1 // SPDX-License-Identifier: GPL-2.0 2 3 #include "vmlinux.h" 4 #include <bpf/bpf_helpers.h> 5 #include <bpf/bpf_tracing.h> 6 7 #define MAX_PATH_LEN 128 8 #define MAX_FILES 7 9 10 pid_t my_pid = 0; 11 __u32 cnt_stat = 0; 12 __u32 cnt_close = 0; 13 char paths_stat[MAX_FILES][MAX_PATH_LEN] = {}; 14 char paths_close[MAX_FILES][MAX_PATH_LEN] = {}; 15 int rets_stat[MAX_FILES] = {}; 16 int rets_close[MAX_FILES] = {}; 17 18 SEC("fentry/vfs_getattr") 19 int BPF_PROG(prog_stat, struct path *path, struct kstat *stat, 20 __u32 request_mask, unsigned int query_flags) 21 { 22 pid_t pid = bpf_get_current_pid_tgid() >> 32; 23 __u32 cnt = cnt_stat; 24 int ret; 25 26 if (pid != my_pid) 27 return 0; 28 29 if (cnt >= MAX_FILES) 30 return 0; 31 ret = bpf_d_path(path, paths_stat[cnt], MAX_PATH_LEN); 32 33 rets_stat[cnt] = ret; 34 cnt_stat++; 35 return 0; 36 } 37 38 SEC("fentry/filp_close") 39 int BPF_PROG(prog_close, struct file *file, void *id) 40 { 41 pid_t pid = bpf_get_current_pid_tgid() >> 32; 42 __u32 cnt = cnt_close; 43 int ret; 44 45 if (pid != my_pid) 46 return 0; 47 48 if (cnt >= MAX_FILES) 49 return 0; 50 ret = bpf_d_path(&file->f_path, 51 paths_close[cnt], MAX_PATH_LEN); 52 53 rets_close[cnt] = ret; 54 cnt_close++; 55 return 0; 56 } 57 58 char _license[] SEC("license") = "GPL"; 59