tjh.dev
Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
1// SPDX-License-Identifier: GPL-2.0
2/* Copyright (c) 2019 Carlos Neira cneirabustos@gmail.com */
3
4#include <linux/bpf.h>
5#include <stdint.h>
6#include <bpf/bpf_helpers.h>
7
8static volatile struct {
9 __u64 dev;
10 __u64 ino;
11 __u64 pid_tgid;
12 __u64 user_pid_tgid;
13} res;
14
15SEC("raw_tracepoint/sys_enter")
16int trace(void *ctx)
17{
18 __u64 ns_pid_tgid, expected_pid;
19 struct bpf_pidns_info nsdata;
20 __u32 key = 0;
21
22 if (bpf_get_ns_current_pid_tgid(res.dev, res.ino, &nsdata,
23 sizeof(struct bpf_pidns_info)))
24 return 0;
25
26 ns_pid_tgid = (__u64)nsdata.tgid << 32 | nsdata.pid;
27 expected_pid = res.user_pid_tgid;
28
29 if (expected_pid != ns_pid_tgid)
30 return 0;
31
32 res.pid_tgid = ns_pid_tgid;
33
34 return 0;
35}
36
37char _license[] SEC("license") = "GPL";