1"use strict";(self.webpackChunkig_website=self.webpackChunkig_website||[]).push([[7963],{38183:(e,t,n)=>{n.r(t),n.d(t,{assets:()=>d,contentTitle:()=>u,default:()=>m,frontMatter:()=>o,metadata:()=>r,toc:()=>c});const r=JSON.parse('{"id":"gadgets/trace_init_module","title":"trace_init_module","description":"The traceinitmodule gadget emits events when processes invoke the initmodule() or finitmodule() syscalls to load kernel modules.","source":"@site/versioned_docs/version-main/gadgets/trace_init_module.mdx","sourceDirName":"gadgets","slug":"/gadgets/trace_init_module","permalink":"/docs/main/gadgets/trace_init_module","draft":false,"unlisted":false,"editUrl":"https://github.com/inspektor-gadget/inspektor-gadget/edit/main/versioned_docs/version-main/gadgets/trace_init_module.mdx","tags":[],"version":"main","sidebarPosition":0,"frontMatter":{"title":"trace_init_module","sidebar_position":0},"sidebar":"mainSidebar","previous":{"title":"trace_gpu_starvation","permalink":"/docs/main/gadgets/trace_gpu_starvation"},"next":{"title":"trace_link","permalink":"/docs/main/gadgets/trace_link"}}');var a=n(74848),l=n(28453),s=n(49489),i=n(7227);const o={title:"trace_init_module",sidebar_position:0},u="trace_init_module",d={},c=[{value:"Requirements",id:"requirements",level:2},{value:"Getting started",id:"getting-started",level:2},{value:"Flags",id:"flags",level:2},{value:"<code>--pid</code>",id:"--pid",level:3},{value:"<code>--uid</code>",id:"--uid",level:3},{value:"Example output",id:"example-output",level:2}];function h(e){const t={code:"code",h1:"h1",h2:"h2",h3:"h3",header:"header",li:"li",p:"p",pre:"pre",strong:"strong",ul:"ul",...(0,l.R)(),...e.components};return(0,a.jsxs)(a.Fragment,{children:[(0,a.jsx)(t.header,{children:(0,a.jsx)(t.h1,{id:"trace_init_module",children:"trace_init_module"})}),"\n",(0,a.jsxs)(t.p,{children:["The trace_init_module gadget emits events when processes invoke the ",(0,a.jsx)(t.code,{children:"init_module()"})," or ",(0,a.jsx)(t.code,{children:"finit_module()"})," syscalls to load kernel modules."]}),"\n",(0,a.jsx)(t.p,{children:(0,a.jsx)(t.strong,{children:"Syscalls traced:"})}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.code,{children:"init_module(module_image, len, param_values)"})," - loads a module from a memory buffer"]}),"\n",(0,a.jsxs)(t.li,{children:[(0,a.jsx)(t.code,{children:"finit_module(fd, param_values, flags)"})," - loads a module from a file descriptor"]}),"\n"]}),"\n",(0,a.jsx)(t.p,{children:"This gadget captures:"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsxs)(t.li,{children:["For ",(0,a.jsx)(t.code,{children:"init_module"}),": module size (",(0,a.jsx)(t.code,{children:"len"}),") and parameters (",(0,a.jsx)(t.code,{children:"param_values"}),")"]}),"\n",(0,a.jsxs)(t.li,{children:["For ",(0,a.jsx)(t.code,{children:"finit_module"}),": file descriptor (",(0,a.jsx)(t.code,{children:"fd"}),"), resolved filepath, flags, and parameters (",(0,a.jsx)(t.code,{children:"param_values"}),")"]}),"\n"]}),"\n",(0,a.jsxs)(t.p,{children:[(0,a.jsx)(t.strong,{children:"Note:"})," The ",(0,a.jsx)(t.code,{children:"module_image"})," parameter from ",(0,a.jsx)(t.code,{children:"init_module"}
1)," is intentionally not captured."]}),"\n",(0,a.jsx)(t.h2,{id:"requirements",children:"Requirements"}),"\n",(0,a.jsxs)(t.ul,{children:["\n",(0,a.jsx)(t.li,{children:"Minimum Kernel Version : 5.4"}),"\n"]}),"\n",(0,a.jsx)(t.h2,{id:"getting-started",children:"Getting started"}),"\n",(0,a.jsx)(t.p,{children:"Running the gadget:"}),"\n",(0,a.jsxs)(s.A,{groupId:"env",children:[(0,a.jsx)(i.A,{value:"kubectl-gadget",label:"kubectl gadget",children:(0,a.jsx)(t.pre,{children:(0,a.jsx)(t.code,{className:"language-bash",children:"$ kubectl gadget run ghcr.io/inspektor-gadget/gadget/trace_init_module:latest [flags]\n"})})}),(0,a.jsx)(i.A,{value:"ig",label:"ig",children:(0,a.jsx)(t.pre,{children:(0,a.jsx)(t.code,{className:"language-bash",children:"$ sudo ig run ghcr.io/inspektor-gadget/gadget/trace_init_module:latest [flags]\n"})})})]}),"\n",(0,a.jsx)(t.h2,{id:"flags",children:"Flags"}),"\n",(0,a.jsx)(t.h3,{id:"--pid",children:(0,a.jsx)(t.code,{children:"--pid"})}),"\n",(0,a.jsx)(t.p,{children:"Show only events generated by processes with this pid"}),"\n",(0,a.jsx)(t.p,{children:'Default value: ""'}),"\n",(0,a.jsx)(t.h3,{id:"--uid",children:(0,a.jsx)(t.code,{children:"--uid"})}),"\n",(0,a.jsx)(t.p,{children:"Show only events generated by processes with this uid"}),"\n",(0,a.jsx)(t.p,{children:'Default value: ""'}),"\n",(0,a.jsx)(t.h2,{id:"example-output",children:"Example output"}),"\n",(0,a.jsx)(t.pre,{children:(0,a.jsx)(t.code,{className:"language-bash",children:"$ sudo ig run trace_init_module:latest\nRUNTIME.CONTAINERNAME COMM PID TID LEN PARAM_VALUES\n... insmod 1234 1234 4096 foo=bar\n"})})]})}function m(e={}){const{wrapper:t}={...(0,l.R)(),...e.components};return t?(0,a.jsx)(t,{...e,children:(0,a.jsx)(h,{...e})}):h(e)}},7227:(e,t,n)=>{n.d(t,{A:()=>s});n(96540);var r=n(34164);const a={tabItem:"tabItem_Ymn6"};var l=n(74848);function s(e){let{children:t,hidden:n,className:s}=e;return(0,l.jsx)("div",{role:"tabpanel",className:(0,r.A)(a.tabItem,s),hidden:n,children:t})}},49489:(e,t,n)=>{n.d(t,{A:()=>y});var r=n(96540),a=n(34164),l=n(24245),s=n(56347),i=n(36494),o=n(62814),u=n(45167),d=n(69900);function c(e){return r.Children.toArray(e).filter((e=>"\n"!==e)).map((e=>{if(!e||(0,r.isValidElement)(e)&&function(e){const{props:t}=e;return!!t&&"object"==typeof t&&"value"in t}(e))return e;throw new Error(`Docusaurus error: Bad <Tabs> child <${"string"==typeof e.type?e.type:e.type.name}>: all children of the <Tabs> component should be <TabItem>, and every <TabItem> should have a unique "value" prop.`)}))?.filter(Boolean)??[]}function h(e){const{values:t,children:n}=e;return(0,r.useMemo)((()=>{const e=t??function(e){return c(e).map((e=>{let{props:{value:t,label:n,attributes:r,default:a}}=e;return{value:t,label:n,attributes:r,default:a}}))}(n);return function(e){const t=(0,u.XI)(e,((e,t)=>e.value===t.value));if(t.length>0)throw new Error(`Docusaurus error: Duplicate values "${t.map((e=>e.value)).join(", ")}" found in <Tabs>. Every value needs to be unique.`)}(e),e}),[t,n])}function m(e){let{value:t,tabValues:n}=e;return n.some((e=>e.value===t))}function p(e){let{queryString:t=!1,groupId:n}=e;const a=(0,s.W6)(),l=function(e){let{queryString:t=!1,groupId:n}=e;if("string"==typeof t)return t;if(!1===t)return null;if(!0===t&&!n)throw new Error('Docusaurus error: The <Tabs> component groupId prop is required if queryString=true, because this value is used as the search param name. You can also provide an explicit value such as queryString="my-search-param".');return n??null}({queryString:t,groupId:n});return[(0,o.aZ)(l),(0,r.useCallback)((e=>{if(!l)return;const t=new URLSearchParams(a.location.search);t.set(l,e),a.replace({...a.location,search:t.toString()})}),[l,a])]}function g(e){const{defaultValue:t,queryString:n=!1,groupId:a}=e,l=h(e),[s,o]=(0,r.useState)((()=>function(e){let{defaultValue:t,tabValues:n}=e;if(0===n.length)throw new Error("Docusaurus error: the <Tabs> component requires at least one <TabItem> children component");if(t){if(!m({value:t,tabValues:n}))throw new Error(`Docusaurus error: The <Tabs> has a defaultValue "${t}" but none of its children has the corresponding value. Available values are: ${n.map((e=>e.value)).join(", ")}. If you intend to show no default tab, use defaultValue={null} instead.`);return t}const r=n.find((e=>e.default))??n[0];if(!r)throw new Error("Unexpected error: 0 tabValues");return r.value}({defaultValue:t,tabValues:l}))),[u,c]=p({queryString:n,groupId:a}),[g,f]=function(e){let{groupId:t}=e;const n=function(e){return e?`docusaurus.tab.${e}`:null}(t),[a,l]=(0,d.Dv)(n);return[a,(0,r.useCallback)((e=>{n&&l.set(e)}),[n,l])]}({groupId:a}),b=(()=>{const e=u??g;return m({value:e,tabValues:l})?e:null})();(0,i.A)((()=>{b&&o(b)}),[b]);return{selectedValue:s,selectValue:(0,r.useCallback)((e=>{if(!m({value:e,tabValues:l}))throw new Error(`Can't select invalid tab value=${e}`);o(e),c(e),f(e)}),[c,f,l]),tabValues:l}}var f=n(11062);const b={tabList:"tabList__CuJ",tabItem:"tabItem_LNqP"};var v=n(74848);function x(e){let{className:t,block:n,selectedValue:r,selectValue:s,tabValues:i}=e;const o=[],{blockElementScrollPositionUntilNextRender:u}=(0,l.a_)(),d=e=>{const t=e.currentTarget,n=o.indexOf(t),a=i[n].value;a!==r&&(u(t),s(a))},c=e=>{let t=null;switch(e.key){case"Enter":d(e);break;case"ArrowRight":{const n=o.indexOf(e.currentTarget)+1;t=o[n]??o[0];break}case"ArrowLeft":{const n=o.indexOf(e.currentTarget)-1;t=o[n]??o[o.length-1];break}}t?.focus()};return(0,v.jsx)("ul",{role:"tablist","aria-orientation":"horizontal",className:(0,a.A)("tabs",{"tabs--block":n},t),children:i.map((e=>{let{value:t,label:n,attributes:l}=e;return(0,v.jsx)("li",{role:"tab",tabIndex:r===t?0:-1,"aria-selected":r===t,ref:e=>o.push(e),onKeyDown:c,onClick:d,...l,className:(0,a.A)("tabs__item",b.tabItem,l?.className,{"tabs__item--active":r===t}),children:n??t},t)}))})}function _(e){let{lazy:t,children:n,selectedValue:l}=e;
1const s=(Array.isArray(n)?n:[n]).filter(Boolean);if(t){const e=s.find((e=>e.props.value===l));return e?(0,r.cloneElement)(e,{className:(0,a.A)("margin-top--md",e.props.className)}):null}return(0,v.jsx)("div",{className:"margin-top--md",children:s.map(((e,t)=>(0,r.cloneElement)(e,{key:t,hidden:e.props.value!==l})))})}function j(e){const t=g(e);return(0,v.jsxs)("div",{className:(0,a.A)("tabs-container",b.tabList),children:[(0,v.jsx)(x,{...t,...e}),(0,v.jsx)(_,{...t,...e})]})}function y(e){const t=(0,f.A)();return(0,v.jsx)(j,{...e,children:c(e.children)},String(t))}},28453:(e,t,n)=>{n.d(t,{R:()=>s,x:()=>i});var r=n(96540);const a={},l=r.createContext(a);function s(e){const t=r.useContext(l);return r.useMemo((function(){return"function"==typeof e?e(t):{...t,...e}}),[t,e])}function i(e){let t;return t=e.disableParentContext?"function"==typeof e.components?e.components(a):e.components||a:s(e.components),r.createElement(l.Provider,{value:t},e.children)}}}]);
Line numbers count LF bytes from the start of the resource, as the search results do. Vendor segments are library code the classifier recognised; they are stored but not indexed. Bytes are shown as Latin1 characters, one per byte.