setuids.bt

#!/usr/bin/env bpftrace
/*
 * setuids - Trace the setuid syscalls: privilege escalation.
 *
 * See BPF Performance Tools, Chapter 11, for an explanation of this tool.
 *
 * Copyright (c) 2019 Brendan Gregg.
 * Licensed under the Apache License, Version 2.0 (the "License").
 * This was originally created for the BPF Performance Tools book
 * published by Addison Wesley. ISBN-13: 9780136554820
 * When copying or porting, include this comment.
 *
 * 26-Feb-2019  Brendan Gregg   Created this.
 */

BEGIN
{
	printf("Tracing setuid(2) family syscalls. Hit Ctrl-C to end.\n");
	printf("%-8s %-6s %-16s %-6s %-9s %s\n", "TIME",
	    "PID", "COMM", "UID", "SYSCALL", "ARGS (RET)");
}

tracepoint:syscalls:sys_enter_setuid,
tracepoint:syscalls:sys_enter_setfsuid
{
	@uid[tid] = uid;
	@setuid[tid] = args.uid;
	@seen[tid] = 1;
}

tracepoint:syscalls:sys_enter_setresuid
{
	@uid[tid] = uid;
	@ruid[tid] = args.ruid;
	@euid[tid] = args.euid;
	@suid[tid] = args.suid;
	@seen[tid] = 1;
}

tracepoint:syscalls:sys_exit_setuid
/@seen[tid]/
{
	time("%H:%M:%S ");
	printf("%-6d %-16s %-6d setuid    uid=%d (%d)\n", pid, comm,
	    @uid[tid], @setuid[tid], args.ret);
	delete(@seen[tid]); delete(@uid[tid]); delete(@setuid[tid]);
}

tracepoint:syscalls:sys_exit_setfsuid
/@seen[tid]/
{
	time("%H:%M:%S ");
	printf("%-6d %-16s %-6d setfsuid  uid=%d (prevuid=%d)\n", pid, comm,
	    @uid[tid], @setuid[tid], args.ret);
	delete(@seen[tid]); delete(@uid[tid]); delete(@setuid[tid]);
}

tracepoint:syscalls:sys_exit_setresuid
/@seen[tid]/
{
	time("%H:%M:%S ");
	printf("%-6d %-16s %-6d setresuid ", pid, comm, @uid[tid]);
	printf("ruid=%d euid=%d suid=%d (%d)\n", @ruid[tid], @euid[tid],
	    @suid[tid], args.ret);
	delete(@seen[tid]); delete(@uid[tid]); delete(@ruid[tid]);
	delete(@euid[tid]); delete(@suid[tid]);
}