bpftrace permission

Support for security such as Firewalls and securing linux
Post Reply
jimmauro
Posts: 1
Joined: 2020/02/11 00:06:04

bpftrace permission

Post by jimmauro » 2020/02/11 00:10:39

I used snap to install bpftrace. I get the following errors when attempting to use bpftrace:

# bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }'
Error creating map: '@': Operation not permitted
Error creating printf map: Operation not permitted
Creation of the required BPF maps has failed.
Make sure you have all the required permissions and are not confined (e.g. like
snapcraft does). `dmesg` will likely have useful output for further troubleshooting

Based on my research so far, this looks like kernel lockdown. Kernel version and CentOS release information below.
I seek advice on how to open permission so I can effectively use bpftrace.

Thanks
Jim

# uname -r
4.20.0-1.el7.elrepo.x86_64
# cat /etc/os-release
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
ID_LIKE="rhel fedora"
VERSION_ID="7"
PRETTY_NAME="CentOS Linux 7 (Core)"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:centos:centos:7"
HOME_URL="https://www.centos.org/"
BUG_REPORT_URL="https://bugs.centos.org/"

CENTOS_MANTISBT_PROJECT="CentOS-7"
CENTOS_MANTISBT_PROJECT_VERSION="7"
REDHAT_SUPPORT_PRODUCT="centos"
REDHAT_SUPPORT_PRODUCT_VERSION="7"

User avatar
TrevorH
Site Admin
Posts: 33220
Joined: 2009/09/24 10:40:56
Location: Brighton, UK

Re: bpftrace permission

Post by TrevorH » 2020/02/11 13:38:30

Try it with the distro kernel.
The future appears to be RHEL or Debian. I think I'm going Debian.
Info for USB installs on http://wiki.centos.org/HowTos/InstallFromUSBkey
CentOS 5 and 6 are deadest, do not use them.
Use the FAQ Luke

Post Reply