0001
0002
0003
0004 #include "vmlinux.h"
0005 #include <bpf/bpf_helpers.h>
0006 #include <bpf/bpf_tracing.h>
0007 #include "bpf_tracing_net.h"
0008
0009 const volatile pid_t my_pid = 0;
0010 char path[256] = {};
0011
0012 SEC("fentry/unix_listen")
0013 int BPF_PROG(unix_listen, struct socket *sock, int backlog)
0014 {
0015 pid_t pid = bpf_get_current_pid_tgid() >> 32;
0016 struct unix_sock *unix_sk;
0017 int i, len;
0018
0019 if (pid != my_pid)
0020 return 0;
0021
0022 unix_sk = (struct unix_sock *)bpf_skc_to_unix_sock(sock->sk);
0023 if (!unix_sk)
0024 return 0;
0025
0026 if (unix_sk->addr->name->sun_path[0])
0027 return 0;
0028
0029 len = unix_sk->addr->len - sizeof(short);
0030 path[0] = '@';
0031 for (i = 1; i < len; i++) {
0032 if (i >= sizeof(struct sockaddr_un))
0033 break;
0034
0035 path[i] = unix_sk->addr->name->sun_path[i];
0036 }
0037 return 0;
0038 }
0039
0040 char _license[] SEC("license") = "GPL";