examples/bpf/sys_enter_openat.c

0001 // SPDX-License-Identifier: GPL-2.0
0002 /*
0003  * Hook into 'openat' syscall entry tracepoint
0004  *
0005  * Test it with:
0006  *
0007  * perf trace -e tools/perf/examples/bpf/sys_enter_openat.c cat /etc/passwd > /dev/null
0008  *
0009  * It'll catch some openat syscalls related to the dynamic linked and
0010  * the last one should be the one for '/etc/passwd'.
0011  *
0012  * The syscall_enter_openat_args can be used to get the syscall fields
0013  * and use them for filtering calls, i.e. use in expressions for
0014  * the return value.
0015  */
0016
0017 #include <bpf/bpf.h>
0018
0019 struct syscall_enter_openat_args {
0020     unsigned long long unused;
0021     long           syscall_nr;
0022     long           dfd;
0023     char           *filename_ptr;
0024     long           flags;
0025     long           mode;
0026 };
0027
0028 int syscall_enter(openat)(struct syscall_enter_openat_args *args)
0029 {
0030     return 1;
0031 }
0032
0033 license(GPL);