RHEL-8 file create

.buildkite/pipeline.yml

@@ -220,9 +220,9 @@ steps:
       machineType: n2-standard-2
       enableNestedVirtualization: true
 
-  - label: "quark-test on rhel 8 (file creation broken)"
+  - label: "quark-test on rhel 8"
     key: test_rhel_8
-    command: "./.buildkite/runtest_distro.sh rhel 8 -x t_file"
+    command: "./.buildkite/runtest_distro.sh rhel 8"
     depends_on:
       - make_docker
     agents:
@@ -286,9 +286,9 @@ steps:
       machineType: n2-standard-2
       enableNestedVirtualization: true
 
-  - label: "quark-test on rhel 8.8 (file creation broken)"
+  - label: "quark-test on rhel 8.8"
     key: test_rhel_8_8
-    command: "./.buildkite/runtest_distro.sh rhel 8.8 -x t_file"
+    command: "./.buildkite/runtest_distro.sh rhel 8.8"
     depends_on:
       - make_docker
     agents:
@@ -297,9 +297,9 @@ steps:
       machineType: n2-standard-2
       enableNestedVirtualization: true
 
-  - label: "quark-test on rhel 8.9 (file creation broken)"
+  - label: "quark-test on rhel 8.9"
     key: test_rhel_8_9
-    command: "./.buildkite/runtest_distro.sh rhel 8.9 -x t_file"
+    command: "./.buildkite/runtest_distro.sh rhel 8.9"
     depends_on:
       - make_docker
     agents:

bpf_queue.c

@@ -667,9 +667,14 @@ bpf_queue_open1(struct quark_queue *qq, int use_fentry)
 	}
 
 	if (qq->flags & QQ_FILE) {
+		int use_fsnotify =
+		    (btf_number_of_params_of_ptr(btf, "inode_operations", "atomic_open") == 6);
+
 		if (use_fentry) {
 			bpf_program__set_autoload(p->progs.fentry__do_renameat2, 1);
 			bpf_program__set_autoload(p->progs.fentry__do_unlinkat, 1);
+			if (use_fsnotify)
+				bpf_program__set_autoload(p->progs.fentry__fsnotify, 1);
 			bpf_program__set_autoload(p->progs.fentry__mnt_want_write, 1);
 			bpf_program__set_autoload(p->progs.fentry__vfs_rename, 1);
 			bpf_program__set_autoload(p->progs.fentry__vfs_unlink, 1);
@@ -688,6 +693,8 @@ bpf_queue_open1(struct quark_queue *qq, int use_fentry)
 			bpf_program__set_autoload(p->progs.kretprobe__chown_common, 1);
 			bpf_program__set_autoload(p->progs.kprobe__do_truncate, 1);
 			bpf_program__set_autoload(p->progs.kretprobe__do_truncate, 1);
+			if (use_fsnotify)
+				bpf_program__set_autoload(p->progs.kprobe__fsnotify, 1);
 			bpf_program__set_autoload(p->progs.kprobe__vfs_writev, 1);
 			bpf_program__set_autoload(p->progs.kretprobe__vfs_writev, 1);
 			bpf_program__set_autoload(p->progs.kprobe__vfs_rename, 1);

btf.c

@@ -186,13 +186,29 @@ btf_offsetof(struct btf *btf, const char *parent_name, const char *member_name,
 	if (parent_t == NULL)
 		parent_t = btf_type_by_name_kind(btf, NULL, parent_name,
 		    BTF_KIND_UNION);
-	if (parent_t == NULL)
+	if (parent_t == NULL) {
+		if (ret_member != NULL)
+			*ret_member = NULL;
 		return (-1);
+	}
 
 	return (btf_offsetof_rec(btf, parent_t, member_name, ret_member, 0));
 
 }
 
+/*
+ * Given a struct or union parent_name, find the btf_member{} of member_name.
+ */
+static struct btf_member *
+btf_find_member(struct btf *btf, const char *parent_name, const char *member_name)
+{
+	struct btf_member *member = NULL;
+
+	btf_offsetof(btf, parent_name, member_name, &member);
+
+	return (member);
+}
+
 static s32
 btf_root_offset2(struct btf *btf, const char *dotname)
 {
@@ -292,11 +308,32 @@ btf_enum_value(struct btf *btf, const char *dotname, ssize_t *uv)
 	return (-1);
 }
 
+int
+btf_number_of_params_of_ptr(struct btf *btf, const char *parent_name, const char *name)
+{
+	struct btf_member	*m;
+	const struct btf_type	*t;
+
+	m = btf_find_member(btf, parent_name, name);
+	if (m == NULL)
+		return (-1);
+	t = btf__type_by_id(btf, m->type);
+	if (t == NULL)
+		return (-1);
+	t = btf__type_by_id(btf, t->type);
+	if (t == NULL)
+		return (-1);
+	if (!btf_is_func_proto(t))
+		return (-1);
+
+	return (btf_vlen(t));
+}
+
 int
 btf_number_of_params(struct btf *btf, const char *func)
 {
-	s32 off;
-	const struct btf_type *t;
+	const struct btf_type	*t;
+	s32			 off;
 
 	off = btf__find_by_name_kind(btf, func, BTF_KIND_FUNC);
 	if (off < 0)

elastic-ebpf/GPL/Events/File/Probe.bpf.c

@@ -286,7 +286,8 @@ static int do_filp_open__exit(struct file *f)
         goto out;
 
     fmode_t fmode = BPF_CORE_READ(f, f_mode);
-    if (fmode & (fmode_t)0x100000) { // FMODE_CREATED
+    if ((fmode & (fmode_t)0x100000) ||                                 // FMODE_CREATED
+        (ebpf_events_state__get(EBPF_EVENTS_STATE_FS_CREATE) != NULL)) { // 4.18.x
         // generate a file creation event
         prepare_and_send_file_event(f, EBPF_EVENT_FILE_CREATE, NULL, 0);
     } else {
@@ -330,9 +331,45 @@ static int do_filp_open__exit(struct file *f)
     }
 
 out:
+    ebpf_events_state__del(EBPF_EVENTS_STATE_FS_CREATE);
+
+    return 0;
+}
+
+static int fsnotify__enter(u32 mask)
+{
+    if (mask & 0x100) { // FS_CREATE
+        struct ebpf_events_state state = {};
+        ebpf_events_state__set(EBPF_EVENTS_STATE_FS_CREATE, &state);
+    }
+
     return 0;
 }
 
+SEC("kprobe/fsnotify")
+int BPF_KPROBE(kprobe__fsnotify,
+               struct inode *to_tell,
+               u32 mask,
+               const void *data,
+               int data_is,
+               const unsigned char *file_name,
+               u32 cookie)
+{
+    return fsnotify__enter(mask);
+}
+
+SEC("fentry/fsnotify")
+int BPF_PROG(fentry__fsnotify,
+             struct inode *to_tell,
+             u32 mask,
+             const void *data,
+             int data_is,
+             const unsigned char *file_name,
+             u32 cookie)
+{
+    return fsnotify__enter(mask);
+}
+
 SEC("fexit/do_filp_open")
 int BPF_PROG(fexit__do_filp_open,
              int dfd,

elastic-ebpf/GPL/Events/State.h

@@ -22,6 +22,7 @@ enum ebpf_events_state_op {
     EBPF_EVENTS_STATE_WRITEV         = 8,
     EBPF_EVENTS_STATE_CHOWN          = 9,
     EBPF_EVENTS_STATE_GROUP_DEAD     = 10,
+    EBPF_EVENTS_STATE_FS_CREATE      = 11,
 };
 
 struct ebpf_events_key {
@@ -93,6 +94,7 @@ struct ebpf_events_state {
         struct ebpf_events_writev_state writev;
         struct ebpf_events_chown_state chown;
         /* struct ebpf_events_group_dead group_dead; nada */
+        /* struct ebpf_events_fs_create fs_create; nada */
     };
 };
 

quark.h

@@ -80,6 +80,7 @@ ssize_t			 quark_btf_offset(struct quark_btf *, const char *);
 struct btf;
 s32			btf_root_offset(struct btf *, const char *, int);
 int			btf_number_of_params(struct btf *, const char *);
+int			btf_number_of_params_of_ptr(struct btf *, const char *, const char *);
 int			btf_index_of_param(struct btf *, const char *, const char *);
 
 /* bpf_queue.c */