anil.recoil.org
1// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
2/* Copyright (c) 2020 Facebook */
3#include <linux/bpf.h>
4#include "bpf/bpf_helpers.h" /* This is from our libbpf library */
5
6char LICENSE[] SEC("license") = "Dual BSD/GPL";
7
8/* Globals implemented as an array */
9struct {
10 __uint(type, BPF_MAP_TYPE_ARRAY);
11 __uint(max_entries, 5);
12 __type(key, int);
13 __type(value, long);
14} globals SEC(".maps");
15
16int my_pid_index = 0;
17
18SEC("tp/syscalls/sys_enter_write")
19int handle_tp(void *ctx) {
20 int pid = bpf_get_current_pid_tgid() >> 32;
21
22 long *my_pid;
23 my_pid = bpf_map_lookup_elem(&globals, &my_pid_index);
24 if (my_pid == NULL) {
25 bpf_printk("Error got NULL");
26 return 1;
27 };
28
29 if (pid != *my_pid)
30 return 0;
31
32 bpf_printk("Hello, BPF triggered from PID %d", pid);
33
34 return 0;
35}