add ringbuf submit function. commit does not verify on input, but the mirror C code does not as well.

This commit is contained in:
2025-10-02 06:31:35 +05:30
parent 2a93a325ce
commit e83215391a
3 changed files with 67 additions and 10 deletions

View File

@ -22,14 +22,14 @@ struct {
SEC("tracepoint/syscalls/sys_enter_execve")
int trace_execve(void *ctx)
{
struct event *e;
__u64 pid_tgid;
__u64 uid_gid;
// struct event *e;
// __u64 pid_tgid;
// __u64 uid_gid;
__u32 *e;
// Reserve space in the ringbuffer
e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
// if (!e)
// return 0;
if (!e)
return 0;
//
// // Fill the struct with data
// pid_tgid = bpf_get_current_pid_tgid();
@ -39,11 +39,13 @@ int trace_execve(void *ctx)
// e->uid = uid_gid & 0xFFFFFFFF;
//
// e->timestamp = bpf_ktime_get_ns();
//
// bpf_get_current_comm(&e->comm, sizeof(e->comm));
//
// // Submit the event to ringbuffer
// bpf_ringbuf_submit(e, 0);
__u32 temp = 32;
e = &temp;
bpf_ringbuf_submit(e, 0);
return 0;
}

View File

@ -1,4 +1,4 @@
from pythonbpf import bpf, map, bpfglobal, section, compile, compile_to_ir
from pythonbpf import bpf, map, bpfglobal, section, compile, compile_to_ir, BPF
from pythonbpf.maps import RingBuf
from ctypes import c_int32, c_void_p
@ -13,7 +13,9 @@ def mymap() -> RingBuf:
@section("tracepoint/syscalls/sys_enter_clone")
def random_section(ctx: c_void_p) -> c_int32:
print("Hello")
e = mymap().reserve(16)
e = mymap().reserve(6)
if e:
mymap().submit(e)
return c_int32(0)
@ -25,3 +27,7 @@ def LICENSE() -> str:
compile_to_ir("ringbuf.py", "ringbuf.ll")
compile()
b = BPF()
b.load_and_attach()
while True:
print("running")