8#include <bpf/vmlinux.h>
9#include <bpf/bpf_helpers.h>
12#include "shared_rust_types.h"
15#define DEFAULT_RINGBUF_SIZE (256 * 1024)
20 __uint(
type, BPF_MAP_TYPE_RINGBUF);
48 void *log = bpf_ringbuf_reserve(&
log_ringbuf, size, 0);
50 bpf_printk(
"seabee log_buf: unable to reserve from ringbuf of size %lu",
61 u64 pid_tgid = bpf_get_current_pid_tgid();
62 hdr->
pid = pid_tgid >> 32;
63 hdr->
tid = pid_tgid & 0xFFFFFFFF;
64 hdr->
uid = bpf_get_current_uid_gid() & 0xFFFFFFFF;
66 bpf_get_current_comm(hdr->
comm,
sizeof(hdr->
comm));
75 bpf_ringbuf_submit(log, 0);
90 const char *fmt, __u64 *data, __u32 data_len)
93 log = log_buf(level, reason, EVENT_TYPE_MSG,
sizeof(*log), NO_POL_ID);
95 long ret = bpf_snprintf((
char *)log->
msg,
sizeof(log->
msg), fmt, data,
98 bpf_printk(
"Error: log_generic_msg: bpf_snprintf failed");
100 bpf_ringbuf_submit(log, 0);
#define DEFAULT_RINGBUF_SIZE
256KB is the default, but can be set in the skeleton before load
Definition logging.h:15
u32 log_level
Defined in each .bpf.c file. Specifies which logs to output to the ringbuf.
Definition label_file.bpf.c:21
EventType
The link between a program's log structure and the logging system.
Definition logging_types.h:52
LogReason
Standard reasons as to why a log is being output.
Definition logging_types.h:36
LogLevel
Standard log levels indicating the severity of the message.
Definition logging_types.h:21
Generic log with a message field.
Definition logging_types.h:108
unsigned char msg[MAX_STR_LEN]
a 128 character message
Definition logging_types.h:112
Header attached to every log message.
Definition logging_types.h:88
unsigned long pid
process id that is triggering the hook
Definition logging_types.h:96
unsigned char reason
alias for LogReason
Definition logging_types.h:92
unsigned char level
alias for LogLevel
Definition logging_types.h:90
unsigned char comm[COMM_LEN]
same as /proc/{pid}/comm
Definition logging_types.h:104
unsigned short type
alias for EventType
Definition logging_types.h:94
unsigned long tid
thread id that is triggering the hook
Definition logging_types.h:98
unsigned long pol_id
policy id for this object
Definition logging_types.h:102
unsigned long uid
effective user id of the process
Definition logging_types.h:100
Ring buffer structure that the user space will read logs from.
Definition logging.h:18
unsigned int max_entries
Can be updated with OpenMap::set_max_entries()
Definition logging.h:22
unsigned int type
Ringbuffer map type.
Definition logging.h:20