From a972481db5b3a2fa3100c284f29607accfae2821 Mon Sep 17 00:00:00 2001 From: foxmsft Date: Sat, 15 Aug 2026 17:57:35 +0200 Subject: [PATCH 1/2] Add support for aarch64 --- .container/install-ubuntu-dependencies.sh | 1 - BUILD.md | 45 +++++ CMakeLists.txt | 196 +++++++++++++++++----- cmake/aarch64-linux-gnu.cmake | 20 +++ ebpfKern/sysmonEBPF_common.h | 4 +- ebpfKern/sysmonFileCreate_rawtp.c | 5 +- ebpfKern/sysmonFileDelete_rawtp.c | 5 +- ebpfKern/sysmonFileOpen.c | 5 +- ebpfKern/sysmonFileOpen_rawtp.c | 5 +- ebpfKern/sysmonProcCreate.c | 3 - linuxTypes.h | 3 +- makePackages.sh | 14 +- package/DEBIAN.in/control.in | 5 +- sysmonforlinux.c | 21 ++- 14 files changed, 268 insertions(+), 64 deletions(-) create mode 100644 cmake/aarch64-linux-gnu.cmake diff --git a/.container/install-ubuntu-dependencies.sh b/.container/install-ubuntu-dependencies.sh index 3e62ce3..1b5c01d 100644 --- a/.container/install-ubuntu-dependencies.sh +++ b/.container/install-ubuntu-dependencies.sh @@ -23,7 +23,6 @@ sudo apt-get install -y --no-install-recommends \ clang \ libzstd1 \ libgtest-dev \ - libc6-dev-i386 \ apt-transport-https \ dirmngr \ googletest \ diff --git a/BUILD.md b/BUILD.md index 28703d5..ade8592 100644 --- a/BUILD.md +++ b/BUILD.md @@ -78,6 +78,51 @@ cmake .. make ``` +## Cross-build for aarch64 on Ubuntu + +First cross-build and stage SysinternalsEBPF as described in its `BUILD.md`. +The commands below assume its staged installation is in +`../SysinternalsEBPF/build-arm64/staging`. + +Install the cross compiler and target development libraries: + +```shell +sudo dpkg --add-architecture arm64 +sudo apt update +sudo apt install crossbuild-essential-arm64 binutils-aarch64-linux-gnu \ + libc6-dev-arm64-cross linux-libc-dev-arm64-cross \ + libelf-dev:arm64 zlib1g-dev:arm64 libzstd-dev:arm64 \ + libjson-glib-dev:arm64 libgtest-dev:arm64 libgmock-dev:arm64 +``` + +Build the eBPF size checker for the build host. It inspects architecture-neutral +eBPF objects during the cross-build and avoids executing aarch64 programs on +the build host: + +```shell +cmake -S . -B build-host +cmake --build build-host --target checkEBPFsizes +``` + +Configure and build the aarch64 targets: + +```shell +EBPF_STAGE="$(realpath ../SysinternalsEBPF/build-arm64/staging)" + +cmake -S . -B build-arm64 \ + -DCMAKE_TOOLCHAIN_FILE=cmake/aarch64-linux-gnu.cmake \ + -DOPENSSL_CROSS_COMPILE=aarch64-linux-gnu- \ + -DSYSINTERNALS_EBPF_ROOT="$EBPF_STAGE/opt/sysinternalsEBPF" \ + -DSYSINTERNALS_EBPF_INCLUDE_DIR="$EBPF_STAGE/usr/local/include" \ + -DSYSINTERNALS_EBPF_LIBRARY="$EBPF_STAGE/usr/local/lib/libsysinternalsEBPF.so" \ + -DSYSMON_HOST_CHECK_EBPF_SIZES="$PWD/build-host/checkEBPFsizes" +cmake --build build-arm64 --parallel +``` + +The resulting `sysmon`, `sysmonLogView`, `sysmonUnitTests`, and +`checkEBPFsizes` executables target aarch64. Run those executables and all +runtime tests on an aarch64 Linux host; QEMU is not required. + ## Test ``` ./sysmonUnitTests diff --git a/CMakeLists.txt b/CMakeLists.txt index 1fd557e..87ed314 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -59,6 +59,66 @@ if ("${PROJECT_VERSION_TWEAK}" STREQUAL "") set(PROJECT_VERSION_TWEAK 0) endif() +if(CMAKE_SYSTEM_PROCESSOR MATCHES "^(aarch64|arm64)$") + set(SYSMON_TARGET_ARCH "aarch64") + set(BPF_TARGET_ARCH "arm64") + set(DEB_ARCH "arm64") + set(RPM_ARCH "aarch64") + set(OPENSSL_TARGET "linux-aarch64") +elseif(CMAKE_SYSTEM_PROCESSOR MATCHES "^(x86_64|amd64|AMD64)$") + set(SYSMON_TARGET_ARCH "x86_64") + set(BPF_TARGET_ARCH "x86") + set(DEB_ARCH "amd64") + set(RPM_ARCH "x86_64") + set(OPENSSL_TARGET "linux-x86_64") +else() + message(FATAL_ERROR "Unsupported target architecture: ${CMAKE_SYSTEM_PROCESSOR}") +endif() + +execute_process( + COMMAND "${CMAKE_C_COMPILER}" -print-multiarch + OUTPUT_VARIABLE TARGET_MULTIARCH + OUTPUT_STRIP_TRAILING_WHITESPACE + RESULT_VARIABLE TARGET_MULTIARCH_RESULT +) +if(NOT TARGET_MULTIARCH_RESULT EQUAL 0 OR NOT TARGET_MULTIARCH) + message(FATAL_ERROR "Failed to determine the target multiarch tuple") +endif() +execute_process( + COMMAND "${CMAKE_C_COMPILER}" -print-file-name=include + OUTPUT_VARIABLE TARGET_COMPILER_INCLUDE + OUTPUT_STRIP_TRAILING_WHITESPACE + RESULT_VARIABLE TARGET_COMPILER_INCLUDE_RESULT +) +if(NOT TARGET_COMPILER_INCLUDE_RESULT EQUAL 0 OR + NOT TARGET_COMPILER_INCLUDE OR + TARGET_COMPILER_INCLUDE STREQUAL "include") + message(FATAL_ERROR "Failed to determine the target compiler include directory") +endif() +set(TARGET_MULTIARCH_INCLUDE "/usr/include/${TARGET_MULTIARCH}") + +set(SYSINTERNALS_EBPF_ROOT "/opt/sysinternalsEBPF" CACHE PATH + "Path containing the target SysinternalsEBPF eBPF resources") +set(SYSINTERNALS_EBPF_INCLUDE_DIR "/usr/local/include" CACHE PATH + "Path containing the target libsysinternalsEBPF.h") +set(SYSINTERNALS_EBPF_LIBRARY "" CACHE FILEPATH + "Target libsysinternalsEBPF shared library") + +if(NOT SYSINTERNALS_EBPF_LIBRARY) + find_library(DETECTED_SYSINTERNALS_EBPF_LIBRARY + NAMES sysinternalsEBPF + PATHS /usr/local/lib /usr/lib + ) + if(NOT DETECTED_SYSINTERNALS_EBPF_LIBRARY) + message(FATAL_ERROR + "libsysinternalsEBPF was not found; set SYSINTERNALS_EBPF_LIBRARY") + endif() + set(SYSINTERNALS_EBPF_LIBRARY "${DETECTED_SYSINTERNALS_EBPF_LIBRARY}") +endif() + +set(SYSINTERNALS_EBPF_KERN_DIR "${SYSINTERNALS_EBPF_ROOT}/ebpfKern") +set(SYSINTERNALS_EBPF_LIBBPF_DIR "${SYSINTERNALS_EBPF_ROOT}/libbpf") + configure_file(linuxVersion.h.in linuxVersion.h) configure_file(package/DEBIAN.in/control.in DEBIANcontrol) configure_file(package/SPECS.in/spec.in SPECS.spec) @@ -74,7 +134,7 @@ configure_file(package/SPECS.in/spec.in SPECS.spec) # set(TEXTTRANSFORM "$ENV{HOME}/.dotnet/tools/t4") set(ICONV "/usr/bin/iconv") -set(LD "/usr/bin/ld") +set(LD "${CMAKE_LINKER}") # # package name @@ -138,15 +198,32 @@ add_custom_command(OUTPUT ${PROJECT_BINARY_DIR}/${SYSMON_COMPRESS_MAN} include(ExternalProject) -# Get and build openSSL. +# Get and build OpenSSL. # When you update the GIT tag please make sure to delete the build # directory before building again. +set(OPENSSL_CROSS_COMPILE "" CACHE STRING + "OpenSSL cross-compiler prefix, for example aarch64-linux-gnu-") + +if(CMAKE_CROSSCOMPILING) + if(NOT OPENSSL_CROSS_COMPILE) + message(FATAL_ERROR + "OPENSSL_CROSS_COMPILE must be set when cross-compiling") + endif() + set(OPENSSL_CONFIGURE_COMMAND + "${CMAKE_COMMAND}" -E env + "CROSS_COMPILE=${OPENSSL_CROSS_COMPILE}" + /Configure "${OPENSSL_TARGET}") +else() + set(OPENSSL_CONFIGURE_COMMAND /Configure "${OPENSSL_TARGET}") +endif() + ExternalProject_Add(openssl GIT_REPOSITORY https://github.com/openssl/openssl.git GIT_TAG openssl-3.6.2 PREFIX ./openssl - CONFIGURE_COMMAND cd ../openssl && ./Configure - BUILD_COMMAND cd ../openssl && make && rm -rf ${PROJECT_BINARY_DIR}/openssl/src/openssl/cloudflare-quiche && rm -rf ${PROJECT_BINARY_DIR}/openssl/src/openssl/pyca-cryptography + BUILD_IN_SOURCE TRUE + CONFIGURE_COMMAND ${OPENSSL_CONFIGURE_COMMAND} + BUILD_COMMAND "${CMAKE_MAKE_PROGRAM}" INSTALL_COMMAND "" UPDATE_COMMAND "" ) @@ -214,24 +291,40 @@ target_include_directories(sysmon PUBLIC "${SYSMON_COMMON_SOURCE_DIR}" "${PROJECT_BINARY_DIR}" "/usr/include" - "/usr/local/include" + "${TARGET_MULTIARCH_INCLUDE}" + "${SYSINTERNALS_EBPF_INCLUDE_DIR}" "${PUGIXML_SOURCE_DIR}" - "/opt/sysinternalsEBPF/ebpfKern" + "${SYSINTERNALS_EBPF_KERN_DIR}" + "${openssl_SOURCE_DIR}/include" ) add_custom_target(deb - COMMAND "${CMAKE_SOURCE_DIR}/makePackages.sh" "${CMAKE_SOURCE_DIR}" "${PROJECT_BINARY_DIR}" "${PACKAGE_NAME}" "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}" "0" "deb" + COMMAND "${CMAKE_SOURCE_DIR}/makePackages.sh" "${CMAKE_SOURCE_DIR}" "${PROJECT_BINARY_DIR}" "${PACKAGE_NAME}" "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}" "0" "deb" "${DEB_ARCH}" "${RPM_ARCH}" DEPENDS "${CMAKE_SOURCE_DIR}/package" "${PROJECT_BINARY_DIR}/sysmon" ) add_custom_target(rpm - COMMAND "${CMAKE_SOURCE_DIR}/makePackages.sh" "${CMAKE_SOURCE_DIR}" "${PROJECT_BINARY_DIR}" "${PACKAGE_NAME}" "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}" "0" "rpm" + COMMAND "${CMAKE_SOURCE_DIR}/makePackages.sh" "${CMAKE_SOURCE_DIR}" "${PROJECT_BINARY_DIR}" "${PACKAGE_NAME}" "${PROJECT_VERSION_MAJOR}.${PROJECT_VERSION_MINOR}.${PROJECT_VERSION_PATCH}" "0" "rpm" "${DEB_ARCH}" "${RPM_ARCH}" DEPENDS "${CMAKE_SOURCE_DIR}/package" "${PROJECT_BINARY_DIR}/sysmon" ) add_dependencies(sysmon openssl) +set(SYSMON_HOST_CHECK_EBPF_SIZES "" CACHE FILEPATH + "Native checkEBPFsizes executable to use while cross-compiling") +if(CMAKE_CROSSCOMPILING) + if(NOT EXISTS "${SYSMON_HOST_CHECK_EBPF_SIZES}") + message(FATAL_ERROR + "Set SYSMON_HOST_CHECK_EBPF_SIZES to a native executable") + endif() + set(CHECK_EBPF_SIZES "${SYSMON_HOST_CHECK_EBPF_SIZES}") + set(CHECK_EBPF_SIZES_DEPENDS "${SYSMON_HOST_CHECK_EBPF_SIZES}") +else() + set(CHECK_EBPF_SIZES "$") + set(CHECK_EBPF_SIZES_DEPENDS checkEBPFsizes) +endif() + # list of ebpf programs to make set(EBPF_PROGS sysmonEBPFkern4.15 @@ -243,75 +336,75 @@ set(EBPF_PROGS ) add_custom_command(OUTPUT sysmonEBPFkern4.15.rep - COMMAND "${CMAKE_BINARY_DIR}/checkEBPFsizes" sysmonEBPFkern4.15.o 4096 && touch sysmonEBPFkern4.15.rep + COMMAND "${CHECK_EBPF_SIZES}" sysmonEBPFkern4.15.o 4096 && touch sysmonEBPFkern4.15.rep COMMENT "Checking sysmonEBPFkern4.15.o" - DEPENDS checkEBPFsizes sysmonEBPFkern4.15.o + DEPENDS ${CHECK_EBPF_SIZES_DEPENDS} sysmonEBPFkern4.15.o ) add_custom_command(OUTPUT sysmonEBPFkern4.16.rep - COMMAND "${CMAKE_BINARY_DIR}/checkEBPFsizes" sysmonEBPFkern4.16.o 4096 && touch sysmonEBPFkern4.16.rep + COMMAND "${CHECK_EBPF_SIZES}" sysmonEBPFkern4.16.o 4096 && touch sysmonEBPFkern4.16.rep COMMENT "Checking sysmonEBPFkern4.16.o" - DEPENDS checkEBPFsizes sysmonEBPFkern4.16.o + DEPENDS ${CHECK_EBPF_SIZES_DEPENDS} sysmonEBPFkern4.16.o ) add_custom_command(OUTPUT sysmonEBPFkern4.17-5.1.rep - COMMAND "${CMAKE_BINARY_DIR}/checkEBPFsizes" sysmonEBPFkern4.17-5.1.o 4096 && touch sysmonEBPFkern4.17-5.1.rep + COMMAND "${CHECK_EBPF_SIZES}" sysmonEBPFkern4.17-5.1.o 4096 && touch sysmonEBPFkern4.17-5.1.rep COMMENT "Checking sysmonEBPFkern4.17-5.1.o" - DEPENDS checkEBPFsizes sysmonEBPFkern4.17-5.1.o + DEPENDS ${CHECK_EBPF_SIZES_DEPENDS} sysmonEBPFkern4.17-5.1.o ) add_custom_command(OUTPUT sysmonEBPFkern5.2.rep - COMMAND "${CMAKE_BINARY_DIR}/checkEBPFsizes" sysmonEBPFkern5.2.o 32768 && touch sysmonEBPFkern5.2.rep + COMMAND "${CHECK_EBPF_SIZES}" sysmonEBPFkern5.2.o 32768 && touch sysmonEBPFkern5.2.rep COMMENT "Checking sysmonEBPFkern5.2.o" - DEPENDS checkEBPFsizes sysmonEBPFkern5.2.o + DEPENDS ${CHECK_EBPF_SIZES_DEPENDS} sysmonEBPFkern5.2.o ) add_custom_command(OUTPUT sysmonEBPFkern5.3-5.5.rep - COMMAND "${CMAKE_BINARY_DIR}/checkEBPFsizes" sysmonEBPFkern5.3-5.5.o 32768 && touch sysmonEBPFkern5.3-5.5.rep + COMMAND "${CHECK_EBPF_SIZES}" sysmonEBPFkern5.3-5.5.o 32768 && touch sysmonEBPFkern5.3-5.5.rep COMMENT "Checking sysmonEBPFkern5.3-5.5.o" - DEPENDS checkEBPFsizes sysmonEBPFkern5.3-5.5.o + DEPENDS ${CHECK_EBPF_SIZES_DEPENDS} sysmonEBPFkern5.3-5.5.o ) add_custom_command(OUTPUT sysmonEBPFkern5.6-.rep - COMMAND "${CMAKE_BINARY_DIR}/checkEBPFsizes" sysmonEBPFkern5.6-.o 32768 && touch sysmonEBPFkern5.6-.rep + COMMAND "${CHECK_EBPF_SIZES}" sysmonEBPFkern5.6-.o 32768 && touch sysmonEBPFkern5.6-.rep COMMENT "Checking sysmonEBPFkern5.6-.o" - DEPENDS checkEBPFsizes sysmonEBPFkern5.6-.o + DEPENDS ${CHECK_EBPF_SIZES_DEPENDS} sysmonEBPFkern5.6-.o ) add_custom_command(OUTPUT sysmonEBPFkern4.15_core.rep - COMMAND "${CMAKE_BINARY_DIR}/checkEBPFsizes" sysmonEBPFkern4.15_core.o 4096 touch sysmonEBPFkern4.15_core.rep + COMMAND "${CHECK_EBPF_SIZES}" sysmonEBPFkern4.15_core.o 4096 && touch sysmonEBPFkern4.15_core.rep COMMENT "Checking sysmonEBPFkern4.15_core.o" - DEPENDS checkEBPFsizes sysmonEBPFkern4.15_core.o + DEPENDS ${CHECK_EBPF_SIZES_DEPENDS} sysmonEBPFkern4.15_core.o ) add_custom_command(OUTPUT sysmonEBPFkern4.16_core.rep - COMMAND "${CMAKE_BINARY_DIR}/checkEBPFsizes" sysmonEBPFkern4.16_core.o 4096 && touch sysmonEBPFkern4.16_core.rep + COMMAND "${CHECK_EBPF_SIZES}" sysmonEBPFkern4.16_core.o 4096 && touch sysmonEBPFkern4.16_core.rep COMMENT "Checking sysmonEBPFkern4.16_core.o" - DEPENDS checkEBPFsizes sysmonEBPFkern4.16_core.o + DEPENDS ${CHECK_EBPF_SIZES_DEPENDS} sysmonEBPFkern4.16_core.o ) add_custom_command(OUTPUT sysmonEBPFkern4.17-5.1_core.rep - COMMAND "${CMAKE_BINARY_DIR}/checkEBPFsizes" sysmonEBPFkern4.17-5.1_core.o 4096 && touch sysmonEBPFkern4.17-5.1_core.rep + COMMAND "${CHECK_EBPF_SIZES}" sysmonEBPFkern4.17-5.1_core.o 4096 && touch sysmonEBPFkern4.17-5.1_core.rep COMMENT "Checking sysmonEBPFkern4.17-5.1_core.o" - DEPENDS checkEBPFsizes sysmonEBPFkern4.17-5.1_core.o + DEPENDS ${CHECK_EBPF_SIZES_DEPENDS} sysmonEBPFkern4.17-5.1_core.o ) add_custom_command(OUTPUT sysmonEBPFkern5.2_core.rep - COMMAND "${CMAKE_BINARY_DIR}/checkEBPFsizes" sysmonEBPFkern5.2_core.o 32768 && touch sysmonEBPFkern5.2_core.rep + COMMAND "${CHECK_EBPF_SIZES}" sysmonEBPFkern5.2_core.o 32768 && touch sysmonEBPFkern5.2_core.rep COMMENT "Checking sysmonEBPFkern5.2_core.o" - DEPENDS checkEBPFsizes sysmonEBPFkern5.2_core.o + DEPENDS ${CHECK_EBPF_SIZES_DEPENDS} sysmonEBPFkern5.2_core.o ) add_custom_command(OUTPUT sysmonEBPFkern5.3-5.5_core.rep - COMMAND "${CMAKE_BINARY_DIR}/checkEBPFsizes" sysmonEBPFkern5.3-5.5_core.o 32768 && touch sysmonEBPFkern5.3-5.5_core.rep + COMMAND "${CHECK_EBPF_SIZES}" sysmonEBPFkern5.3-5.5_core.o 32768 && touch sysmonEBPFkern5.3-5.5_core.rep COMMENT "Checking sysmonEBPFkern5.3-5.5_core.o" - DEPENDS checkEBPFsizes sysmonEBPFkern5.3-5.5_core.o + DEPENDS ${CHECK_EBPF_SIZES_DEPENDS} sysmonEBPFkern5.3-5.5_core.o ) add_custom_command(OUTPUT sysmonEBPFkern5.6-_core.rep - COMMAND "${CMAKE_BINARY_DIR}/checkEBPFsizes" sysmonEBPFkern5.6-_core.o 32768 && touch sysmonEBPFkern5.6-_core.rep + COMMAND "${CHECK_EBPF_SIZES}" sysmonEBPFkern5.6-_core.o 32768 && touch sysmonEBPFkern5.6-_core.rep COMMENT "Checking sysmonEBPFkern5.6-_core.o" - DEPENDS checkEBPFsizes sysmonEBPFkern5.6-_core.o + DEPENDS ${CHECK_EBPF_SIZES_DEPENDS} sysmonEBPFkern5.6-_core.o ) # list of files the EBPF programs depend upon @@ -319,10 +412,10 @@ set(EBPF_DEPENDS sysmon_defs.h linuxTypes.h "${SYSMON_COMMON_SOURCE_DIR}/ioctlcmd.h" - /opt/sysinternalsEBPF/ebpfKern/sysinternalsEBPF_helpers.c - /opt/sysinternalsEBPF/ebpfKern/sysinternalsEBPF_common.h - /opt/sysinternalsEBPF/ebpfKern/sysinternalsEBPFoffsets.h - /opt/sysinternalsEBPF/ebpfKern/sysinternalsEBPFshared.h + "${SYSINTERNALS_EBPF_KERN_DIR}/sysinternalsEBPF_helpers.c" + "${SYSINTERNALS_EBPF_KERN_DIR}/sysinternalsEBPF_common.h" + "${SYSINTERNALS_EBPF_KERN_DIR}/sysinternalsEBPFoffsets.h" + "${SYSINTERNALS_EBPF_KERN_DIR}/sysinternalsEBPFshared.h" ebpfKern/sysmonEBPF_common.h ebpfKern/sysmonGenericEntry_tp.c ebpfKern/sysmonGenericEntry_rawtp.c @@ -372,7 +465,7 @@ set(EBPF_DEPENDS # # link sysmon # -target_link_libraries(sysmon sysinternalsEBPF pthread ${openssl_SOURCE_DIR}/libcrypto.a ${CMAKE_DL_LIBS} ) +target_link_libraries(sysmon "${SYSINTERNALS_EBPF_LIBRARY}" pthread ${openssl_SOURCE_DIR}/libcrypto.a ${CMAKE_DL_LIBS} ) # @@ -393,6 +486,7 @@ target_include_directories(sysmonLogView PUBLIC "${SYSMON_COMMON_SOURCE_DIR}" "${PROJECT_BINARY_DIR}" "/usr/include" + "${TARGET_MULTIARCH_INCLUDE}" "${PUGIXML_SOURCE_DIR}" ) @@ -408,9 +502,11 @@ add_executable(checkEBPFsizes target_include_directories(checkEBPFsizes PUBLIC "/usr/include" + "${TARGET_MULTIARCH_INCLUDE}" + "${SYSINTERNALS_EBPF_INCLUDE_DIR}" ) -target_link_libraries(checkEBPFsizes sysinternalsEBPF) +target_link_libraries(checkEBPFsizes "${SYSINTERNALS_EBPF_LIBRARY}") # # GTest required for unit tests @@ -445,14 +541,17 @@ add_executable(sysmonUnitTests ) target_link_libraries(sysmonUnitTests ${GTEST_LIBRARIES} pthread ${openssl_SOURCE_DIR}/libcrypto.a ${CMAKE_DL_LIBS}) +add_dependencies(sysmonUnitTests openssl) target_include_directories(sysmonUnitTests PUBLIC "${CMAKE_SOURCE_DIR}" "${SYSMON_COMMON_SOURCE_DIR}" "${SYSMON_TESTS_SOURCE_DIR}" "${PROJECT_BINARY_DIR}" "/usr/include" + "${TARGET_MULTIARCH_INCLUDE}" "${PUGIXML_SOURCE_DIR}" "${GTEST_INCLUDE_DIRS}" + "${openssl_SOURCE_DIR}/include" ) # @@ -603,7 +702,10 @@ endif() file(WRITE "${PROJECT_BINARY_DIR}/previous_cmake_file_hash.txt" "${CMAKE_FILE_HASH}") # set binaries and options for clang and llc -set(CLANG "clang") +find_program(CLANG clang) +if(NOT CLANG) + message(FATAL_ERROR "clang is required to build eBPF programs") +endif() set(LLC "llc") set(CLANG_OPTIONS -Wno-unused-value -Wno-pointer-sign @@ -616,7 +718,7 @@ set(CLANG_OPTIONS -Wno-unused-value ) set(CLANG_DEFINES -D __KERNEL__ -D __BPF_TRACING__ - -D __TARGET_ARCH_x86 + -D "__TARGET_ARCH_${BPF_TARGET_ARCH}" -D __linux__ ) if (DEBUG_K) @@ -628,10 +730,9 @@ set(CLANG_INCLUDES -I "${CMAKE_SOURCE_DIR}/gnu" -I "${CMAKE_SOURCE_DIR}" -I "${SYSMON_COMMON_SOURCE_DIR}" - -I "/opt/sysinternalsEBPF/ebpfKern" - -I "/opt/sysinternalsEBPF/libbpf" + -I "${SYSINTERNALS_EBPF_KERN_DIR}" + -I "${SYSINTERNALS_EBPF_LIBBPF_DIR}" -I "${CMAKE_BINARY_DIR}" - -I "${libbpf_SOURCE_DIR}/src" ) set(EBPF_CORE_PROG_SUFFIX "_core") @@ -645,7 +746,14 @@ set(EBPF_CORE_PROG_SUFFIX "_core") # function to make ebpf programs function(build_ebpf ebpfsrc suffix) add_custom_command(OUTPUT ${ebpfsrc}${suffix}.o - COMMAND "${CLANG}" -nostdinc ${CLANG_INCLUDES} -isystem "/usr/include" -isystem "/usr/include/x86_64-linux-gnu" -isystem `gcc -print-file-name=include` ${CLANG_DEFINES} -O2 ${CLANG_OPTIONS} -target bpf -fno-stack-protector -c "${CMAKE_SOURCE_DIR}/ebpfKern/${ebpfsrc}.c" -o "${ebpfsrc}${suffix}.o" + COMMAND "${CLANG}" -nostdinc ${CLANG_INCLUDES} + -isystem "${TARGET_MULTIARCH_INCLUDE}" + -isystem "/usr/include" + -isystem "${TARGET_COMPILER_INCLUDE}" + ${CLANG_DEFINES} -O2 ${CLANG_OPTIONS} + -target bpf -fno-stack-protector + -c "${CMAKE_SOURCE_DIR}/ebpfKern/${ebpfsrc}.c" + -o "${ebpfsrc}${suffix}.o" COMMENT "Building EBPF object ${ebpfsrc}${suffix}.o" DEPENDS ebpfKern/${ebpfsrc}.c ${EBPF_DEPENDS} ) diff --git a/cmake/aarch64-linux-gnu.cmake b/cmake/aarch64-linux-gnu.cmake new file mode 100644 index 0000000..7a20fb3 --- /dev/null +++ b/cmake/aarch64-linux-gnu.cmake @@ -0,0 +1,20 @@ +set(CMAKE_SYSTEM_NAME Linux) +set(CMAKE_SYSTEM_PROCESSOR aarch64) + +set(CMAKE_C_COMPILER aarch64-linux-gnu-gcc) +set(CMAKE_CXX_COMPILER aarch64-linux-gnu-g++) +set(CMAKE_AR aarch64-linux-gnu-ar) +set(CMAKE_LINKER aarch64-linux-gnu-ld) +set(CMAKE_NM aarch64-linux-gnu-nm) +set(CMAKE_OBJCOPY aarch64-linux-gnu-objcopy) +set(CMAKE_OBJDUMP aarch64-linux-gnu-objdump) +set(CMAKE_RANLIB aarch64-linux-gnu-ranlib) +set(CMAKE_STRIP aarch64-linux-gnu-strip) + +set(CMAKE_FIND_ROOT_PATH_MODE_PROGRAM NEVER) +set(CMAKE_FIND_ROOT_PATH_MODE_LIBRARY BOTH) +set(CMAKE_FIND_ROOT_PATH_MODE_INCLUDE BOTH) +set(CMAKE_FIND_ROOT_PATH_MODE_PACKAGE BOTH) + +set(ENV{PKG_CONFIG_LIBDIR} + "/usr/lib/aarch64-linux-gnu/pkgconfig:/usr/share/pkgconfig") diff --git a/ebpfKern/sysmonEBPF_common.h b/ebpfKern/sysmonEBPF_common.h index db96cf0..267f450 100644 --- a/ebpfKern/sysmonEBPF_common.h +++ b/ebpfKern/sysmonEBPF_common.h @@ -49,10 +49,12 @@ #endif #include +#ifndef EBPF_CO_RE #include +#endif #include #include -#include +#include #include #include "sysmon_defs.h" diff --git a/ebpfKern/sysmonFileCreate_rawtp.c b/ebpfKern/sysmonFileCreate_rawtp.c index b15b1c3..44f7388 100644 --- a/ebpfKern/sysmonFileCreate_rawtp.c +++ b/ebpfKern/sysmonFileCreate_rawtp.c @@ -42,9 +42,13 @@ int FileCreateRawExit(struct bpf_our_raw_tracepoint_args *ctx) } // only handle file creation events +#ifdef __NR_creat if (eventArgs->syscallId != __NR_creat) { return 0; } +#else + return 0; +#endif // set the return code if (bpf_probe_read(&eventArgs->returnCode, sizeof(int64_t), (void *)&SYSCALL_PT_REGS_RC(regs)) != 0){ @@ -66,4 +70,3 @@ int FileCreateRawExit(struct bpf_our_raw_tracepoint_args *ctx) return 0; } - diff --git a/ebpfKern/sysmonFileDelete_rawtp.c b/ebpfKern/sysmonFileDelete_rawtp.c index ff61f9a..b566fe4 100644 --- a/ebpfKern/sysmonFileDelete_rawtp.c +++ b/ebpfKern/sysmonFileDelete_rawtp.c @@ -41,9 +41,13 @@ int FileDeleteRawExit(struct bpf_our_raw_tracepoint_args *ctx) return 0; // only handle unlink events +#ifdef __NR_unlink if (eventArgs->syscallId != __NR_unlink) { return 0; } +#else + return 0; +#endif // set the return code if (bpf_probe_read(&eventArgs->returnCode, sizeof(int64_t), (void *)&SYSCALL_PT_REGS_RC(regs)) != 0){ @@ -64,4 +68,3 @@ int FileDeleteRawExit(struct bpf_our_raw_tracepoint_args *ctx) return 0; } - diff --git a/ebpfKern/sysmonFileOpen.c b/ebpfKern/sysmonFileOpen.c index 643035a..9d92368 100644 --- a/ebpfKern/sysmonFileOpen.c +++ b/ebpfKern/sysmonFileOpen.c @@ -78,11 +78,15 @@ static inline char* set_FileOpen_info( // store event time in nanoseconds for comparison eventTimeNs = bpf_ktime_get_ns() + config->bootNsSinceEpoch; +#ifdef __NR_open if (eventArgs->syscallId == __NR_open) { event->m_Flags = (uint32_t)eventArgs->a[1]; } else { event->m_Flags = (uint32_t)eventArgs->a[2]; } +#else + event->m_Flags = (uint32_t)eventArgs->a[2]; +#endif ptr = (char *)(event + 1); memset(event->m_Extensions, 0, sizeof(event->m_Extensions)); @@ -211,4 +215,3 @@ static inline char* set_FileOpen_info( return (char *)eventHdr; } } - diff --git a/ebpfKern/sysmonFileOpen_rawtp.c b/ebpfKern/sysmonFileOpen_rawtp.c index cff7333..be0bd6a 100644 --- a/ebpfKern/sysmonFileOpen_rawtp.c +++ b/ebpfKern/sysmonFileOpen_rawtp.c @@ -41,7 +41,11 @@ int FileOpenRawExit(struct bpf_our_raw_tracepoint_args *ctx) return 0; // only handle open and openat events +#ifdef __NR_open if (eventArgs->syscallId != __NR_open && eventArgs->syscallId != __NR_openat) { +#else + if (eventArgs->syscallId != __NR_openat) { +#endif return 0; } @@ -64,4 +68,3 @@ int FileOpenRawExit(struct bpf_our_raw_tracepoint_args *ctx) return 0; } - diff --git a/ebpfKern/sysmonProcCreate.c b/ebpfKern/sysmonProcCreate.c index b9664f1..fa30bbe 100644 --- a/ebpfKern/sysmonProcCreate.c +++ b/ebpfKern/sysmonProcCreate.c @@ -28,8 +28,6 @@ // //==================================================================== -#include - __attribute__((always_inline)) static inline char* set_process_ext( PSYSMON_PROCESS_CREATE event, @@ -191,4 +189,3 @@ static inline char* set_ProcCreate_info( return set_process_ext(event, config, task); } - diff --git a/linuxTypes.h b/linuxTypes.h index 1319aa4..28d467a 100644 --- a/linuxTypes.h +++ b/linuxTypes.h @@ -25,7 +25,9 @@ #pragma once #include +#ifndef EBPF_CO_RE #include +#endif #include #include #include @@ -616,4 +618,3 @@ typedef struct { - diff --git a/makePackages.sh b/makePackages.sh index 05b1499..523fbfc 100755 --- a/makePackages.sh +++ b/makePackages.sh @@ -25,8 +25,8 @@ ################################################################################# -if [ "$5" = "" ]; then - echo "Usage: $0 " +if [ "$8" = "" ]; then + echo "Usage: $0 " exit 1 fi @@ -37,8 +37,10 @@ PACKAGE_NAME=$3 PACKAGE_VER=$4 PACKAGE_REL=$5 PACKAGE_TYPE=$6 +DEB_ARCH=$7 +RPM_ARCH=$8 -DEB_PACKAGE_NAME="${PACKAGE_NAME}_${PACKAGE_VER}_amd64" +DEB_PACKAGE_NAME="${PACKAGE_NAME}_${PACKAGE_VER}_${DEB_ARCH}" RPM_PACKAGE_NAME="${PACKAGE_NAME}-${PACKAGE_VER}-${PACKAGE_REL}" if [ "$PACKAGE_TYPE" = "deb" ]; then @@ -68,7 +70,7 @@ if [ "$PACKAGE_TYPE" = "deb" ]; then RET=1 fi - exit 0 + exit $RET fi if [ "$PACKAGE_TYPE" = "rpm" ]; then @@ -87,9 +89,9 @@ if [ "$PACKAGE_TYPE" = "rpm" ]; then # make the rpm if [ "$RPMBUILD" != "" ]; then cd "${PROJECT_BINARY_DIR}/rpm/${RPM_PACKAGE_NAME}" - "$RPMBUILD" --define "_topdir `pwd`" -v -bb "SPECS/${RPM_PACKAGE_NAME}.spec" + "$RPMBUILD" --target "${RPM_ARCH}" --define "_topdir `pwd`" -v -bb "SPECS/${RPM_PACKAGE_NAME}.spec" RET=$? - cp RPMS/x86_64/*.rpm .. + cp "RPMS/${RPM_ARCH}/"*.rpm .. else echo "No rpmbuild found" RET=1 diff --git a/package/DEBIAN.in/control.in b/package/DEBIAN.in/control.in index da5235f..5be65a6 100644 --- a/package/DEBIAN.in/control.in +++ b/package/DEBIAN.in/control.in @@ -1,8 +1,7 @@ Package: sysmonforlinux Version: @PROJECT_VERSION_MAJOR@.@PROJECT_VERSION_MINOR@.@PROJECT_VERSION_PATCH@ -Architecture: amd64 +Architecture: @DEB_ARCH@ Maintainer: Sysinternals Description: A system monitor based on eBPF, ported from Windows, that outputs events to Syslog -Depends: libc6 (>= 2.14), libgcc1 (>= 1:3.0), libstdc++6 (>= 5), libssl-dev, sysinternalsebpf (>= 1.6.0) +Depends: libc6 (>= 2.14), libgcc-s1 | libgcc1, libstdc++6 (>= 5), sysinternalsebpf (>= 1.6.0) Installed-Size: 58934 - diff --git a/sysmonforlinux.c b/sysmonforlinux.c index 46207f6..6e46670 100644 --- a/sysmonforlinux.c +++ b/sysmonforlinux.c @@ -101,10 +101,16 @@ const ebpfSyscallTPprog TPenterProgs[] = const ebpfSyscallTPprog TPexitProgs[] = { {__NR_execve, "ProcCreateExit"}, {__NR_execveat, "ProcCreateExit"}, +#ifdef __NR_creat {__NR_creat, "FileCreateExit"}, +#endif +#ifdef __NR_open {__NR_open, "FileOpenExit"}, +#endif {__NR_openat, "FileOpenExit"}, +#ifdef __NR_unlink {__NR_unlink, "FileDeleteExit"}, +#endif {__NR_unlinkat, "FileDeleteAtExit"}, {__NR_unlinkat, "FileDeleteAtCwdExit"}, {__NR_accept, "TCPacceptExit"}, @@ -127,12 +133,18 @@ const ebpfSyscallRTPprog RTPexitProgs[] = { {"ProcCreateRawExit", __NR_execve}, {"ProcCreateRawExit", __NR_execveat}, +#ifdef __NR_creat {"FileCreateRawExit", __NR_creat}, +#endif +#ifdef __NR_open {"FileOpenRawExit", __NR_open}, +#endif {"FileOpenRawExit", __NR_openat}, {"FileOpenRawExit", __NR_RAWACCESS}, {"FileOpenRawExit", __NR_CREATE}, +#ifdef __NR_unlink {"FileDeleteRawExit", __NR_unlink}, +#endif {"FileDeleteAtRawExit", __NR_unlinkat}, {"FileDeleteAtCwdRawExit", __NR_unlinkat}, {"TCPacceptRawExit", __NR_accept}, @@ -906,18 +918,26 @@ void SetSyscallActive(bool *s, ULONG eventId) s[__NR_PROCTERM] = true; break; case SYSMONEVENT_RAWACCESS_READ_EVENT_value: +#ifdef __NR_open s[__NR_open] = true; +#endif s[__NR_openat] = true; s[__NR_RAWACCESS] = true; break; case SYSMONEVENT_FILE_CREATE_EVENT_value: +#ifdef __NR_open s[__NR_open] = true; +#endif s[__NR_openat] = true; +#ifdef __NR_creat s[__NR_creat] = true; +#endif s[__NR_CREATE] = true; break; case SYSMONEVENT_FILE_DELETE_EVENT_value: +#ifdef __NR_unlink s[__NR_unlink] = true; +#endif s[__NR_unlinkat] = true; break; case SYSMONEVENT_ACCESS_PROCESS_EVENT_value: @@ -1725,4 +1745,3 @@ main( Usage( argv[0], &csbi ); return ERROR_INVALID_PARAMETER; } - From 99f1b6301b7b608fb19e7476a856ac24c316e26e Mon Sep 17 00:00:00 2001 From: foxmsft Date: Sat, 15 Aug 2026 17:59:20 +0200 Subject: [PATCH 2/2] Update version year to 2026 --- linuxVersion.h.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/linuxVersion.h.in b/linuxVersion.h.in index 418b4a6..08d358c 100644 --- a/linuxVersion.h.in +++ b/linuxVersion.h.in @@ -32,5 +32,5 @@ // #define VER_COMPANY "Sysinternals - www.sysinternals.com" -#define VER_COPYRIGHT "By Mark Russinovich, Thomas Garnier and Kevin Sheldrake\nCopyright (C) 2014-2025 Microsoft Corporation\nLicensed under MIT/GPLv2\nUsing pugixml. pugixml is Copyright (C) 2006-2024 Arseny Kapoulkine. MIT License." +#define VER_COPYRIGHT "By Mark Russinovich, Thomas Garnier and Kevin Sheldrake\nCopyright (C) 2014-2026 Microsoft Corporation\nLicensed under MIT/GPLv2\nUsing pugixml. pugixml is Copyright (C) 2006-2024 Arseny Kapoulkine. MIT License."