mirror of
https://github.com/varun-r-mallya/Python-BPF.git
synced 2025-12-31 21:06:25 +00:00
varun-r-mallya
a27360482b
TODO: struct_kioctx for x86_64 vmlinux.h has anonymous structs that refused to transpile well, so an extra rule has been written to make only the structs of that external. Fix this in the future.
20 lines
377 B
C
20 lines
377 B
C
#include "vmlinux.h"
|
|
#include <bpf/bpf_helpers.h>
|
|
#include <bpf/bpf_tracing.h>
|
|
|
|
char LICENSE[] SEC("license") = "Dual BSD/GPL";
|
|
|
|
SEC("kprobe/do_unlinkat")
|
|
int kprobe_execve(struct pt_regs *ctx)
|
|
{
|
|
bpf_printk("unlinkat created");
|
|
return 0;
|
|
}
|
|
|
|
SEC("kretprobe/do_unlinkat")
|
|
int kretprobe_execve(struct pt_regs *ctx)
|
|
{
|
|
bpf_printk("unlinkat returned\n");
|
|
return 0;
|
|
}
|