Bpftrace: First example failed with "couldn't set RLIMIT_MEMLOCK" and "tracepoint not found"

[Pro-YY]

About bpftrace one-liner, I failed with "RLIMIT_MEMLOCK", and I cannot list the syscall probes via "bpftrace -l", as shown.

root@VM-250-12-ubuntu:~# bpftrace -e 'tracepoint:syscalls:sys_enter_open { printf("%s %s\n", comm, str(args->filename)); }'
Unknown error -1: couldn't set RLIMIT_MEMLOCK for bpftrace. If your program is not loading, you can try "ulimit -l 8192" to fix the problem
ERROR: tracepoint not found: syscalls:sys_enter_open
root@VM-250-12-ubuntu:~# ulimit -l 8192
root@VM-250-12-ubuntu:~# ulimit -l
8192
root@VM-250-12-ubuntu:~# bpftrace -e 'tracepoint:syscalls:sys_enter_open { printf("%s %s\n", comm, str(args->filename)); }'
Unknown error -1: couldn't set RLIMIT_MEMLOCK for bpftrace. If your program is not loading, you can try "ulimit -l 8192" to fix the problem
ERROR: tracepoint not found: syscalls:sys_enter_open

root@VM-250-12-ubuntu:~# bpftrace -l 'tracepoint:syscalls:sys_enter_open*'
root@VM-250-12-ubuntu:~# bpftrace -l '*'
software:alignment-faults:
software:bpf-output:
software:context-switches:
software:cpu-clock:
software:cpu-migrations:
software:dummy:
software:emulation-faults:
software:major-faults:
software:minor-faults:
software:page-faults:
software:task-clock:
hardware:backend-stalls:
hardware:branch-instructions:
hardware:branch-misses:
hardware:bus-cycles:
hardware:cache-misses:
hardware:cache-references:
hardware:cpu-cycles:
hardware:frontend-stalls:
hardware:instructions:
hardware:ref-cycles:
Permission denied: /sys/kernel/debug/tracing/available_filter_functions

My VM system info:

root@VM-250-12-ubuntu:~# cat /etc/issue
Ubuntu 18.04.1 LTS \n \l

root@VM-250-12-ubuntu:~# uname -a
Linux VM-250-12-ubuntu 4.15.0-54-generic #58-Ubuntu SMP Mon Jun 24 10:55:24 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

root@VM-250-12-ubuntu:~# bpftrace -V
bpftrace v0.9.2-1-g9bf8

root@VM-250-12-ubuntu:~# cat /sys/kernel/debug/tracing/tracing_on
1
root@VM-250-12-ubuntu:~# cat /sys/kernel/debug/tracing/available_events | grep syscalls:sys_enter_open*
syscalls:sys_enter_openat
syscalls:sys_enter_open
syscalls:sys_enter_open_by_handle_at
root@VM-250-12-ubuntu:~# mount | grep /sys/kernel/debug
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
tracefs on /sys/kernel/debug/tracing type tracefs (rw,relatime)
root@VM-250-12-ubuntu:~# grep BPF /boot/config-4.15.0-54-generic
CONFIG_CGROUP_BPF=y
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT_ALWAYS_ON=y
CONFIG_NETFILTER_XT_MATCH_BPF=m
CONFIG_NET_CLS_BPF=m
CONFIG_NET_ACT_BPF=m
CONFIG_BPF_JIT=y
CONFIG_BPF_STREAM_PARSER=y
CONFIG_LWTUNNEL_BPF=y
CONFIG_HAVE_EBPF_JIT=y
CONFIG_BPF_EVENTS=y
CONFIG_TEST_BPF=m

But the perf utility tool managed to trace the openat syscalls:

root@VM-250-12-ubuntu:~# perf list | grep syscalls:sys_enter_open
  syscalls:sys_enter_open                            [Tracepoint event]
  syscalls:sys_enter_open_by_handle_at               [Tracepoint event]
  syscalls:sys_enter_openat                          [Tracepoint event]
root@VM-250-12-ubuntu:~# perf record -e syscalls:sys_enter_openat -a sleep 1
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.222 MB perf.data (477 samples) ]
root@VM-250-12-ubuntu:~# perf script | head -n 3
            perf  8182 [000] 860461.219603: syscalls:sys_enter_openat: dfd: 0xffffff9c, filename: 0x7ffd9c64f1d0, flags: 0x00000000, mode: 0x00000000
           sleep  8185 [000] 860461.219874: syscalls:sys_enter_openat: dfd: 0xffffff9c, filename: 0x7f9d6060c428, flags: 0x00080000, mode: 0x00000000
           sleep  8185 [000] 860461.219884: syscalls:sys_enter_openat: dfd: 0xffffff9c, filename: 0x7f9d60814f20, flags: 0x00080000, mode: 0x00000000

Thanks~

[fbs]

Did you build from source or did you use snap?

Does anything interesting show up in the system logs? (journald, dmesg, /var/log/syslog)

[Pro-YY]

I used snap.
And I found an "apparmor deined" message with journalctl/dmesg.

Dec 31 14:32:35 VM-250-12-ubuntu audit[15403]: AVC apparmor="DENIED" operation="open" profile="snap.bpftrace.bpftrace" name="/sys/kernel/debug/tracing/events/" pid=15403 comm="bpftrace" requested_mask="r" denied_mask="r" fsuid=0 ouid=0
Dec 31 14:32:35 VM-250-12-ubuntu kernel: audit: type=1400 audit(1577773955.650:151): apparmor="DENIED" operation="open" profile="snap.bpftrace.bpftrace" name="/sys/kernel/debug/tracing/events/" pid=15403 comm="bpftrace" requested_mask="r" denied_mask="r" fsuid=0 ouid=0

[Pro-YY]

Thanks @fbs.
I found a workaround here: https://github.com/iovisor/bpftrace/issues/642
Reinstalling bpftrace with --devmode seems work.

root@VM-250-12-ubuntu:~# sudo snap install --devmode bpftrace
bpftrace 0.9.2 from Colin King (cking-kernel-tools) installed