Skip to content

Commit d025b34

Browse files
Resolve filepath via struct path on exec (#229)
* Resolve path via struct path on exec * Update tests to account for full path resolution
1 parent f7ff8d6 commit d025b34

File tree

2 files changed

+2
-2
lines changed

2 files changed

+2
-2
lines changed

GPL/Events/Process/Probe.bpf.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -166,7 +166,7 @@ int BPF_PROG(sched_process_exec,
166166

167167
// filename
168168
field = ebpf_vl_field__add(&event->vl_fields, EBPF_VL_FIELD_FILENAME);
169-
size = read_kernel_str_or_empty_str(field->data, PATH_MAX, binprm->filename);
169+
size = ebpf_resolve_path_to_string(field->data, &p, task);
170170
ebpf_vl_field__set_size(&event->vl_fields, field, size);
171171

172172
ebpf_ringbuf_write(&ringbuf, event, EVENT_SIZE(event), 0);

testing/testrunner/ebpf_test.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,7 @@ func ForkExec(t *testing.T, et *Runner) {
179179

180180
require.Equal(t, execEvent.Creds.CapPermitted, uint64(0x000001ffffffffff))
181181
require.Equal(t, execEvent.Creds.CapEffective, uint64(0x000001ffffffffff))
182-
require.Equal(t, execEvent.FileName, "./do_nothing")
182+
require.Equal(t, execEvent.FileName, "/do_nothing")
183183
require.Equal(t, execEvent.Argv[0], "./do_nothing")
184184
require.Equal(t, execEvent.Env[0], "TEST_ENV_KEY1=TEST_ENV_VAL1")
185185
require.Equal(t, execEvent.Env[1], "TEST_ENV_KEY2=TEST_ENV_VAL2")

0 commit comments

Comments
 (0)