diff --git a/docs/linux/helper-function/bpf_get_current_comm.md b/docs/linux/helper-function/bpf_get_current_comm.md index 4914620..f3babcc 100644 --- a/docs/linux/helper-function/bpf_get_current_comm.md +++ b/docs/linux/helper-function/bpf_get_current_comm.md @@ -48,5 +48,19 @@ This helper call can be used in the following program types: ### Example -!!! example "Docs could be improved" - This part of the docs is incomplete, contributions are very welcome +```c +#include +#include + +SEC("tp/syscalls/sys_enter_open") +int sys_open_trace(void *ctx) { + // TASK_COMM_LEN is defined in vmlinux.h + char comm[TASK_COMM_LEN]; + if (bpf_get_current_comm(comm, TASK_COMM_LEN)) { + bpf_printk("Failed to get comm\n"); + return 0; + } + bpf_printk("Hello from %s\n", comm); + return 0; +} +``` diff --git a/docs/linux/helper-function/bpf_probe_write_user.md b/docs/linux/helper-function/bpf_probe_write_user.md index b46fbeb..f27a289 100644 --- a/docs/linux/helper-function/bpf_probe_write_user.md +++ b/docs/linux/helper-function/bpf_probe_write_user.md @@ -50,5 +50,29 @@ This helper call can be used in the following program types: ### Example -!!! example "Docs could be improved" - This part of the docs is incomplete, contributions are very welcome +```c +#include +#include +#include +#include + +// We do it in the exit to not alter the syscall behavior. The userspace program +// will see the new filename only after the syscall execution. +SEC("fexit/__x64_sys_open") +int BPF_PROG(p_open, struct pt_regs *regs, long ret) { + // If it is our example program overwrite the open path. + struct task_struct *task = (struct task_struct *)bpf_get_current_task_btf(); + if (bpf_strncmp(task->comm, TASK_COMM_LEN, "example") != 0) { + return 0; + } + + // SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode) + // first param is the pointer to filename. + void *filename_ptr = (void *)PT_REGS_PARM1_CORE_SYSCALL(regs); + const char filename[16] = "/tmp/new"; + if (bpf_probe_write_user(filename_ptr, filename, 16)) { + bpf_printk("Failed to write new filename\n"); + } + return 0; +} +``` diff --git a/docs/linux/helper-function/bpf_strncmp.md b/docs/linux/helper-function/bpf_strncmp.md index 5251f49..d534f06 100644 --- a/docs/linux/helper-function/bpf_strncmp.md +++ b/docs/linux/helper-function/bpf_strncmp.md @@ -68,5 +68,17 @@ This helper call can be used in the following program types: ### Example -!!! example "Docs could be improved" - This part of the docs is incomplete, contributions are very welcome +```c +#include +#include + +SEC("tp_btf/sys_enter") +int sys_enter_trace(void *ctx) { + struct task_struct *task = (struct task_struct *)bpf_get_current_task_btf(); + if (bpf_strncmp(task->comm, TASK_COMM_LEN, "cat") != 0) { + return 0; + } + bpf_printk("Hello, I'm a cat!\n"); + return 0; +} +```