Module: Vivarium

Defined in:
lib/vivarium.rb,
lib/vivarium/cli.rb,
lib/vivarium/version.rb,
lib/vivarium/correlator.rb,
lib/vivarium/tree_renderer.rb

Defined Under Namespace

Modules: CLI Classes: Correlator, Daemon, Error, MapStore, ObservationSession, TreeRenderer

Constant Summary collapse

PIN_DIR = 
ENV.fetch("VIVARIUM_BPF_PIN_DIR", "/sys/fs/bpf/vivarium")
CONFIG_ROOT_TARGETS_PIN = 
File.join(PIN_DIR, "config_root_targets")
CONFIG_SPAWNED_TARGETS_PIN = 
File.join(PIN_DIR, "config_spawned_targets")
CONFIG_TARGETS_PIN = 
CONFIG_ROOT_TARGETS_PIN
EVENTS_PIN = 
File.join(PIN_DIR, "events")
EVENT_NAME_SIZE = 
16
EVENT_PAYLOAD_SIZE = 
256
EVENT_TS_SIZE = 
8
PROC_EXEC_SLOT_SIZE = 
64
PROC_EXEC_SLOT_COUNT = 
4
EVENT_STRUCT_SIZE = 
288
EVENT_TS_OFFSET = 
0
EVENT_PID_OFFSET = 
8
EVENT_TID_OFFSET = 
12
EVENT_NAME_OFFSET = 
16
EVENT_PAYLOAD_OFFSET = 
32
EVENTS_RINGBUF_PAGES = 
256
SPAN_ALLOWCLASSES = 
[
  Socket,
  BasicSocket,
  IPSocket,
  TCPSocket,
  UDPSocket,
  UNIXSocket,
  File,
  Dir,
  Signal,
  Process,
  Process::UID,
  Process::GID,
]
SPAN_ALLOWLIST = 
[
  "Kernel#system",
  "Kernel#require",
  "Kernel#require_relative",
  "Kernel#load",
  "Kernel#eval",
  "Object#instance_eval",
  "Object#instance_exec",
].freeze
EVENT_SEVERITY_HIGH = 
%w[
  capable_check bprm_creds setid_change task_kill
  ptrace_check sb_mount kernel_read_file
].freeze
CAPABILITY_NAMES = 
{
  0 => "CAP_CHOWN",
  1 => "CAP_DAC_OVERRIDE",
  2 => "CAP_DAC_READ_SEARCH",
  3 => "CAP_FOWNER",
  4 => "CAP_FSETID",
  5 => "CAP_KILL",
  6 => "CAP_SETGID",
  7 => "CAP_SETUID",
  8 => "CAP_SETPCAP",
  9 => "CAP_LINUX_IMMUTABLE",
  10 => "CAP_NET_BIND_SERVICE",
  12 => "CAP_NET_ADMIN",
  13 => "CAP_NET_RAW",
  16 => "CAP_SYS_MODULE",
  17 => "CAP_SYS_RAWIO",
  18 => "CAP_SYS_CHROOT",
  19 => "CAP_SYS_PTRACE",
  21 => "CAP_SYS_ADMIN",
  22 => "CAP_SYS_BOOT",
  23 => "CAP_SYS_NICE",
  24 => "CAP_SYS_RESOURCE",
  25 => "CAP_SYS_TIME",
  27 => "CAP_MKNOD",
  29 => "CAP_AUDIT_WRITE",
  37 => "CAP_AUDIT_READ",
  38 => "CAP_PERFMON",
  39 => "CAP_BPF",
  40 => "CAP_CHECKPOINT_RESTORE"
}.freeze
SETID_FLAG_NAMES = 
{
  0x01 => "LSM_SETID_ID",
  0x02 => "LSM_SETID_RE",
  0x04 => "LSM_SETID_RES",
  0x08 => "LSM_SETID_FS"
}.freeze
VERSION = 
"0.3.0"

Class Attribute Summary collapse

Class Method Summary collapse

Class Attribute Details

.bpf_pin_dir ⇒ Object 



104
105
106
 
# File 'lib/vivarium.rb', line 104

def bpf_pin_dir
  @bpf_pin_dir || PIN_DIR
end

Class Method Details

.build_observe_tracepoint(method_id_queue) ⇒ Object 



1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
 
# File 'lib/vivarium.rb', line 1624

def self.build_observe_tracepoint(method_id_queue)
  allow_classes = SPAN_ALLOWCLASSES
  allowlist = SPAN_ALLOWLIST
  TracePoint.new(:call, :c_call, :return, :c_return, :raise) do |tp|
    if tp.event == :raise
      Vivarium::Usdt.raise(
        tp.raised_exception.class.to_s,
        tp.raised_exception.message.to_s,
        file: tp.path,
        lineno: tp.lineno
      )
      next
    end

    signature = "#{tp.defined_class}##{tp.method_id}"
    is_target = allowlist.include?(signature) || \
      allow_classes.any? { |klass| tp.defined_class == klass } || \
      allow_classes.any? { |klass| tp.defined_class == klass.singleton_class }
    next unless is_target

    case tp.event
    when :call, :c_call
      method_id = Vivarium::Usdt.start(tp.defined_class.to_s, tp.method_id.to_s, file: tp.path, lineno: tp.lineno)
      method_id_queue << [method_id, signature]
    when :return, :c_return
      Vivarium::Usdt.stop(tp.defined_class.to_s, tp.method_id.to_s, file: tp.path, lineno: tp.lineno)
    end
  end
end

.c_string(bytes) ⇒ Object 



109
110
111
112
113
114
115
 
# File 'lib/vivarium.rb', line 109

def self.c_string(bytes)
  str = bytes.to_s.b
  nul = str.index("\x00")
  return str if nul.nil?

  str[0, nul]
end

.decode_bad_socket_payload(raw_payload) ⇒ Object 



190
191
192
 
# File 'lib/vivarium.rb', line 190

def self.decode_bad_socket_payload(raw_payload)
  decode_odd_socket_payload(raw_payload)
end

.decode_bprm_creds_payload(raw_payload) ⇒ Object 



310
311
312
313
314
315
316
317
 
# File 'lib/vivarium.rb', line 310

def self.decode_bprm_creds_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 2

  has_file = bytes.getbyte(0).to_i
  path = c_string(bytes[1, EVENT_PAYLOAD_SIZE - 1])
  "has_file=#{has_file} file=#{path.inspect}"
end

.decode_capable_check_payload(raw_payload) ⇒ Object 



300
301
302
303
304
305
306
307
308
 
# File 'lib/vivarium.rb', line 300

def self.decode_capable_check_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 8

  cap = bytes[0, 4].unpack1("L<")
  opts = bytes[4, 4].unpack1("L<")
  cap_name = CAPABILITY_NAMES.fetch(cap, "UNKNOWN")
  "cap=#{cap}(#{cap_name}) opts=0x#{opts.to_s(16)}"
end

.decode_dns_qname(raw_payload) ⇒ Object 



121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
 
# File 'lib/vivarium.rb', line 121

def self.decode_dns_qname(raw_payload)
  bytes = raw_payload.to_s.b.bytes
  labels = []
  idx = 0

  while idx < bytes.length
    length = bytes[idx]
    break if length.nil? || length.zero?
    break if length > 63

    idx += 1
    break if (idx + length) > bytes.length

    label = bytes[idx, length].pack("C*")
    labels << label
    idx += length
  end

  return "" if labels.empty?

  labels.join(".")
end

.decode_file_chmod_payload(raw_payload) ⇒ Object 



215
216
217
218
219
220
221
222
 
# File 'lib/vivarium.rb', line 215

def self.decode_file_chmod_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 2

  mode = bytes[0, 2].unpack1("S<")
  path = c_string(bytes[2, 254])
  "mode=#{format('0o%o', mode)} path=#{path.inspect}"
end

.decode_file_getdents_payload(raw_payload) ⇒ Object 



224
225
226
227
228
229
230
231
 
# File 'lib/vivarium.rb', line 224

def self.decode_file_getdents_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 8

  fd = bytes[0, 4].unpack1("L<")
  count = bytes[4, 4].unpack1("L<")
  "fd=#{fd} count=#{count}"
end

.decode_file_hardlink_payload(raw_payload) ⇒ Object 



201
202
203
204
205
206
 
# File 'lib/vivarium.rb', line 201

def self.decode_file_hardlink_payload(raw_payload)
  bytes = raw_payload.to_s.b
  old_path = c_string(bytes[0, 128])
  new_name = c_string(bytes[128, 128])
  "old_path=#{old_path.inspect} new_name=#{new_name.inspect}"
end

.decode_file_rename_payload(raw_payload) ⇒ Object 



208
209
210
211
212
213
 
# File 'lib/vivarium.rb', line 208

def self.decode_file_rename_payload(raw_payload)
  bytes = raw_payload.to_s.b
  old_name = c_string(bytes[0, 128])
  new_name = c_string(bytes[128, 128])
  "old_name=#{old_name.inspect} new_name=#{new_name.inspect}"
end

.decode_file_symlink_payload(raw_payload) ⇒ Object 



194
195
196
197
198
199
 
# File 'lib/vivarium.rb', line 194

def self.decode_file_symlink_payload(raw_payload)
  bytes = raw_payload.to_s.b
  target = c_string(bytes[0, 128])
  link_name = c_string(bytes[128, 128])
  "target=#{target.inspect} link_name=#{link_name.inspect}"
end

.decode_kernel_read_file_payload(raw_payload) ⇒ Object 



265
266
267
268
269
270
271
272
 
# File 'lib/vivarium.rb', line 265

def self.decode_kernel_read_file_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 8

  id = bytes[0, 4].unpack1("L<")
  contents = bytes[4, 4].unpack1("L<")
  "id=#{id} contents=#{contents}"
end

.decode_odd_socket_payload(raw_payload) ⇒ Object 



165
166
167
168
169
170
171
172
173
174
175
176
 
# File 'lib/vivarium.rb', line 165

def self.decode_odd_socket_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 6

  family = bytes[0, 2].unpack1("S<")
  type = bytes[2, 2].unpack1("S<")
  protocol = bytes[4, 2].unpack1("S<")
  family_name = socket_const_name("AF_", family)
  type_name = socket_const_name("SOCK_", type)
  protocol_name = socket_const_name("IPPROTO_", protocol)
  "family=#{family}(#{family_name}) type=#{type}(#{type_name}) protocol=#{protocol}(#{protocol_name})"
end

.decode_proc_exec_payload(raw_payload) ⇒ Object 



233
234
235
236
237
238
239
240
241
242
243
244
245
 
# File 'lib/vivarium.rb', line 233

def self.decode_proc_exec_payload(raw_payload)
  bytes = raw_payload.to_s.b
  slots = PROC_EXEC_SLOT_COUNT.times.map do |index|
    offset = index * PROC_EXEC_SLOT_SIZE
    c_string(bytes[offset, PROC_EXEC_SLOT_SIZE])
  end
  slots.reject!(&:empty?)
  return "" if slots.empty?

  filename = slots.shift
  argv = slots
  "filename=#{filename.inspect} argv=[#{argv.map(&:inspect).join(', ')}]"
end

.decode_proc_fork_payload(raw_payload) ⇒ Object 



319
320
321
322
323
324
325
326
 
# File 'lib/vivarium.rb', line 319

def self.decode_proc_fork_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 8

  child_pid = bytes[0, 4].unpack1("L<")
  child_tid = bytes[4, 4].unpack1("L<")
  "child_pid=#{child_pid} child_tid=#{child_tid}"
end

.decode_ptrace_check_payload(raw_payload) ⇒ Object 



247
248
249
250
251
252
253
 
# File 'lib/vivarium.rb', line 247

def self.decode_ptrace_check_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 4

  mode = bytes[0, 4].unpack1("L<")
  "mode=0x#{mode.to_s(16)}"
end

.decode_sb_mount_payload(raw_payload) ⇒ Object 



255
256
257
258
259
260
261
262
263
 
# File 'lib/vivarium.rb', line 255

def self.decode_sb_mount_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 248

  flags = bytes[0, 8].unpack1("Q<")
  dev_name = c_string(bytes[8, 120])
  fs_type = c_string(bytes[128, 120])
  "flags=0x#{flags.to_s(16)} dev_name=#{dev_name.inspect} fs_type=#{fs_type.inspect}"
end

.decode_setid_change_payload(raw_payload) ⇒ Object 



288
289
290
291
292
293
294
295
296
297
298
 
# File 'lib/vivarium.rb', line 288

def self.decode_setid_change_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 4

  flags = bytes[0, 4].unpack1("L<")
  names = SETID_FLAG_NAMES.each_with_object([]) do |(bit, name), acc|
    acc << name if (flags & bit) != 0
  end
  names << "UNKNOWN" if names.empty?
  "flags=0x#{flags.to_s(16)} kinds=[#{names.join(', ')}]"
end

.decode_sock_connect_payload(raw_payload) ⇒ Object 



144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
 
# File 'lib/vivarium.rb', line 144

def self.decode_sock_connect_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 20

  family = bytes[0, 2].unpack1("S<")
  port = bytes[2, 2].unpack1("n")
  addr = bytes[4, 16]

  case family
  when 2 # AF_INET
    ipv4 = addr[0, 4].bytes.join(".")
    "#{ipv4}:#{port} (#{socket_const_name("AF_", family)})"
  when 10 # AF_INET6
    words = addr.unpack("n8")
    ipv6 = words.map { |w| format("%x", w) }.join(":")
    "[#{ipv6}]:#{port} (#{socket_const_name("AF_", family)})"
  else
    "family=#{family}(#{socket_const_name("AF_", family)}) port=#{port}"
  end
end

.decode_span_payload(raw_payload) ⇒ Object 



328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
 
# File 'lib/vivarium.rb', line 328

def self.decode_span_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 8

  method_id = bytes[0, 8].unpack1("q<")
  result = format("method_id=0x%016X", method_id & 0xFFFF_FFFF_FFFF_FFFF)

  if bytes.bytesize >= 24
    file_id = bytes[8, 8].unpack1("q<")
    lineno = bytes[16, 8].unpack1("q<")
    result += format(" file_id=0x%016X", file_id & 0xFFFF_FFFF_FFFF_FFFF) if file_id != -1
    result += " lineno=#{lineno}" if lineno > 0
  end

  result
end

.decode_span_raise_payload(raw_payload) ⇒ Object 



345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
 
# File 'lib/vivarium.rb', line 345

def self.decode_span_raise_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 8

  error_id = bytes[0, 8].unpack1("q<")
  result = format("error_id=0x%016X", error_id & 0xFFFF_FFFF_FFFF_FFFF)

  if bytes.bytesize >= 16
    message_id = bytes[8, 8].unpack1("q<")
    result += format(" message_id=0x%016X", message_id & 0xFFFF_FFFF_FFFF_FFFF)
  end

  if bytes.bytesize >= 24
    file_id = bytes[16, 8].unpack1("q<")
    result += format(" file_id=0x%016X", file_id & 0xFFFF_FFFF_FFFF_FFFF) if file_id != -1
  end

  if bytes.bytesize >= 32
    lineno = bytes[24, 8].unpack1("q<")
    result += " lineno=#{lineno}" if lineno > 0
  end

  result
end

.decode_task_kill_payload(raw_payload) ⇒ Object 



274
275
276
277
278
279
280
281
282
283
284
285
286
 
# File 'lib/vivarium.rb', line 274

def self.decode_task_kill_payload(raw_payload)
  bytes = raw_payload.to_s.b
  return "" if bytes.bytesize < 4

  sig = bytes[0, 4].unpack1("l<")
  signame = begin
    Signal.signame(sig)
  rescue ArgumentError
    nil
  end

  signame ? "sig=#{sig} signame=#{signame}" : "sig=#{sig}"
end

.event_severity(event_name) ⇒ Object 



117
118
119
 
# File 'lib/vivarium.rb', line 117

def self.event_severity(event_name)
  EVENT_SEVERITY_HIGH.include?(event_name.to_s) ? "high" : "medium"
end

.gettid ⇒ Object 



1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
 
# File 'lib/vivarium.rb', line 1654

def self.gettid
  @gettid_func ||= begin
    libc = Fiddle.dlopen("libc.so.6")
    Fiddle::Function.new(libc["gettid"], [], Fiddle::TYPE_INT)
  rescue Fiddle::DLError
    libc = Fiddle.dlopen(nil)
    Fiddle::Function.new(libc["gettid"], [], Fiddle::TYPE_INT)
  end
  @gettid_func.call
end

.locate_vivarium_usdt_so ⇒ Object 



1669
1670
1671
1672
1673
1674
1675
1676
1677
 
# File 'lib/vivarium.rb', line 1669

def self.locate_vivarium_usdt_so
  require "vivarium_usdt/vivarium_usdt"
  so = $LOADED_FEATURES.find { |p| p =~ %r{vivarium_usdt/vivarium_usdt\.(so|bundle|dylib)\z} }
  raise Error, "vivarium_usdt native extension not found in $LOADED_FEATURES" unless so

  File.realpath(so)
rescue LoadError => e
  raise Error, "failed to load vivarium_usdt: #{e.message}"
end

.monotonic_ktime_ns ⇒ Object 



1665
1666
1667
 
# File 'lib/vivarium.rb', line 1665

def self.monotonic_ktime_ns
  Process.clock_gettime(Process::CLOCK_MONOTONIC, :nanosecond)
end

.observe(pin_dir: bpf_pin_dir, dest: $stdout, &block) ⇒ Object 



1560
1561
1562
1563
1564
 
# File 'lib/vivarium.rb', line 1560

def self.observe(pin_dir: bpf_pin_dir, dest: $stdout, &block)
  return scoped_observe(pin_dir: pin_dir, dest: dest, &block) if block_given?

  top_observe(pin_dir: pin_dir, dest: dest)
end

.render_event_payload(event) ⇒ Object 



370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
 
# File 'lib/vivarium.rb', line 370

def self.render_event_payload(event)
  case event.event_name
  when "dns_req"
    decoded = decode_dns_qname(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "sock_connect"
    decoded = decode_sock_connect_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "odd_socket"
    decoded = decode_odd_socket_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "proc_exec"
    decoded = decode_proc_exec_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "ptrace_check"
    decoded = decode_ptrace_check_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "sb_mount"
    decoded = decode_sb_mount_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "kernel_read_file"
    decoded = decode_kernel_read_file_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "task_kill"
    decoded = decode_task_kill_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "setid_change"
    decoded = decode_setid_change_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "capable_check"
    decoded = decode_capable_check_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "bprm_creds"
    decoded = decode_bprm_creds_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "proc_fork"
    decoded = decode_proc_fork_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "span_start", "span_stop"
    decoded = decode_span_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "span_raise"
    decoded = decode_span_raise_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "file_symlink"
    decoded = decode_file_symlink_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "file_hardlink"
    decoded = decode_file_hardlink_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "file_rename"
    decoded = decode_file_rename_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "file_chmod"
    decoded = decode_file_chmod_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  when "file_getdents"
    decoded = decode_file_getdents_payload(event.payload)
    decoded.empty? ? event.payload.inspect : decoded
  else
    strip_to_first_null(event.payload).inspect
  end
end

.run_daemon!(argv = ARGV) ⇒ Object 



1679
1680
1681
1682
1683
1684
1685
1686
1687
 
# File 'lib/vivarium.rb', line 1679

def self.run_daemon!(argv = ARGV)
  options = { pin_dir: bpf_pin_dir }
  OptionParser.new do |opts|
    opts.banner = "Usage: vivariumd [--pin-dir PATH]"
    opts.on("--pin-dir PATH", "Pinned map directory") { |v| options[:pin_dir] = v }
  end.parse!(argv)

  Daemon.new(pin_dir: options[:pin_dir]).run
end

.scoped_observe(pin_dir:, dest:) ⇒ Object 



1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
 
# File 'lib/vivarium.rb', line 1595

def self.scoped_observe(pin_dir:, dest:)
  require "vivarium_usdt"

  store = MapStore.new(pin_dir: pin_dir)
  pid = Process.pid
  store.register_pid(pid)

  method_id_queue = Thread::Queue.new
  main_tid = gettid

  correlator = Correlator.new(
    pin_dir: pin_dir,
    observer_pid: pid,
    main_tid: main_tid,
    method_id_queue: method_id_queue,
    dest: dest
  )
  correlator.start

  tracer = build_observe_tracepoint(method_id_queue)
  tracer.enable

  yield
ensure
  tracer&.disable
  store&.unregister_pid(pid)
  correlator&.stop
end

.socket_const_name(prefix, value) ⇒ Object 



178
179
180
181
182
183
184
185
186
187
188
 
# File 'lib/vivarium.rb', line 178

def self.socket_const_name(prefix, value)
  return "UNKNOWN" unless defined?(Socket)

  key = Socket.constants.find do |name|
    name.to_s.start_with?(prefix) && Socket.const_get(name) == value
  rescue NameError
    false
  end

  key ? key.to_s : "UNKNOWN"
end

.strip_to_first_null(bytes) ⇒ Object 



434
435
436
437
438
439
 
# File 'lib/vivarium.rb', line 434

def self.strip_to_first_null(bytes)
  nul = bytes.index("\x00")
  return bytes if nul.nil?

  bytes[0, nul]
end

.top_observe(pin_dir: bpf_pin_dir, dest: $stdout) ⇒ Object 



1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
 
# File 'lib/vivarium.rb', line 1566

def self.top_observe(pin_dir: bpf_pin_dir, dest: $stdout)
  require "vivarium_usdt"

  store = MapStore.new(pin_dir: pin_dir)
  pid = Process.pid
  store.register_pid(pid)

  method_id_queue = Thread::Queue.new
  main_tid = gettid

  correlator = Correlator.new(
    pin_dir: pin_dir,
    observer_pid: pid,
    main_tid: main_tid,
    method_id_queue: method_id_queue,
    dest: dest
  )
  correlator.start

  tracer = build_observe_tracepoint(method_id_queue)
  tracer.enable

  session = ObservationSession.new(
    store: store, pid: pid, tracer: tracer, correlator: correlator
  )
  at_exit { session.stop }
  session
end