inspektor-gadget

1
// Code generated by bpf2go; DO NOT EDIT.
2
//go:build 386 || amd64 || amd64p32 || arm || arm64 || loong64 || mips64le || mips64p32le || mipsle || ppc64le || riscv64
3

4
package tracer
5

6
import (
7
	"bytes"
8
	_ "embed"
9
	"fmt"
10
	"io"
11

12
	"github.com/cilium/ebpf"
13
)
14

15
type execsnoopEvent struct {
16
	MntnsId    uint64
17
	Timestamp  uint64
18
	Pid        uint32
19
	Ppid       uint32
20
	Uid        uint32
21
	Gid        uint32
22
	Loginuid   uint32
23
	Sessionid  uint32
24
	Retval     int32
25
	ArgsCount  int32
26
	UpperLayer bool
27
	_          [3]byte
28
	ArgsSize   uint32
29
	Comm       [16]uint8
30
	Args       [7680]uint8
31
}
32

33
// loadExecsnoop returns the embedded CollectionSpec for execsnoop.
34
func loadExecsnoop() (*ebpf.CollectionSpec, error) {
35
	reader := bytes.NewReader(_ExecsnoopBytes)
36
	spec, err := ebpf.LoadCollectionSpecFromReader(reader)
37
	if err != nil {
38
		return nil, fmt.Errorf("can't load execsnoop: %w", err)
39
	}
40

41
	return spec, err
42
}
43

44
// loadExecsnoopObjects loads execsnoop and converts it into a struct.
45
//
46
// The following types are suitable as obj argument:
47
//
48
//	*execsnoopObjects
49
//	*execsnoopPrograms
50
//	*execsnoopMaps
51
//
52
// See ebpf.CollectionSpec.LoadAndAssign documentation for details.
53
func loadExecsnoopObjects(obj interface{}, opts *ebpf.CollectionOptions) error {
54
	spec, err := loadExecsnoop()
55
	if err != nil {
56
		return err
57
	}
58

59
	return spec.LoadAndAssign(obj, opts)
60
}
61

62
// execsnoopSpecs contains maps and programs before they are loaded into the kernel.
63
//
64
// It can be passed ebpf.CollectionSpec.Assign.
65
type execsnoopSpecs struct {
66
	execsnoopProgramSpecs
67
	execsnoopMapSpecs
68
}
69

70
// execsnoopSpecs contains programs before they are loaded into the kernel.
71
//
72
// It can be passed ebpf.CollectionSpec.Assign.
73
type execsnoopProgramSpecs struct {
74
	IgExecveE *ebpf.ProgramSpec `ebpf:"ig_execve_e"`
75
	IgExecveX *ebpf.ProgramSpec `ebpf:"ig_execve_x"`
76
}
77

78
// execsnoopMapSpecs contains maps before they are loaded into the kernel.
79
//
80
// It can be passed ebpf.CollectionSpec.Assign.
81
type execsnoopMapSpecs struct {
82
	Events               *ebpf.MapSpec `ebpf:"events"`
83
	Execs                *ebpf.MapSpec `ebpf:"execs"`
84
	GadgetMntnsFilterMap *ebpf.MapSpec `ebpf:"gadget_mntns_filter_map"`
85
	PidByTgid            *ebpf.MapSpec `ebpf:"pid_by_tgid"`
86
}
87

88
// execsnoopObjects contains all objects after they have been loaded into the kernel.
89
//
90
// It can be passed to loadExecsnoopObjects or ebpf.CollectionSpec.LoadAndAssign.
91
type execsnoopObjects struct {
92
	execsnoopPrograms
93
	execsnoopMaps
94
}
95

96
func (o *execsnoopObjects) Close() error {
97
	return _ExecsnoopClose(
98
		&o.execsnoopPrograms,
99
		&o.execsnoopMaps,
100
	)
101
}
102

103
// execsnoopMaps contains all maps after they have been loaded into the kernel.
104
//
105
// It can be passed to loadExecsnoopObjects or ebpf.CollectionSpec.LoadAndAssign.
106
type execsnoopMaps struct {
107
	Events               *ebpf.Map `ebpf:"events"`
108
	Execs                *ebpf.Map `ebpf:"execs"`
109
	GadgetMntnsFilterMap *ebpf.Map `ebpf:"gadget_mntns_filter_map"`
110
	PidByTgid            *ebpf.Map `ebpf:"pid_by_tgid"`
111
}
112

113
func (m *execsnoopMaps) Close() error {
114
	return _ExecsnoopClose(
115
		m.Events,
116
		m.Execs,
117
		m.GadgetMntnsFilterMap,
118
		m.PidByTgid,
119
	)
120
}
121

122
// execsnoopPrograms contains all programs after they have been loaded into the kernel.
123
//
124
// It can be passed to loadExecsnoopObjects or ebpf.CollectionSpec.LoadAndAssign.
125
type execsnoopPrograms struct {
126
	IgExecveE *ebpf.Program `ebpf:"ig_execve_e"`
127
	IgExecveX *ebpf.Program `ebpf:"ig_execve_x"`
128
}
129

130
func (p *execsnoopPrograms) Close() error {
131
	return _ExecsnoopClose(
132
		p.IgExecveE,
133
		p.IgExecveX,
134
	)
135
}
136

137
func _ExecsnoopClose(closers ...io.Closer) error {
138
	for _, closer := range closers {
139
		if err := closer.Close(); err != nil {
140
			return err
141
		}
142
	}
143
	return nil
144
}
145

146
// Do not access this directly.
147
//
148
//go:embed execsnoop_bpfel.o
149
var _ExecsnoopBytes []byte
150