setuids.bt(8)

📦
version 0.27.0 · 3 versions
  • 0.27.0 · alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
  • 0.14.0 · ubuntu jammy
  • 0.20.2 · ubuntu noble
, in alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, debian trixie, fedora 43, fedora 44, nixos 26.05, nixpkgs unstable, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ setuids.bt(8) — the setuid tracer 💖

Okay so setuids.bt is the manual name for this tool, and it's giving privilege-escalation detective energy 🕵️🎀. It traces setuid-family syscalls and uses bpftrace/eBPF to do it 🔥. Main character energy, honestly.

🌸 NAME

setuids.bt — Trace setuid family of syscalls. Uses bpftrace/eBPF.

🦋 SYNOPSIS

setuids.bt

💅 DESCRIPTION

Okay bestie, this tool traces privilege escalation via setuid syscalls 👀. It's super useful for debugging, whitelist creation, and intrusion detection, so it's lowkey a whole vibe 🔍✨.

It works by tracing the setuid(2), setfsuid(2), and retresuid(2) syscalls using the syscall tracepoints 🧚. Literally those three, no cap.

⚠️ Since this uses BPF, only the root user can use this tool. Not you, not me, not anybody else without root 💀.

📋 REQUIREMENTS

You need CONFIG_BPF and bpftrace 🫶. No shortcuts, periodt.

🍓 EXAMPLES

Trace setuid syscalls:

# setuids.bt

🌈 FIELDS

  • PID — The calling process ID 🆔.
  • COMM — The calling process (thread) name 🧵.
  • UID — The UID of the caller 👤.
  • SYSCALL — The syscall name 📞.
  • ARGS — The arguments to the syscall 🧩.
  • (RET) — The return value for the syscall: 0 means success 🎉, other numbers indicate an error code 🙈.

🫧 OVERHEAD

setuid calls are expected to be low frequency (<< 100/s), so the overhead of this tool is expected to be negligible 😌✨. Chill vibes only.

💜 SOURCE

This tool originated from the book "BPF Performance Tools", published by Addison Wesley (2019) 📚:

http://www.brendangregg.com/bpf-performance-tools-book.html

See the book for more documentation on this tool 🤓.

This version is in the bpftrace repository:

https://github.com/bpftrace/bpftrace

Also look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool 📝🫶.

🖥️ OS

Linux 🐧

🧪 STABILITY

Unstable - in development 🚧. Handle with care, bestie.

👑 AUTHOR

Brendan Gregg 👑💖

🔗 SEE ALSO

capable.bt(8) 🦋

Stay safe, stay root-only, and keep those setuid calls low-key 🌸. Source: setuids.bt, USER COMMANDS manual page, dated 2019-07-05 💅✨

📦 where this page comes from