.rodata: map create: read- and write-only maps not supported (requires >= v5.2) #39

cfc4n · 2022-04-20T14:24:34Z

Describe the bug
cant load ebpf bytecode with cilium/ebpf library on linux kernel 4.18.0 while global variable used in kernel code.

To Reproduce

git clone https://github.com/ehids/ecapture
cd ecapture
make nocore
./bin/ecapture tls

./bin/ecapture tls
loading objects: field UretprobeBashReadline: program uretprobe_bash_readline: map .rodata: map create: read- and write-only maps not supported (requires >= v5.2)

** DEBUG**

const volatile u64 target_pid declaration at
https://github.com/ehids/ecapture/blob/0787e297de3c9c78ea13fbc7aacc7d68b88ac367/kern/common.h#L23-L28

used at
https://github.com/ehids/ecapture/blob/0787e297de3c9c78ea13fbc7aacc7d68b88ac367/kern/openssl_kern.c#L157-L160

const volatile u64 target_pid = 0;

Expected behavior
It works with global variable in ebpf kernel function on linux kernel 4.18.

Additional context
seems like a cilium/ebpf bug ref cilium/ebpf#628 .

…ted (requires >= v5.2) 1,global variable declaration will compile to .rodata/.bss section in ELF file. 2, haveMapMutabilityModifiers function will create ARRAY type ebpf map with BPF_F_RDONLY_PROG flag to detect system support in syscalls.go . 3. so need to remove global variable on kernel version less than 5.2 via haveMapMutabilityModifiers in cilium/ebpf/syscalls.go 4. more info cilium/ebpf@f5942f5 Signed-off-by: CFC4N <cfc4n.cs@gmail.com>

* : Fix #39 .rodata: map create: read- and write-only maps not supported (requires >= v5.2)

cfc4n linked a pull request Apr 20, 2022 that will close this issue

* : Fix #39 .rodata: map create: read- and write-only maps not supported (requires >= v5.2) #40

Merged

cfc4n closed this as completed in #40 Apr 21, 2022

cfc4n added a commit that referenced this issue Apr 21, 2022

Merge pull request #40 from ehids/rodata-map-not-supported

347a0cd

* : Fix #39 .rodata: map create: read- and write-only maps not supported (requires >= v5.2)

cfc4n mentioned this issue May 4, 2022

add errnumber flag for bash (kernel filter) #54

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

.rodata: map create: read- and write-only maps not supported (requires >= v5.2) #39

.rodata: map create: read- and write-only maps not supported (requires >= v5.2) #39

cfc4n commented Apr 20, 2022 •

edited

Loading

.rodata: map create: read- and write-only maps not supported (requires >= v5.2) #39

.rodata: map create: read- and write-only maps not supported (requires >= v5.2) #39

Comments

cfc4n commented Apr 20, 2022 • edited Loading

cfc4n commented Apr 20, 2022 •

edited

Loading