The error you're encountering is due to bpftrace's safe mode, which restricts the use of certain functions (like system()) for security reasons. By default, bpftrace runs in safe mode to prevent potentially dangerous operations (e.g., executing arbitrary shell commands).

How to Fix the Error

Option 1: Disable Safe Mode (Not Recommended for Production)

You can disable safe mode by using the --unsafe flag when running bpftrace. This allows the use of unsafe functions like system().

sudo bpftrace --unsafe -e '
tracepoint:syscalls:sys_enter_execve
/str(args.filename) == "/usr/bin/sleep"/
{
    system("/usr/bin/touch /home/ubuntu/proof");
}
'

⚠️ Warning: Disabling safe mode can expose your system to security risks if the script is not trusted.

Option 2: Use a Safer Alternative

Instead of using system(), consider using bpftrace's built-in functions or eBPF maps to achieve your goal without executing shell commands. For example:

• If you want to log the event, use printf():

  bash

  Copy

  sudo bpftrace -e '
  tracepoint:syscalls:sys_enter_execve
  /str(args.filename) == "/usr/bin/sleep"/
  {
      printf("Detected execution of /usr/bin/sleep\n");
  }
  '

• If you want to write to a file, use bpftrace's join() or str() functions to store data in a map and later dump it to a file.

Option 3: Use BPF_PROG_TYPE_KPROBE (Advanced)

If you need to execute actions in response to kernel events, consider writing a custom eBPF program using libbpf or BCC (BPF Compiler Collection), which provides more flexibility and control.

Why Is system() Unsafe?

• system() allows arbitrary shell command execution, which can be exploited if the script is manipulated.
• bpftrace's safe mode is designed to prevent accidental or malicious damage to the system.

Recommendation

If your goal is to detect and log the execution of /usr/bin/sleep, use printf() or write to a bpftrace map instead of system(). If you must execute a command, use --unsafe with caution.