File: bashreadline.c

package info (click to toggle)
bpfcc 0.18.0%2Bds-2
  • links: PTS, VCS
  • area: main
  • in suites: bullseye
  • size: 12,368 kB
  • sloc: ansic: 132,727; python: 36,226; cpp: 26,973; sh: 710; yacc: 525; makefile: 141; lex: 94
file content (22 lines) | stat: -rw-r--r-- 476 bytes parent folder | download | duplicates (5) 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
 
#include <uapi/linux/ptrace.h>

struct str_t {
	u64 pid;
	char str[80];
};

BPF_PERF_OUTPUT(events);

int printret(struct pt_regs *ctx)
{
	struct str_t data  = {};
	u32 pid;
        if (!PT_REGS_RC(ctx))
          return 0;
        pid = bpf_get_current_pid_tgid();
        data.pid = pid;
        bpf_probe_read_user(&data.str, sizeof(data.str),
                            (void *)PT_REGS_RC(ctx));
        events.perf_submit(ctx, &data, sizeof(data));
        return 0;
};