diff --git a/examples/execve.py b/examples/execve.py index 1fc215a..a680ff0 100644 --- a/examples/execve.py +++ b/examples/execve.py @@ -1,9 +1,11 @@ -from pythonbpf.decorators import tracepoint +from pythonbpf.decorators import tracepoint, syscalls from ctypes import c_void_p, c_int32 -@tracepoint("syscalls:sys_enter_execve") + +@tracepoint(syscalls.sys_enter_execve) def trace_execve(ctx: c_void_p) -> c_int32: - print("execve called\n") + print("execve called") return c_int32(0) + LICENSE = "GPL" diff --git a/examples/hello_world.py b/examples/hello_world.py new file mode 100644 index 0000000..5c2e061 --- /dev/null +++ b/examples/hello_world.py @@ -0,0 +1,11 @@ +from pythonbpf.decorators import tracepoint, syscalls +from ctypes import c_void_p, c_int32 + + +@tracepoint(syscalls.sys_clone) +def trace_clone(ctx: c_void_p) -> c_int32: + print("Hello, World!") + return c_int32(0) + + +LICENSE = "GPL" diff --git a/pythonbpf/decorators.py b/pythonbpf/decorators.py index 150bd01..2bba8bc 100644 --- a/pythonbpf/decorators.py +++ b/pythonbpf/decorators.py @@ -1,3 +1,12 @@ +from types import SimpleNamespace + +syscalls = SimpleNamespace( + sys_enter_execve="syscalls:sys_enter_execve", + sys_exit_execve="syscalls:sys_exit_execve", + sys_clone="syscalls:sys_clone", +) + + def tracepoint(name: str): def wrapper(fn): fn._section = f"tracepoint/{name}"