Save syscall.log per target program execution

[yskzalloc]

Currently, it is difficult to trace or debug individual target program runs because behavior for each execution has not been logging. To improve traceability, I propose adding support for saving logs in a structured way for every client execution.

Proposal

• For each target program run, generate and store optionally(default: sys):
  • syscall.log
• Logs should be created with unique name for every execution to avoid overwriting data.
• Each execution could store logs under a dedicated directory, e.g.:

  <unique log directory(timestamp or run-id with hash)>/
      syscall.log
  

Motivation

• Easier reproduction of issues when analyzing target program behavior.
• Clear separation of logs between runs for debugging and testing.
• Improves collaboration when sharing logs across developers or bug reports.

Use cases

• Debugging reproducible failing cases.
• Collecting syscall logs for fuzzing analysis.

[yskzalloc]

I will not using ptrace, All syscall tracing is done using pure eBPF(not using libbpf) on a BPF queue map by vock driver program to target $PID(not on the target program). The traced syscalls can be transformed into syzlang(syz-trace2syz Converting syscalls to syzlang requires a separate implementation, so it should be tracked in another ticket).

[yskzalloc]

I found the good reference:

Kernel Space Hooking for eBPF

• ebpftracer

Substitute of ptrace

• https://github.com/pmem/syscall_intercept (Archived)
• https://github.com/yasukata/zpoline need /proc/sys/vm/mmap_min_addr = 0
• https://github.com/lazypoline/lazypoline.git need /proc/sys/vm/mmap_min_addr = 0