeleton ${CMAKE_CURRENT_BINARY_DIR}/.output/file_fentry.bpf.o > ${CMAKE_CURRENT_BINARY_DIR}/.output/file_fentry.skel.h
81+ COMMAND cc -g -Wall -fPIC -I${CMAKE_SOURCE_DIR}/include -I${CMAKE_CURRENT_BINARY_DIR}/.output -I${CMAKE_CURRENT_SOURCE_DIR} -c ${CMAKE_CURRENT_SOURCE_DIR}/file_fentry.c -o ${CMAKE_CURRENT_BINARY_DIR}/.output/file_fentry.o
82+ )
83+diff --git a/observer_agent/ebpf/file_ebpf/file_fentry.bpf.c b/observer_agent/ebpf/file_ebpf/file_fentry.bpf.c
84+index b3ef041..bf61e65 100644
85+--- a/observer_agent/ebpf/file_ebpf/file_fentry.bpf.c
86++++ b/observer_agent/ebpf/file_ebpf/file_fentry.bpf.c
87+@@ -12,7 +12,23 @@
88+ #define S_ISREG(m) (((m) & S_IFMT) == S_IFREG)
89+
90+ #define O_CREAT 100
91++
92++/*
93++ * LOOKUP_OPEN/LOOKUP_CREATE changed in kernel 6.16:
94++ * < 6.16 : LOOKUP_CREATE = 0x0200
95++ * >= 6.16: LOOKUP_CREATE = BIT(17) = 0x20000
96++ * LINUX_VERSION_CODE is injected at compile time by CMake (kernel-devel).
97++ */
98++#ifndef KERNEL_VERSION
99++#define KERNEL_VERSION(a, b, c) (((a) << 16) + ((b) << 8) + (c))
100++#endif
101++
102++#if defined(LINUX_VERSION_CODE) && LINUX_VERSION_CODE >= KERNEL_VERSION(6, 16, 0)
103++#define LOOKUP_CREATE 0x20000
104++#else
105+ #define LOOKUP_CREATE 0x0200
106++#endif
107++
108+ #define FMODE_CREATED 0x100000
109+
110+ char LICENSE[] SEC("license") = "Dual BSD/GPL";
111+--
112+2.54.0
113+ 
MsecDetector.spec+7-2
@@ -5,7 +5,7 @@
5Name : secDetector5Name : secDetector
6Summary : OS Security Intrusion Detection System6Summary : OS Security Intrusion Detection System
7Version : 1.07Version : 1.0
8-Release : 168+Release : 17
9License : GPL-2.09License : GPL-2.0
10Source0 : %{name}-v%{version}.tar.gz10Source0 : %{name}-v%{version}.tar.gz
11BuildRequires: kernel-devel kernel-headers kernel-debuginfo11BuildRequires: kernel-devel kernel-headers kernel-debuginfo
@@ -50,6 +50,7 @@ Patch0033: Backport-fix-6.x-kernel-compile-error.patch
50Patch0034: fix-del_timer_sync-removed-in-kernel-6.15.patch50Patch0034: fix-del_timer_sync-removed-in-kernel-6.15.patch
51Patch0035: fix-no_llseek-removed-in-kernel-6.4.patch51Patch0035: fix-no_llseek-removed-in-kernel-6.4.patch
52Patch0036: Backport-adapt-file-ebpf-for-kernel-6.6.patch 52Patch0036: Backport-adapt-file-ebpf-for-kernel-6.6.patch
53+Patch0037: adapt-LOOKUP_CRETE-in-kernel-6.16.patch
53 54 
54%description55%description
55OS Security Intrusion Detection System56OS Security Intrusion Detection System
@@ -69,6 +70,7 @@ sed -i 's#/lib/modules/$(shell uname -r)/build#/lib/modules/%{kernel_version}/bu
69make70make
70cd ../cases71cd ../cases
71sed -i 's#/lib/modules/$(shell uname -r)/build#/lib/modules/%{kernel_version}/build#' Makefile72sed -i 's#/lib/modules/$(shell uname -r)/build#/lib/modules/%{kernel_version}/build#' Makefile
73+ 
72make74make
73 75 
74cd ../../76cd ../../
@@ -76,7 +78,7 @@ mkdir -p build
76sed -i 's#`uname -r`#%{kernel_version}#' observer_agent/ebpf/file_ebpf/CMakeLists.txt78sed -i 's#`uname -r`#%{kernel_version}#' observer_agent/ebpf/file_ebpf/CMakeLists.txt
77sed -i 's#`uname -r`#%{kernel_version}#' observer_agent/ebpf/CMakeLists.txt79sed -i 's#`uname -r`#%{kernel_version}#' observer_agent/ebpf/CMakeLists.txt
78cd build80cd build
79-cmake .. && make81+cmake -DBPF_KERNEL_REL="%{kernel_version}" .. && make
80 82 
81 83 
82%install84%install
@@ -125,6 +127,9 @@ rm -rf %{buildroot}
125%attr(0644,root,root) /usr/include/secDetector/secDetector_topic.h127%attr(0644,root,root) /usr/include/secDetector/secDetector_topic.h
126 128 
127%changelog129%changelog
130+* Tue Sep 1 2026 hongjinghao <hongjinghao@huawei.com> - 1.0-17
131+- adapt LOOKUP_CREATE in kernel 6.16
132+ 
128* Thu Aug 27 2026 hongjinghao <hongjinghao@huawei.com> - 1.0-16133* Thu Aug 27 2026 hongjinghao <hongjinghao@huawei.com> - 1.0-16
129- adapt file ebpf for kernel 6.6134- adapt file ebpf for kernel 6.6
130- vmlinux in kernel-debuginfo when complie in docker, so add kernel-debuginfo buildrequires135- vmlinux in kernel-debuginfo when complie in docker, so add kernel-debuginfo buildrequires