can trace openat exit

1 files changed, 15 insertions, 6 deletions

diff --git a/main.bpf.c b/main.bpf.c
index df20264..475d2ee 100644
--- a/main.bpf.c
+++ b/main.bpf.c
@@ -1,6 +1,6 @@
 //+build ignore
 
-#include <vmlinux.h>
+#include "vmlinux.h"
 
 #include <bpf/bpf_helpers.h>
 
@@ -16,18 +16,27 @@ struct {
     __uint(max_entries, 1 << 24);
 } tester SEC(".maps");
 
+struct openat_event {
+    int fd;
+    u32 tid;
+    char filename[256];
+    char comm[16];
+};
+
 struct {
     __uint(type, BPF_MAP_TYPE_PERF_EVENT_ARRAY);
     __uint(key_size, sizeof(u32));
     __uint(value_size, sizeof(u32));
 } events SEC(".maps");
 
-SEC("kprobe/sys_mmap")
-int kprobe__sys_mmap(struct pt_regs *ctx)
-{
-    char *foo = "foo";
-    bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, foo, sizeof(char) * 3);
+SEC("tracepoint/syscalls/sys_exit_openat")
+int handle_openat(struct trace_event_raw_sys_exit *args) {
+    struct openat_event event = {};
+    event.fd = args->ret;
+    event.tid = bpf_get_current_pid_tgid();
+    bpf_get_current_comm(&event.comm, sizeof(event.comm));
 
+    bpf_perf_event_output(args, &events, BPF_F_CURRENT_CPU, &event, sizeof(event));
     return 0;
 }