Learning

In this post we are going to write a new module for python: a very simple function exported from Rust that we can consume in the Python interpreter. We’ll leverage the PyO3 Rust bindings for the Python interpreter. Let’s start with a new Cargo project: $ cargo init --lib demo_rust_lib and insert the required settings in Cargo.toml: [package] name = "rusty" version = "0.1.0" edition = "2021" [lib] name="rusty" crate-type = ["cdylib"] [dependencies.pyo3] version = "*" [features] extension-module = ["pyo3/extension-module"] default = ["extension-module"] now it’s a matter to write our library; luckily the PyO3 library exposes a lot of useful types for python interop; the only thing we need to add is an extra fn named as our module that “exports” the functions we want to make available in the Python layer: ...

Let’s get our feet wet; in this first part I’ll write about a very simple way to interface Rust and Python. First of all let’s build a Rust dynamic library with some basic functions. // this file is: src/lib.rs #[no_mangle] pub extern "C" fn hello() { println!("Hello from the library!"); } #[no_mangle] pub extern "C" fn sum(a: i32, b: i32) -> i32 { a + b } your Cargo.toml should look like this: [package] name = "pyrust" version = "0.1.0" edition = "2018" [dependencies] [lib] crate-type = ["cdylib"] compile the library with cargo build ...

In the last post we introduced the BCC framework to interface Python code with eBPF facility. Now we are ready to make one step further! #!/usr/bin/python3 import bcc bpf = bcc.BPF(text=""" #include <uapi/linux/ptrace.h> int trace_malloc(struct pt_regs *ctx, size_t size) { bpf_trace_printk("size=%d\\n",size); return 0; };""") bpf.attach_uprobe(name="c",sym="malloc",fn_name="trace_malloc") while 1: (task, pid, cpu, flags, ts, msg) = bpf.trace_fields() print(f"task={task}\tmsg={msg}") This code is a little more complex, but still quite easy: first of all we use bcc to attach an “user space probe” instead of a kernel probe, and the function being observed will be libc’s malloc. ...

eBPF is a revolutionary technology that can run sandboxed programs in the Linux kernel without changing kernel source code or loading kernel modules. Basically any user can write code for a virtual machine that can interact with the kernel data structure and functions. bcc is an high-level helper interface to eBPF (another is bpftrace). To use it, start by following installation guide , but if you have a recent Debian system, it’s just a matter of installing some packages: ...