Subsystem permission error diagnostic aid
Systems, methods, and apparatuses for determining a cause of an error in a computing environment, such as a permission denied error in a linux computing environment, are provided herein. An example method comprises executing an application in a linux environment, monitoring a plurality of linux subsystems and functions via an instrumentation inserted on a kernel, and responsive to a failure of the application, providing a summary of a cause of the failure based upon the monitoring of the linux subsystems and functions.
1 . A method, comprising:
executing an application in a computing environment;
monitoring a plurality of computing subsystems and a plurality of functions via an instrumentation inserted on a kernel to identify a plurality of actions performed by the plurality of computing subsystems and the plurality of functions;
recording the plurality of actions performed by the plurality of computing subsystems and the plurality of functions; and
responsive to a failure of the application:
determining an action of the plurality of actions that occurred just prior to the failure of the application;
identifying a permission corresponding to the action;
based on identifying the permission corresponding to the action, determining that the permission is a denied permission that caused the failure of the application; and
providing a summary of a cause of the failure, the summary comprising the denied permission.
2 . The method of claim 1 , wherein the executing takes place in a containerized computing environment.
3 . The method of claim 2 , wherein the containerized computing environment runs in a container engine, and wherein the monitoring is responsive to a debug flag being set to active in the container engine.
4 . The method of claim 1 , wherein the failure of the application is caused by a permission denied error.
5 . The method of claim 1 , wherein the summary further includes a computing subsystem of the plurality of computing subsystems that caused the failure.
6 . The method of claim 1 , further comprising determining a computing subsystem of the plurality of computing subsystems that caused the failure based upon the action of the plurality of actions that occurred just prior to the failure of the application.
7 . The method of claim 1 , wherein the instrumentation includes an extended Berkeley Packet Filter (eBPF) implementation.
8 . A system, comprising:
a memory; and
a processing device, operatively coupled to the memory, to:
execute an application in a computing environment;
monitor a plurality of computing subsystems and a plurality of functions via an instrumentation inserted on a kernel to identify a plurality of actions performed by the plurality of computing subsystems and the plurality of functions;
record the plurality of actions performed by the plurality of computing subsystems and the plurality of functions; and
responsive to a failure of the application;
determine an action of the plurality of actions that occurred just prior to the failure of the application;
identify a permission corresponding to the action;
based on identifying the permission corresponding to the action, determine that the permission is a denied permission that caused the failure of the application; and
provide a summary of a cause of the failure, the summary comprising the denied permission.
9 . The system of claim 8 , wherein the failure of the application is caused by a permission denied error.
10 . The system of claim 8 , wherein the summary further includes a computing subsystem of the plurality of computing subsystems that caused the failure of the application.
11 . The system of claim 8 , wherein the processing device is further operatively coupled to the memory to determine a computing subsystem of the plurality of computing subsystems that caused the failure based upon the action of the plurality of actions that occurred just prior to the failure of the application.
12 . The system of claim 8 , wherein the instrumentation includes an extended Berkeley Packet Filter (eBPF) implementation.
13 . A non-transitory machine-readable medium storing instructions which, when executed by a processing device, cause the processing device to:
execute an application in a computing environment;
monitor a plurality of computing subsystems and a plurality of functions via an instrumentation inserted on a kernel to identify a plurality of actions performed by the plurality of computing subsystems and the plurality of functions;
record the plurality of actions performed by the plurality of computing subsystems and the plurality of functions; and
responsive to a failure of the application:
determine an action of the plurality of actions that occurred just prior to the failure of the application;
identify a permission corresponding to the action;
based on identifying the permission corresponding to the action, determining that the permission is a denied permission that caused the failure of the application; and
provide a summary of a cause of the failure, the summary comprising the denied permission.
14 . The non-transitory machine-readable medium of claim 13 , wherein the failure of the application is caused by a permission denied error.
15 . The non-transitory machine-readable medium of claim 13 , wherein the summary further includes a computing subsystem that caused the failure.
16 . The non-transitory machine-readable medium of claim 13 , wherein the instructions, when executed by the processing device, further cause the processing device to determine a computing subsystem of the plurality of computing subsystems that caused the failure based upon the action of the plurality of actions that occurred just prior to the failure of the application.
17 . The non-transitory machine-readable medium of claim 13 , wherein the instrumentation includes an extended Berkeley Packet Filter (eBPF) implementation.