task-47: add KindExec for execve paths

1 files changed, 16 insertions, 9 deletions

diff --git a/internal/c/generated_tracepoints.c b/internal/c/generated_tracepoints.c
index b7fa686..58c993f 100644
--- a/internal/c/generated_tracepoints.c
+++ b/internal/c/generated_tracepoints.c
@@ -8972,7 +8972,7 @@ int handle_sys_exit_pipe(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_execve is a struct path_event
+/// sys_enter_execve is a struct exec_event
 SEC("tracepoint/syscalls/sys_enter_execve")
 int handle_sys_enter_execve(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -8982,17 +8982,20 @@ int handle_sys_enter_execve(struct syscall_trace_enter *ctx) {
     if (!ior_on_syscall_enter(tid, SYS_ENTER_EXECVE))
         return 0;
 
-    struct path_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct path_event), 0);
+    struct exec_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct exec_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_PATH_EVENT;
+    ev->event_type = ENTER_EXEC_EVENT;
     ev->trace_id = SYS_ENTER_EXECVE;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
-    __builtin_memset(&(ev->pathname), 0, sizeof(ev->pathname));
-    bpf_probe_read_user_str(ev->pathname, sizeof(ev->pathname), (void*)ctx->args[0]);
+    __builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
+    bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[0]);
+    bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
+    ev->dirfd = -1;
+    ev->flags = 0;
 
     bpf_ringbuf_submit(ev, 0);
     return 0;
@@ -9024,7 +9027,7 @@ int handle_sys_exit_execve(struct syscall_trace_exit *ctx) {
     return 0;
 }
 
-/// sys_enter_execveat is a struct fd_event
+/// sys_enter_execveat is a struct exec_event
 SEC("tracepoint/syscalls/sys_enter_execveat")
 int handle_sys_enter_execveat(struct syscall_trace_enter *ctx) {
     __u32 pid, tid;
@@ -9034,16 +9037,20 @@ int handle_sys_enter_execveat(struct syscall_trace_enter *ctx) {
     if (!ior_on_syscall_enter(tid, SYS_ENTER_EXECVEAT))
         return 0;
 
-    struct fd_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct fd_event), 0);
+    struct exec_event *ev = bpf_ringbuf_reserve(&event_map, sizeof(struct exec_event), 0);
     if (!ev)
         return 0;
 
-    ev->event_type = ENTER_FD_EVENT;
+    ev->event_type = ENTER_EXEC_EVENT;
     ev->trace_id = SYS_ENTER_EXECVEAT;
     ev->pid = pid;
     ev->tid = tid;
     ev->time = bpf_ktime_get_boot_ns();
-    ev->fd = (__s32)ctx->args[0];
+    __builtin_memset(&(ev->filename), 0, sizeof(ev->filename) + sizeof(ev->comm));
+    bpf_probe_read_user_str(ev->filename, sizeof(ev->filename), (void *)ctx->args[1]);
+    bpf_get_current_comm(&ev->comm, sizeof(ev->comm));
+    ev->dirfd = -1;
+    ev->flags = (__s32)ctx->args[4];
 
     bpf_ringbuf_submit(ev, 0);
     return 0;