| Demonstrations of bashreadline, the Linux eBPF/bcc version. |
| |
| |
| This prints bash commands from all running bash shells on the system. For |
| example: |
| |
| # ./bashreadline |
| TIME PID COMMAND |
| 05:28:25 21176 ls -l |
| 05:28:28 21176 date |
| 05:28:35 21176 echo hello world |
| 05:28:43 21176 foo this command failed |
| 05:28:45 21176 df -h |
| 05:29:04 3059 echo another shell |
| 05:29:13 21176 echo first shell again |
| |
| When running the script on Arch Linux, you may need to specify the location |
| of libreadline.so library: |
| |
| # ./bashreadline -s /lib/libreadline.so |
| TIME PID COMMAND |
| 11:17:34 28796 whoami |
| 11:17:41 28796 ps -ef |
| 11:17:51 28796 echo "Hello eBPF!" |
| |
| |
| The entered command may fail. This is just showing what command lines were |
| entered interactively for bash to process. |
| |
| It works by tracing the return of the readline() function using uprobes |
| (specifically a uretprobe). |
