0001
0002
0003 #include <linux/bpf.h>
0004 #include <bpf/bpf_helpers.h>
0005 #include <bpf/bpf_tracing.h>
0006
0007 #include <sys/types.h>
0008
0009 pid_t pid = 0;
0010 long ret = 0;
0011 void *user_ptr = 0;
0012 char buf[256] = {};
0013
0014 SEC("tracepoint/syscalls/sys_enter_nanosleep")
0015 int on_write(void *ctx)
0016 {
0017 if (pid != (bpf_get_current_pid_tgid() >> 32))
0018 return 0;
0019
0020 ret = bpf_probe_read_user_str(buf, sizeof(buf), user_ptr);
0021
0022 return 0;
0023 }
0024
0025 char _license[] SEC("license") = "GPL";