1
- #include <vmlinux.h>
2
- #include <linux/limits.h>
3
1
#include <bpf/bpf_core_read.h>
4
2
#include <bpf/bpf_helpers.h>
5
3
#include <bpf/bpf_tracing.h>
4
+ #include <linux/limits.h>
5
+ #include <vmlinux.h>
6
6
7
7
char LICENSE [] SEC ("license" ) = "Dual BSD/GPL" ;
8
8
@@ -13,8 +13,8 @@ char LICENSE[] SEC("license") = "Dual BSD/GPL";
13
13
#define MAX_NAMESPACES 8096
14
14
15
15
struct {
16
- __uint (type , BPF_MAP_TYPE_RINGBUF );
17
- __uint (max_entries , 256 * 1024 /* 256 KB */ );
16
+ __uint (type , BPF_MAP_TYPE_RINGBUF );
17
+ __uint (max_entries , 256 * 1024 /* 256 KB */ );
18
18
} audit_log SEC (".maps" );
19
19
20
20
static __always_inline u32 get_mntns ()
@@ -23,20 +23,23 @@ static __always_inline u32 get_mntns()
23
23
return BPF_CORE_READ (task , nsproxy , mnt_ns , ns .inum );
24
24
}
25
25
26
- static __always_inline long read_kernel_str (char * stack_ptr , u32 size , const char * kernel_ptr ) {
26
+ static __always_inline long read_kernel_str (char * stack_ptr , u32 size ,
27
+ const char * kernel_ptr )
28
+ {
27
29
long len = 0 ;
28
- if (kernel_ptr ) {
30
+ if (kernel_ptr ) {
29
31
len = bpf_probe_read_kernel_str (stack_ptr , size , kernel_ptr );
30
32
}
31
- if (len < 1 ) {
33
+ if (len < 1 ) {
32
34
stack_ptr [0 ] = 0 ;
33
35
len = 1 ;
34
36
}
35
37
return len ;
36
38
}
37
39
38
40
SEC ("kprobe/aa_audit" )
39
- int BPF_KPROBE (kprobe__aa_audit , int type , struct aa_profile * profile , struct apparmor_audit_data * ad )
41
+ int BPF_KPROBE (kprobe__aa_audit , int type , struct aa_profile * profile ,
42
+ struct apparmor_audit_data * ad )
40
43
{
41
44
const int error = BPF_CORE_READ (ad , error );
42
45
if (likely (!error )) {
@@ -52,7 +55,7 @@ int BPF_KPROBE(kprobe__aa_audit, int type, struct aa_profile * profile, struct a
52
55
u8 complain = (BPF_CORE_READ (profile , mode ) == APPARMOR_COMPLAIN );
53
56
const char * name_ptr = BPF_CORE_READ (ad , name );
54
57
const char * op_ptr = BPF_CORE_READ (ad , op );
55
- struct task_struct * task = (void * )bpf_get_current_task ();
58
+ struct task_struct * task = (void * )bpf_get_current_task ();
56
59
const char * comm_ptr = BPF_CORE_READ (task , comm );
57
60
58
61
char op [16 ];
0 commit comments