0001
0002
0003
0004 #include "vmlinux.h"
0005 #include <bpf/bpf_helpers.h>
0006
0007 __u64 inKey = 0;
0008 __u64 inValue = 0;
0009 __u32 inPid = 0;
0010
0011 struct {
0012 __uint(type, BPF_MAP_TYPE_PERCPU_HASH);
0013 __uint(max_entries, 2);
0014 __type(key, __u64);
0015 __type(value, __u64);
0016 } hashmap1 SEC(".maps");
0017
0018
0019 SEC("tp/syscalls/sys_enter_getpgid")
0020 int sysenter_getpgid(const void *ctx)
0021 {
0022
0023
0024
0025 int cur_pid = bpf_get_current_pid_tgid() >> 32;
0026
0027 if (cur_pid == inPid)
0028 bpf_map_update_elem(&hashmap1, &inKey, &inValue, BPF_NOEXIST);
0029
0030 return 0;
0031 }
0032
0033 char _license[] SEC("license") = "GPL";