mirror of
https://github.com/eunomia-bpf/bpf-developer-tutorial.git
synced 2026-10-29 11:45:17 +08:00
426e993507
* use BPF_NO_GLOBAL_DATA to avoid error on old kernel versions or libbpf versions, use BPF_NO_GLOBAL_DATA * add translate of replace * add socket * add socket http impl * improve userspace program * add desc for http * update translate to eng * add ci for 32
23 lines
589 B
C
23 lines
589 B
C
#define BPF_NO_GLOBAL_DATA
|
|
#include <vmlinux.h>
|
|
#include <bpf/bpf_helpers.h>
|
|
|
|
/// @description "Process ID to trace"
|
|
const volatile int pid_target = 0;
|
|
|
|
SEC("tracepoint/syscalls/sys_enter_openat")
|
|
int tracepoint__syscalls__sys_enter_openat(struct trace_event_raw_sys_enter* ctx)
|
|
{
|
|
u64 id = bpf_get_current_pid_tgid();
|
|
u32 pid = id >> 32;
|
|
|
|
if (pid_target && pid_target != pid)
|
|
return false;
|
|
// Use bpf_printk to print the process information
|
|
bpf_printk("Process ID: %d enter sys openat\n", pid);
|
|
return 0;
|
|
}
|
|
|
|
/// "Trace open family syscalls."
|
|
char LICENSE[] SEC("license") = "GPL";
|