1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2019 Carlos Neira cneirabustos@gmail.com */
3 
4 #include <linux/bpf.h>
5 #include <stdint.h>
6 #include <bpf/bpf_helpers.h>
7 
8 static volatile struct {
9 	__u64 dev;
10 	__u64 ino;
11 	__u64 pid_tgid;
12 	__u64 user_pid_tgid;
13 } res;
14 
15 SEC("raw_tracepoint/sys_enter")
trace(void * ctx)16 int trace(void *ctx)
17 {
18 	__u64  ns_pid_tgid, expected_pid;
19 	struct bpf_pidns_info nsdata;
20 	__u32 key = 0;
21 
22 	if (bpf_get_ns_current_pid_tgid(res.dev, res.ino, &nsdata,
23 		   sizeof(struct bpf_pidns_info)))
24 		return 0;
25 
26 	ns_pid_tgid = (__u64)nsdata.tgid << 32 | nsdata.pid;
27 	expected_pid = res.user_pid_tgid;
28 
29 	if (expected_pid != ns_pid_tgid)
30 		return 0;
31 
32 	res.pid_tgid = ns_pid_tgid;
33 
34 	return 0;
35 }
36 
37 char _license[] SEC("license") = "GPL";
38