From f1d915931ca1e0f5fb4007c9cab59fd460a25c6c Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 9 Feb 2024 00:32:11 +0200 Subject: also catch enter openat syscall --- internal/tracepoints/syscalls.go | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) create mode 100644 internal/tracepoints/syscalls.go (limited to 'internal/tracepoints') diff --git a/internal/tracepoints/syscalls.go b/internal/tracepoints/syscalls.go new file mode 100644 index 0000000..ebc46af --- /dev/null +++ b/internal/tracepoints/syscalls.go @@ -0,0 +1,21 @@ +package tracepoints + +import ( + "fmt" + + bpf "github.com/aquasecurity/libbpfgo" +) + +func AttachSyscalls(bpfModule *bpf.Module, names ...string) error { + for _, name := range names { + // Attach to tracepoint + prog, err := bpfModule.GetProgram(fmt.Sprintf("handle_%s", name)) + if err != nil { + return fmt.Errorf("Failed to get BPF program handle_%s: %v", name, err) + } + if _, err = prog.AttachTracepoint("syscalls", fmt.Sprintf("sys_%s", name)); err != nil { + return fmt.Errorf("Failed to attach to sys_%s tracepoint: %v", name, err) + } + } + return nil +} -- cgit v1.2.3