mirror of
https://github.com/varun-r-mallya/Python-BPF.git
synced 2025-12-31 21:06:25 +00:00
Add passing uid_gid helper test
This commit is contained in:
31
tests/passing_tests/helpers/uid_gid.py
Normal file
31
tests/passing_tests/helpers/uid_gid.py
Normal file
@ -0,0 +1,31 @@
|
||||
from pythonbpf import bpf, section, bpfglobal, compile
|
||||
from ctypes import c_void_p, c_int64
|
||||
from pythonbpf.helper import uid, pid
|
||||
|
||||
|
||||
@bpf
|
||||
@section("tracepoint/syscalls/sys_enter_execve")
|
||||
def filter_by_user(ctx: c_void_p) -> c_int64:
|
||||
"""Filter events by specific user ID"""
|
||||
|
||||
current_uid = uid()
|
||||
|
||||
# Only trace root user (UID 0)
|
||||
if current_uid == 0:
|
||||
process_id = pid()
|
||||
print(f"Root process {process_id} executed")
|
||||
|
||||
# Or trace specific user (e.g., UID 1000)
|
||||
if current_uid == 1002:
|
||||
print("User 1002 executed something")
|
||||
|
||||
return 0
|
||||
|
||||
|
||||
@bpf
|
||||
@bpfglobal
|
||||
def LICENSE() -> str:
|
||||
return "GPL"
|
||||
|
||||
|
||||
compile()
|
||||
Reference in New Issue
Block a user