Running: [root@seventh ~]# perf trace -e augmented_raw_syscalls.o,recvmmsg event syntax error: 'augmented_raw_syscalls.o' \___ Key was rejected by service (add -v to see detail) Run 'perf list' for a list of valid events Usage: perf trace [] [] or: perf trace [] -- [] or: perf trace record [] [] or: perf trace record [] -- [] -e, --event event/syscall selector. use 'perf list' to list available events [root@seventh ~]# With this in place shows that the first sys_bpf(BPF_PROG_LOAD) that has the bpf_attr->prog_sig and prog_sig_len set reaches verify_pkcs7_message_sig and it returns 0, meaning that the signature was verified, its only the second time that it returns -129 (EKEYREJECTED), may be a bug in the scripts/bpfsign that doesn't generate the right signature for the second and subsequent BPF bytecode sections, or in my libbpf patches that attach the ELF signature sections to the ELF bytecode sections to then send to the kernel. [root@seventh ~]# perf probe verify_pkcs7_message_sig%return '$retval:s32' Added new event: probe:verify_pkcs7_message_sig__return (on verify_pkcs7_message_sig%return with $retval:s32) You can now use it in all perf tools, such as: perf record -e probe:verify_pkcs7_message_sig__return -aR sleep 1 [root@seventh ~]# perf probe -l probe:pkcs7_verify__return (on pkcs7_verify%return@pkcs7_verify.c with arg1) probe:verify_pkcs7_message_sig__return (on verify_pkcs7_message_sig%return@bpf/certs/system_keyring.c with arg1) [root@seventh ~]# perf trace --libtraceevent_print -e probe:*/call-graph=dwarf/ 0.000 perf/2065 probe:pkcs7_verify__return((ffffffffa74e0ad0 <- ffffffffa725f2e1) arg1=0) kretprobe_trampoline ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.31.so) sys_bpf (inlined) sys_bpf_prog_load (inlined) bpf_load_program_xattr (/home/acme/bin/perf) load_program (/home/acme/bin/perf) bpf_program__load (/home/acme/bin/perf) bpf_object__load_progs (inlined) bpf_object__load_xattr (/home/acme/bin/perf) bpf_object__load (/home/acme/bin/perf) bpf__load (/home/acme/bin/perf) parse_events_load_bpf_obj (/home/acme/bin/perf) [0] ([unknown]) 0.421 perf/2065 probe:verify_pkcs7_message_sig__return((ffffffffa725f280 <- ffffffffa725f3cc) arg1=0) kretprobe_trampoline ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.31.so) sys_bpf (inlined) sys_bpf_prog_load (inlined) bpf_load_program_xattr (/home/acme/bin/perf) load_program (/home/acme/bin/perf) bpf_program__load (/home/acme/bin/perf) bpf_object__load_progs (inlined) bpf_object__load_xattr (/home/acme/bin/perf) bpf_object__load (/home/acme/bin/perf) bpf__load (/home/acme/bin/perf) parse_events_load_bpf_obj (/home/acme/bin/perf) [0] ([unknown]) 0.485 perf/2065 probe:pkcs7_verify__return((ffffffffa74e0ad0 <- ffffffffa725f2e1) arg1=0) kretprobe_trampoline ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.31.so) sys_bpf (inlined) sys_bpf_prog_load (inlined) bpf_load_program_xattr (/home/acme/bin/perf) load_program (/home/acme/bin/perf) bpf_program__load (/home/acme/bin/perf) bpf_object__load_progs (inlined) bpf_object__load_xattr (/home/acme/bin/perf) bpf_object__load (/home/acme/bin/perf) bpf__load (/home/acme/bin/perf) parse_events_load_bpf_obj (/home/acme/bin/perf) [0] ([unknown]) 0.904 perf/2065 probe:verify_pkcs7_message_sig__return((ffffffffa725f280 <- ffffffffa725f3cc) arg1=-129) kretprobe_trampoline ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.31.so) sys_bpf (inlined) sys_bpf_prog_load (inlined) bpf_load_program_xattr (/home/acme/bin/perf) load_program (/home/acme/bin/perf) bpf_program__load (/home/acme/bin/perf) bpf_object__load_progs (inlined) bpf_object__load_xattr (/home/acme/bin/perf) bpf_object__load (/home/acme/bin/perf) bpf__load (/home/acme/bin/perf) parse_events_load_bpf_obj (/home/acme/bin/perf) [0] ([unknown]) 0.929 perf/2065 probe:pkcs7_verify__return((ffffffffa74e0ad0 <- ffffffffa725f2e1) arg1=0) kretprobe_trampoline ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.31.so) sys_bpf (inlined) sys_bpf_prog_load (inlined) bpf_load_program_xattr (/home/acme/bin/perf) load_program (/home/acme/bin/perf) bpf_program__load (/home/acme/bin/perf) bpf_object__load_progs (inlined) bpf_object__load_xattr (/home/acme/bin/perf) bpf_object__load (/home/acme/bin/perf) bpf__load (/home/acme/bin/perf) parse_events_load_bpf_obj (/home/acme/bin/perf) [0] ([unknown]) 1.351 perf/2065 probe:verify_pkcs7_message_sig__return((ffffffffa725f280 <- ffffffffa725f3cc) arg1=-129) kretprobe_trampoline ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.31.so) sys_bpf (inlined) sys_bpf_prog_load (inlined) bpf_load_program_xattr (/home/acme/bin/perf) load_program (/home/acme/bin/perf) bpf_program__load (/home/acme/bin/perf) bpf_object__load_progs (inlined) bpf_object__load_xattr (/home/acme/bin/perf) bpf_object__load (/home/acme/bin/perf) bpf__load (/home/acme/bin/perf) parse_events_load_bpf_obj (/home/acme/bin/perf) [0] ([unknown]) 1.365 perf/2065 probe:pkcs7_verify__return((ffffffffa74e0ad0 <- ffffffffa725f2e1) arg1=0) kretprobe_trampoline ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.31.so) sys_bpf (inlined) sys_bpf_prog_load (inlined) bpf_load_program_xattr (/home/acme/bin/perf) load_program (/home/acme/bin/perf) bpf_program__load (/home/acme/bin/perf) bpf_object__load_progs (inlined) bpf_object__load_xattr (/home/acme/bin/perf) bpf_object__load (/home/acme/bin/perf) bpf__load (/home/acme/bin/perf) parse_events_load_bpf_obj (/home/acme/bin/perf) [0] ([unknown]) 1.772 perf/2065 probe:verify_pkcs7_message_sig__return((ffffffffa725f280 <- ffffffffa725f3cc) arg1=-129) kretprobe_trampoline ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.31.so) sys_bpf (inlined) sys_bpf_prog_load (inlined) bpf_load_program_xattr (/home/acme/bin/perf) load_program (/home/acme/bin/perf) bpf_program__load (/home/acme/bin/perf) bpf_object__load_progs (inlined) bpf_object__load_xattr (/home/acme/bin/perf) bpf_object__load (/home/acme/bin/perf) bpf__load (/home/acme/bin/perf) parse_events_load_bpf_obj (/home/acme/bin/perf) [0] ([unknown]) 1.800 perf/2065 probe:pkcs7_verify__return((ffffffffa74e0ad0 <- ffffffffa725f2e1) arg1=0) kretprobe_trampoline ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.31.so) sys_bpf (inlined) sys_bpf_prog_load (inlined) bpf_load_program_xattr (/home/acme/bin/perf) load_program (/home/acme/bin/perf) bpf_program__load (/home/acme/bin/perf) bpf_object__load_progs (inlined) bpf_object__load_xattr (/home/acme/bin/perf) bpf_object__load (/home/acme/bin/perf) bpf__load (/home/acme/bin/perf) parse_events_load_bpf_obj (/home/acme/bin/perf) [0] ([unknown]) 2.191 perf/2065 probe:verify_pkcs7_message_sig__return((ffffffffa725f280 <- ffffffffa725f3cc) arg1=-129) kretprobe_trampoline ([kernel.kallsyms]) syscall (/usr/lib64/libc-2.31.so) sys_bpf (inlined) sys_bpf_prog_load (inlined) bpf_load_program_xattr (/home/acme/bin/perf) load_program (/home/acme/bin/perf) bpf_program__load (/home/acme/bin/perf) bpf_object__load_progs (inlined) bpf_object__load_xattr (/home/acme/bin/perf) bpf_object__load (/home/acme/bin/perf) bpf__load (/home/acme/bin/perf) parse_events_load_bpf_obj (/home/acme/bin/perf) [0] ([unknown])