setuids.bt(8)

📦 version 0.17.0, in debian bookworm

💅 setuids.bt — the manual page, but make it make sense 💅

okay so bestie, you found setuids.bt(8) in the System Manager's Manual section and honestly? iconic choice. this lil baddie traces the whole setuid syscall family, and yes it uses bpftrace/eBPF. let's get into it 🫶

✨ NAME ✨

setuids.bt — traces the setuid family of syscalls. uses bpftrace/eBPF. periodt. 💖

🌸 SYNOPSIS 🌸

setuids.bt

that's it. no flags, no drama, no notes. she just runs. 👑

🦋 DESCRIPTION 🦋

so what does she actually do? she traces privilege escalation via setuid syscalls, which lowkey makes her the main character for debugging, whitelist creation, and intrusion detection. three jobs, one script, no cap. 💅

the way she works is by tracing the setuid(2), setfsuid(2), and retresuid(2) syscalls using the syscall tracepoints. fr fr, that's the whole mechanism.

⚠️ okay important: since this uses BPF, only the root user can use this tool. no root, no vibes. sorry bestie 😭

🎀 REQUIREMENTS 🎀

  • CONFIG_BPF
  • bpftrace

both. you need both. that's the list. ✨

💜 EXAMPLES 💜

trace setuid syscalls — like, the whole point:

# setuids.bt

slay. that's the example. 💖

🍓 FIELDS 🍓

here's the output decoder ring, bestie, learn her:

  • PID — the calling process ID.
  • COMM — the calling process (thread) name.
  • UID — the UID of the caller.
  • SYSCALL — the syscall name.
  • ARGS — the arguments to the syscall
  • (RET) — the return value for the syscall: 0 == success, other numbers indicate an error code.
🫶 note that (RET) is the vibe check: 0 means we ate, anything else means something went wrong.

🌈 OVERHEAD 🌈

setuid calls are expected to be low frequency (<< 100/s), so the overhead of this tool is expected to be negligible. she's lightweight, she's polite, she's not gonna tank your system. 😌✨

⭐ SOURCE ⭐

this tool originated from the book "BPF Performance Tools", published by Addison Wesley (2019):

http://www.brendangregg.com/bpf-performance-tools-book.html

see the book for more documentation on this tool. 📚

this version lives in the bpftrace repository:

https://github.com/iovisor/bpftrace

also look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. it's giving bonus content, we love her. 💖

🐧 OS 🐧

Linux

💀 STABILITY 💀

Unstable — in development. she's growing, she's evolving, be nice to her. 🙈

👑 AUTHOR 👑

Brendan Gregg

🧚 SEE ALSO 🧚

okay and for the cute sign-off: this page comes from the USER COMMANDS manual section and it's dated 2019-07-05. vintage but still serving. 💅🌸 bye bestie, go trace some syscalls 🦋✨

📦 where this page comes from