53 lines · c
1// SPDX-License-Identifier: GPL-2.02/* Copyright (c) 2019 Carlos Neira cneirabustos@gmail.com */3 4#include <linux/bpf.h>5#include <stdint.h>6#include <bpf/bpf_helpers.h>7 8struct {9 __uint(type, BPF_MAP_TYPE_SOCKMAP);10 __uint(max_entries, 2);11 __type(key, __u32);12 __type(value, __u32);13} sock_map SEC(".maps");14 15__u64 user_pid = 0;16__u64 user_tgid = 0;17__u64 dev = 0;18__u64 ino = 0;19 20static void get_pid_tgid(void)21{22 struct bpf_pidns_info nsdata;23 24 if (bpf_get_ns_current_pid_tgid(dev, ino, &nsdata, sizeof(struct bpf_pidns_info)))25 return;26 27 user_pid = nsdata.pid;28 user_tgid = nsdata.tgid;29}30 31SEC("?tracepoint/syscalls/sys_enter_nanosleep")32int tp_handler(const void *ctx)33{34 get_pid_tgid();35 return 0;36}37 38SEC("?cgroup/bind4")39int cgroup_bind4(struct bpf_sock_addr *ctx)40{41 get_pid_tgid();42 return 1;43}44 45SEC("?sk_msg")46int sk_msg(struct sk_msg_md *msg)47{48 get_pid_tgid();49 return SK_PASS;50}51 52char _license[] SEC("license") = "GPL";53