I'm trying to get the filepath for the opened file for the sys_openat
syscall for both 32bit and 64 bit processes. 64 bit processes work fine. For 32 bit processes I had to register for __ia32_compat_sys_openat
(instead of __ia32_sys_opena
t) to get the callback to get called at all. However the pointer for pathname appears to always get the same address pointing to invalid memory 00000000e662cc4c
, the ctx->si
points to the same address. The flags come through fine so it seems like I'm missing something in the documentation I need to do to convert the 32bit pathname address?
int syscall__openat(struct pt_regs *ctx, int dirfd, const char __user *pathname, int flags) {
u32 pid = bpf_get_current_pid_tgid() & 0xFFFFFFFF;
char buf[64];
int len = bpf_probe_read_str(buf, sizeof(buf), pathname);
bpf_trace_printk("**OPENAT len %d\n", len);
bpf_trace_printk("**OPENAT %p Pid %d pathname: %s\n", pathname, pid, buf);
bpf_trace_printk("**OPENAT flags %d\n", flags);
return 0;
}
Thanks!
User contributions licensed under CC BY-SA 3.0