Skip to content

Commit 4efd322

Browse files
committed
Add passing uid_gid helper test
1 parent 4884ed7 commit 4efd322

File tree

1 file changed

+31
-0
lines changed

1 file changed

+31
-0
lines changed
Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
from pythonbpf import bpf, section, bpfglobal, compile
2+
from ctypes import c_void_p, c_int64
3+
from pythonbpf.helper import uid, pid
4+
5+
6+
@bpf
7+
@section("tracepoint/syscalls/sys_enter_execve")
8+
def filter_by_user(ctx: c_void_p) -> c_int64:
9+
"""Filter events by specific user ID"""
10+
11+
current_uid = uid()
12+
13+
# Only trace root user (UID 0)
14+
if current_uid == 0:
15+
process_id = pid()
16+
print(f"Root process {process_id} executed")
17+
18+
# Or trace specific user (e.g., UID 1000)
19+
if current_uid == 1002:
20+
print("User 1002 executed something")
21+
22+
return 0
23+
24+
25+
@bpf
26+
@bpfglobal
27+
def LICENSE() -> str:
28+
return "GPL"
29+
30+
31+
compile()

0 commit comments

Comments
 (0)