We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
There was an error while loading. Please reload this page.
1 parent 4884ed7 commit 4efd322Copy full SHA for 4efd322
tests/passing_tests/helpers/uid_gid.py
@@ -0,0 +1,31 @@
1
+from pythonbpf import bpf, section, bpfglobal, compile
2
+from ctypes import c_void_p, c_int64
3
+from pythonbpf.helper import uid, pid
4
+
5
6
+@bpf
7
+@section("tracepoint/syscalls/sys_enter_execve")
8
+def filter_by_user(ctx: c_void_p) -> c_int64:
9
+ """Filter events by specific user ID"""
10
11
+ current_uid = uid()
12
13
+ # Only trace root user (UID 0)
14
+ if current_uid == 0:
15
+ process_id = pid()
16
+ print(f"Root process {process_id} executed")
17
18
+ # Or trace specific user (e.g., UID 1000)
19
+ if current_uid == 1002:
20
+ print("User 1002 executed something")
21
22
+ return 0
23
24
25
26
+@bpfglobal
27
+def LICENSE() -> str:
28
+ return "GPL"
29
30
31
+compile()
0 commit comments