zh/tutorials/5-uprobe-bashreadline/

[giscus[bot]]

zh/tutorials/5-uprobe-bashreadline/

Unlock the potential of eBPF

https://eunomia.dev/zh/tutorials/5-uprobe-bashreadline/

[TravisRoad]

参考：iovisor/bcc#1851

% sudo ecli run package.json
INFO [faerie::elf] strtab: 0x455 symtab 0x490 relocs 0x4d8 sh_offset 0x4d8
libbpf: elf: 'readline' is 0 in symtab for '/bin/bash': should not be 0 in a shared library
Error: Failed to run native eBPF program

Caused by:
    Bpf error: Failed to start polling: Bpf("Failed to load and attach: Failed to attach program `printret`: Internal error: bpf call \"libbpf_rs::program::Program::attach::{{closure}}\" returned NULL"), RecvError

如果你也在这一节遇到了相同的困扰，应该是动态链接的问题，检查一下 ldd

% ldd /bin/bash    
        ...
        libreadline.so.8 => /usr/lib/libreadline.so.8 (0x00007bad65e9f000)
        ...

所以我们可以把 SEC("uretprobe//bin/bash:readline") 换成 SEC("uretprobe//usr/lib/libreadline.so.8:readline") 来达到最后的效果。注意：这里替换的binary路径需要和你的 ldd 中的 libreadline 相一致。