3 ms·
I have not attempted it but I believe this can be accomplished with eBPF https://elixir.bootlin.com/linux/v4.0/source/include/linux/security.h#L2700 https://eli
by harporoeder 6y ago
I have not attempted it but I believe this can be accomplished with eBPF https://elixir.bootlin.com/linux/v4.0/source/include/linux/security.h#L2700 https://elixir.bootlin.com/linux/v4.0/source/include/linux/s...
- egberts 6y agoI don’t see a single parameter of the process ID.
- harporoeder 6y agoWell yes you don't get it with a parameter you get it with this helper function while in those contexts `bpf_get_current_pid_tgid`. Edit to provide link: https://elixir.bootlin.com/linux/v4.6/source/samples/bpf/bpf_helpers.h#L28 https://elixir.bootlin.com/linux/v4.6/source/samples/bpf/bpf...
- egberts 6y agoUsing same bootlin search engine using your link, function nor variable not found. Furthermore, the process ID is not yet identified at early inbound stage of EBPD. We would be talking about being past the pre-inbound stage, post-table-lookup stage, and specifically just during the input-to-user land stage.