Trying to get this to run on android: /proc/sys/kernel/ftrace_enabled: no such device

[nitanmarcel]

This is a discussion more than an issue since it might be something wrong with my kernel configuration or patches. I'm trying to execute tracee-ebpf-static on my android device and I ran into a fatal error regarding reading the ftrace_enabled node. This also happens when I try to cat it but not when I try to echo it.

{"level":"fatal","ts":1715874890.5336044,"msg":"App","error":"could not read from ftrace_enabled file: read /proc/sys/kernel/ftrace_enabled: no such device"}

Could someone give me an hand?

My kernel: https://github.com/nitanmarcel/android_kernel_oneplus_sdm845/commits/lineage-21/

My defconfig: https://pastebin.com/8SFCb9iB

Thank you very much :)

[yanivagman]

Seems that you are running tracee-ebpf and not tracee from the cmdline, is that correct?
If so, that's where it fails: https://github.com/aquasecurity/tracee/blob/main/pkg/cmd/urfave/urfave.go#L156

A few things to note here:

1. We don't test tracee on Android, though older versions of tracee used to work on it (which I manually tested in the past)
2. tracee-ebpf is now deprecated, and we will soon remove it from the repo. The new tracee cmdline combines the functionality of both tracee-ebpf and tracee-rules
3. To resolve the issue you have, it seems that you will need to recompile without the mentioned ftrace_enabled check, as this is Linux specific, and probably won't work on Android (unless you compile the Android kernel yourself and can turn it on)
4. After recompiling tracee without this check, I suspect it still won't work since we now only support environment with BTF enabled kernels, and Android kernels don't seem to enable BTF by default.

[nitanmarcel]

I suppose that instead of patching tracee, I could patch the kernel to always show ftrace_enabled as enabled, as long as it doesn't causes issues with other things, in that case I can set it to disabled and enable it on need.

About btf, that should be a challenge because I don't even have DEBUG_INFO_BTF in the kernel to enable, only trace of it's a definition check

#ifdef CONFIG_DEBUG_INFO_BTF
	.BTF : AT(ADDR(.BTF) - LOAD_OFFSET) {
		*(.BTF)
	}
#endif

[nitanmarcel]

BTF support seems easy to add

Supposedly I need these patches

https://lore.kernel.org/all/[email protected]/

https://lore.kernel.org/all/[email protected]/

https://lore.kernel.org/all/[email protected]/

[nitanmarcel]

I managed to get tracee somewhat running with a few patches to generate BTF types. It still doesn't fully work but at least it's a start

OnePlus6T:/data/local/tmp/dist # ./tracee-ebpf-static --events 'open*'                                                                                                                                             
{"level":"warn","ts":1716163906.178522,"msg":"KConfig: could not detect kconfig options","options":[11]}
{"level":"warn","ts":1716163906.856367,"msg":"libbpf: map 'task_info_map': failed to create: Invalid argument(-22)"}
{"level":"warn","ts":1716163906.8565907,"msg":"libbpf: failed to load object ''"}
{"level":"fatal","ts":1716163906.8615963,"msg":"App","error":"cmd.Runner.Run: error initializing Tracee: ebpf.(*Tracee).Init: ebpf.(*Tracee).initBPF: failed to load BPF object: invalid argument"}

btf: rename /sys/kernel/btf/kernel into /sys/kernel/btf/vmlinux
btf: do not use CONFIG_OUTPUT_FORMAT
btf: expose BTF info through sysfs
kbuild: add ability to generate BTF type info for vmlinux

[nitanmarcel]

I ended up with 6 patches instead of 4. Tracee doesn't work yet but at least BTF type info is now generated and working.

btfdump from /sys/kernel/btf/vmlinux on Android 14 kernel 4.9.337

• nitanmarcel/android_kernel_oneplus_sdm845-bpf@0bbd2c4
• nitanmarcel/android_kernel_oneplus_sdm845-bpf@82747ae
• nitanmarcel/android_kernel_oneplus_sdm845-bpf@82747ae
• nitanmarcel/android_kernel_oneplus_sdm845-bpf@e971690
• nitanmarcel/android_kernel_oneplus_sdm845-bpf@542330d
• nitanmarcel/android_kernel_oneplus_sdm845-bpf@a639d31

EDIT: /proc/sys/kernel/ftrace_enabled seems to be broken again, maybe because I rooted with apatch, no idea yet. for now this works

echo 1 > /data/local/tmp/frace_enabled
busybox mount -o loop,bind /data/local/tmp/frace_enabled /proc/sys/kernel/ftrace_enabled