running as sudo with root gives error permission denies when loading ebpf program in a simple program

Question

This is my simple ebpf program

#include <linux/bpf.h>
#include <linux/version.h>
#include <linux/ip.h>
#include <linux/if_ether.h>
#include <bpf_helpers.h>
#include <bpf_endian.h>// iproute specifically looks for this ELF section

//#include <net/sock.h>

#include <linux/bpf.h>
#include <linux/version.h>

#include <bpf_helpers.h>

#define bpf_printk(fmt, ...)                            \
({                                                      \
        char ____fmt[] = fmt;                           \
        bpf_trace_printk(____fmt, sizeof(____fmt),      \
                         ##__VA_ARGS__);                \
})

SEC("kprobe/tcp_connect")
int connect(struct pt_regs *ctx)
{
  bpf_printk("connect called -- Hello from [fawad] \n");
  
   return 0;
}
char _license[] SEC("license") = "GPL";

compiling above program with this command

clang -O2 -Wall -target bpf -c -o xdp.o -I    /build/root/usr/include/bpf   -I /usr/src/linux-headers-5.11.0-41/arch/alpha/include/ -I /usr/src/linux-headers-5.11.0-41/arch/alpha/include/ xdp.c

and this is a loader program

#include <stdlib.h>
#include <unistd.h>
#include <sys/resource.h>
#include <bpf/libbpf.h>
#include <bpf_load.h>
int main() {  // raise the rlimit or see
  // failed to create a map: 1 Operation not permitted
  // when load_bpf_file is run

    if (load_bpf_file("xdp.o")) 
    {
        printf("%s\n", bpf_log_buf);
        return 1;
    }  
    while(1){
        sleep(1);
    }
  
  }  return 0;
}

compiling my ebpf loader program like this

clang -O2 -Wall -target bpf -c -o user.o -I    /build/root/usr/include/bpf -I /home/ubuntu/Desktop/linux/test/linux-5.14.1/samples/bpf/   -I /usr/src/linux-headers-5.11.0-41/arch/alpha/include/ -I /usr/src/linux-headers-5.11.0-41/arch/alpha/include/ user.c

When I run the loader program like #./user.o

it gives error

bash: ./user.o: Permission denied

running with sudo does not even recognized the file

root@this:/home/ubuntu/Desktop/ebpf# sudo  ./user.o
sudo: ./user.o: command not found
root@this:/home/ubuntu/Desktop/ebpf#

I am loading the ebpf program as fresh out file from compiling. I read i need to strip headers from elf file is this true before loading the ebpf program how to do it? — user786, Dec 16 '21 at 09:29
You can't run object files. You need to *link* them into executable files. — Some programmer dude, Dec 16 '21 at 09:30
You have only compiled user.c to user.o. That doesn't yet generate an executable by another call of sth. like `clang -o user user.o xdp.o` (this is the linker) — Ingo Leonhardt, Dec 16 '21 at 09:32
@Someprogrammerdude if I dont provide -c to create executable the clang throws error that no input file, how to resolve this? taken from here https://stackoverflow.com/a/1847104/4808760 — user786, Dec 16 '21 at 09:39
@IngoLeonhardt can u tell how to create executable using clang all these articles about ebpf showing this why would they do this — user786, Dec 16 '21 at 09:40
sorry, I don't know ebpf so I can't tell you the complete linker call (esp. what libraries are needed) — Ingo Leonhardt, Dec 16 '21 at 09:45
@IngoLeonhardt what libraries are need, nothing much just library with few files, I am in including it like this -I /build/root/usr/include/bpf the headers in clang command — user786, Dec 16 '21 at 09:47
The "loader" program is a plain C program, and should not use the `-target bpf` option. Then it should not use the `-c` option. It *do* have an "input" namely the `user.c` source file. So you should build your program without the `-target bpf` or `-c` options, and name your program `user` instead of `user.o`. Then run `./user`. — Some programmer dude, Dec 16 '21 at 09:51

score 1 · Answer 1 · answered Dec 16 '21 at 09:53

1

Only your eBPF program needs to be compiled as eBPF, with the -t bpf target. Just compile your loader program regularly with either clang or gcc:

$ clang -Wall -o user user.c

Then you should be able to run your executable file after that (although I've not checked whether your program works as intended):

$ sudo ./user

(Note: You might still need to pass some of the include paths when compiling, -I /home/ubuntu/Desktop/linux/test/linux-5.14.1/samples/bpf/ for <bpf_load.h>, and maybe the path to <bpf/libbpf.h>)

answered Dec 16 '21 at 09:53

Qeole

8,284
1
24
52

also please do tell I could not find `load_bpf_file` function how to include the header file for this function. Can u give me a simple example of loading the ebpf program. I am on linux 5.14.1 – user786 Dec 16 '21 at 10:08
`load_bpf_file` comes from the kernel samples, but it's somewhat deprecated and more and more samples dropped it in favour of libbpf. You would have to get the header from samples/bpf/ in your kernel directory, I don't remember if there's a separate .c program too, check the existing samples maybe. If you want to build your loader program with libbpf, which is probably a better alternative, I would strongly encourage you to check out [libbpf-boostrap](https://nakryiko.com/posts/libbpf-bootstrap/). – Qeole Dec 16 '21 at 11:46

running as sudo with root gives error permission denies when loading ebpf program in a simple program

1 Answers1