Failed to capture file creation using fsprobe after added another monitor function of security_inode_create

[soh0ro0t]

Failed to capture file creation using fsprobe after added another monitor function of security_inode_create

[soh0ro0t]

And the source code is as bellow:

/*
Copyright © 2020 GUILLAUME FOURNIER

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
#ifndef _CREATE_H_
#define _CREATE_H_

// trace_security_inode_create - Traces a file system creation event.
// @ctx: registers context
// @dir: pointer to the inode of the containing directory
// @dentry: pointer to the dentry structure of the new directory
// @mode: mode of the security_inode_create call
__attribute__((always_inline)) static int trace_security_inode_create(struct pt_regs *ctx, struct inode *dir,
    struct dentry *dentry, umode_t mode)
{
    u32 cpu = bpf_get_smp_processor_id();
    struct dentry_cache_t *data_cache = bpf_map_lookup_elem(&dentry_cache_builder, &cpu);
    if (!data_cache)
        return 0;
    // Reset pathname keys (could mess up resolution if there was some leftover data)
    data_cache->fs_event.src_path_key = 0;
    data_cache->fs_event.target_path_key = 0;
    data_cache->cursor = 0;
    // Add process data
    u64 key = fill_process_data(&data_cache->fs_event.process_data);
    // Probe type
    data_cache->fs_event.event = EVENT_CREATE;

    // Add mode
    data_cache->fs_event.mode = (int)mode;

    // Mount ID
    data_cache->fs_event.src_mount_id = get_inode_mount_id(dir);

    // Dentry data
    data_cache->src_dentry = dentry;

    // Filter
    if (!filter(data_cache, FILTER_SRC))
        return 0;

    // Send to cache
    bpf_map_update_elem(&dentry_cache, &key, data_cache, BPF_ANY);
    return 0;
}

// trace_security_inode_create_ret - Traces the return of a file system creation event.
// @ctx: registers context
__attribute__((always_inline)) static int trace_security_inode_create_ret(struct pt_regs *ctx)
{
    u64 key = bpf_get_current_pid_tgid();
    struct dentry_cache_t *data_cache = bpf_map_lookup_elem(&dentry_cache, &key);
    if (!data_cache)
        return 0;
    data_cache->fs_event.retval = PT_REGS_RC(ctx);

    // Add inode data
    data_cache->fs_event.src_inode = get_dentry_ino(data_cache->src_dentry);

    // Resolve paths
    resolve_paths(ctx, data_cache, RESOLVE_SRC | EMIT_EVENT);

    // Check recursive mode and insert inode if necessary
    u64 recursive = load_recursive_mode();
    if (recursive) {
        u8 value = 0;
        bpf_map_update_elem(&inodes_filter, &data_cache->fs_event.src_inode, &value, BPF_ANY);
    }

    bpf_map_delete_elem(&dentry_cache, &key);
    return 0;
}

#endif

[soh0ro0t]

I tried to figure out the rootcause and it worked after the line of resolve_paths(ctx, data_cache, RESOLVE_SRC | EMIT_EVENT) deleted. How could be that ? I think security_inode_create and open functions could both be triggered when a newly file created, and open function was hitted in deed according to some experiment, while security_inode_create couldn't work.

[zer0-1s]

sudo fsprobe /tmp
    EVT      TS    PID    TID    UID    GID              CMD  INODE MOUNTID    RET   MODE             FLAG PATH
ERROR[2023-03-02T17:49:54Z] couldn't start probe "rename": couldn't enable kprobe kprobe/vfs_rename: cannot write "p:pvfs_rename vfs_rename\n" to kprobe_events: write /sys/kernel/debug/tracing/kprobe_events: file exists 
ERROR[2023-03-02T17:49:54Z] failed to start monitor FileSystem: couldn't enable kprobe kprobe/vfs_rename: cannot write "p:pvfs_rename vfs_rename\n" to kprobe_events: write /sys/kernel/debug/tracing/kprobe_events: file exists 
FATAL[2023-03-02T17:49:54Z] couldn't start watching the filesystem: couldn't enable kprobe kprobe/vfs_rename: cannot write "p:pvfs_rename vfs_rename\n" to kprobe_events: write /sys/kernel/debug/tracing/kprobe_events: file exists 

do you meet this error?