1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * Hook into 'openat' syscall entry tracepoint
4  *
5  * Test it with:
6  *
7  * perf trace -e tools/perf/examples/bpf/sys_enter_openat.c cat /etc/passwd > /dev/null
8  *
9  * It'll catch some openat syscalls related to the dynamic linked and
10  * the last one should be the one for '/etc/passwd'.
11  *
12  * The syscall_enter_openat_args can be used to get the syscall fields
13  * and use them for filtering calls, i.e. use in expressions for
14  * the return value.
15  */
16 
17 #include <bpf.h>
18 
19 struct syscall_enter_openat_args {
20 	unsigned long long unused;
21 	long		   syscall_nr;
22 	long		   dfd;
23 	char		   *filename_ptr;
24 	long		   flags;
25 	long		   mode;
26 };
27 
syscall_enter(openat)28 int syscall_enter(openat)(struct syscall_enter_openat_args *args)
29 {
30 	return 1;
31 }
32 
33 license(GPL);
34