26 lines · c
1// SPDX-License-Identifier: GPL-2.02 3#include <linux/bpf.h>4#include <bpf/bpf_helpers.h>5#include <bpf/bpf_tracing.h>6 7#include <sys/types.h>8 9pid_t pid = 0;10long ret = 0;11void *user_ptr = 0;12char buf[256] = {};13 14SEC("tracepoint/syscalls/sys_enter_nanosleep")15int on_write(void *ctx)16{17 if (pid != (bpf_get_current_pid_tgid() >> 32))18 return 0;19 20 ret = bpf_probe_read_user_str(buf, sizeof(buf), user_ptr);21 22 return 0;23}24 25char _license[] SEC("license") = "GPL";26