xref: /aosp_15_r20/external/bcc/libbpf-tools/execsnoop.h (revision 387f9dfdfa2baef462e92476d413c7bc2470293e)
1*387f9dfdSAndroid Build Coastguard Worker /* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
2*387f9dfdSAndroid Build Coastguard Worker #ifndef __EXECSNOOP_H
3*387f9dfdSAndroid Build Coastguard Worker #define __EXECSNOOP_H
4*387f9dfdSAndroid Build Coastguard Worker 
5*387f9dfdSAndroid Build Coastguard Worker #define ARGSIZE  128
6*387f9dfdSAndroid Build Coastguard Worker #define TASK_COMM_LEN 16
7*387f9dfdSAndroid Build Coastguard Worker #define TOTAL_MAX_ARGS 60
8*387f9dfdSAndroid Build Coastguard Worker #define DEFAULT_MAXARGS 20
9*387f9dfdSAndroid Build Coastguard Worker #define FULL_MAX_ARGS_ARR (TOTAL_MAX_ARGS * ARGSIZE)
10*387f9dfdSAndroid Build Coastguard Worker #define INVALID_UID ((uid_t)-1)
11*387f9dfdSAndroid Build Coastguard Worker #define BASE_EVENT_SIZE (size_t)(&((struct event*)0)->args)
12*387f9dfdSAndroid Build Coastguard Worker #define EVENT_SIZE(e) (BASE_EVENT_SIZE + e->args_size)
13*387f9dfdSAndroid Build Coastguard Worker #define LAST_ARG (FULL_MAX_ARGS_ARR - ARGSIZE)
14*387f9dfdSAndroid Build Coastguard Worker 
15*387f9dfdSAndroid Build Coastguard Worker struct event {
16*387f9dfdSAndroid Build Coastguard Worker 	pid_t pid;
17*387f9dfdSAndroid Build Coastguard Worker 	pid_t ppid;
18*387f9dfdSAndroid Build Coastguard Worker 	uid_t uid;
19*387f9dfdSAndroid Build Coastguard Worker 	int retval;
20*387f9dfdSAndroid Build Coastguard Worker 	int args_count;
21*387f9dfdSAndroid Build Coastguard Worker 	unsigned int args_size;
22*387f9dfdSAndroid Build Coastguard Worker 	char comm[TASK_COMM_LEN];
23*387f9dfdSAndroid Build Coastguard Worker 	char args[FULL_MAX_ARGS_ARR];
24*387f9dfdSAndroid Build Coastguard Worker };
25*387f9dfdSAndroid Build Coastguard Worker 
26*387f9dfdSAndroid Build Coastguard Worker #endif /* __EXECSNOOP_H */
27