1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
#![no_std]
#![feature(c_size_t)]
use aya_ebpf::cty::c_long;
use core::ffi::c_int;
use core::ffi::c_size_t;
use core::ffi::CStr;
use core::fmt::{self, Formatter};
use core::str;
mod vmlinux;
use crate::vmlinux::umode_t;
pub enum SyscallInfo {
Write(WriteSyscallBPF),
Open(OpenSyscallBPF),
Close(CloseSyscallBPF),
}
#[derive(Clone, Copy)]
pub struct WriteSyscallBPF {
pub pid: u32,
pub fd: c_int,
pub buf: [u8; 96], //TODO: might want to use c_char here
pub count: c_size_t,
pub ret: c_long,
}
unsafe impl Sync for WriteSyscallBPF {}
impl fmt::Debug for WriteSyscallBPF {
fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
f.debug_struct("WriteSyscallBPF")
.field("pid", &self.pid)
.field("fd", &self.fd)
.field("buf", &str::from_utf8(&self.buf).unwrap_or(""))
.field("count", &self.count)
.field("ret", &self.ret)
.finish()
}
}
#[derive(Clone, Copy)]
pub struct OpenSyscallBPF {
pub pid: u32,
pub dfd: c_int,
pub filename: [u8; 96],
pub flags: c_int,
pub mode: umode_t,
pub ret: c_int,
}
unsafe impl Sync for OpenSyscallBPF {}
impl fmt::Debug for OpenSyscallBPF {
fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
f.debug_struct("OpenSyscallBPF")
.field("pid", &self.pid)
.field("dfd", &self.dfd)
.field(
"filename",
&CStr::from_bytes_until_nul(&self.filename).unwrap_or_default(),
)
.field("flags", &self.flags)
.field("ret", &self.ret)
.finish()
}
}
#[derive(Clone, Copy)]
pub struct CloseSyscallBPF {
pub pid: u32,
pub fd: c_int,
pub ret: c_long,
}
unsafe impl Sync for CloseSyscallBPF {}
impl fmt::Debug for CloseSyscallBPF {
fn fmt(&self, f: &mut Formatter<'_>) -> fmt::Result {
f.debug_struct("CloseSyscallBPF")
.field("pid", &self.pid)
.field("fd", &self.fd)
.field("ret", &self.ret)
.finish()
}
}
|
