1// SPDX-License-Identifier: GPL-2.0
2/*
3 * Hook into 'openat' syscall entry tracepoint
4 *
5 * Test it with:
6 *
7 * perf trace -e tools/perf/examples/bpf/sys_enter_openat.c cat /etc/passwd > /dev/null
8 *
9 * It'll catch some openat syscalls related to the dynamic linked and
10 * the last one should be the one for '/etc/passwd'.
11 *
12 * The syscall_enter_openat_args can be used to get the syscall fields
13 * and use them for filtering calls, i.e. use in expressions for
14 * the return value.
15 */
16
17#include <bpf/bpf.h>
18
19struct syscall_enter_openat_args {
20	unsigned long long unused;
21	long		   syscall_nr;
22	long		   dfd;
23	char		   *filename_ptr;
24	long		   flags;
25	long		   mode;
26};
27
28int syscall_enter(openat)(struct syscall_enter_openat_args *args)
29{
30	return 1;
31}
32
33license(GPL);
34