inspektor-gadget

1
// Code generated by bpf2go; DO NOT EDIT.
2
//go:build 386 || amd64 || amd64p32 || arm || arm64 || loong64 || mips64le || mips64p32le || mipsle || ppc64le || riscv64
3

4
package tracer
5

6
import (
7
	"bytes"
8
	_ "embed"
9
	"fmt"
10
	"io"
11

12
	"github.com/cilium/ebpf"
13
)
14

15
type execsnoopWithCwdBufT struct{ Buf [32768]uint8 }
16

17
type execsnoopWithCwdEvent struct {
18
	MntnsId    uint64
19
	Timestamp  uint64
20
	Pid        uint32
21
	Ppid       uint32
22
	Uid        uint32
23
	Gid        uint32
24
	Loginuid   uint32
25
	Sessionid  uint32
26
	Retval     int32
27
	ArgsCount  int32
28
	UpperLayer bool
29
	_          [3]byte
30
	ArgsSize   uint32
31
	Comm       [16]uint8
32
	Cwd        [4096]uint8
33
	Args       [7680]uint8
34
}
35

36
// loadExecsnoopWithCwd returns the embedded CollectionSpec for execsnoopWithCwd.
37
func loadExecsnoopWithCwd() (*ebpf.CollectionSpec, error) {
38
	reader := bytes.NewReader(_ExecsnoopWithCwdBytes)
39
	spec, err := ebpf.LoadCollectionSpecFromReader(reader)
40
	if err != nil {
41
		return nil, fmt.Errorf("can't load execsnoopWithCwd: %w", err)
42
	}
43

44
	return spec, err
45
}
46

47
// loadExecsnoopWithCwdObjects loads execsnoopWithCwd and converts it into a struct.
48
//
49
// The following types are suitable as obj argument:
50
//
51
//	*execsnoopWithCwdObjects
52
//	*execsnoopWithCwdPrograms
53
//	*execsnoopWithCwdMaps
54
//
55
// See ebpf.CollectionSpec.LoadAndAssign documentation for details.
56
func loadExecsnoopWithCwdObjects(obj interface{}, opts *ebpf.CollectionOptions) error {
57
	spec, err := loadExecsnoopWithCwd()
58
	if err != nil {
59
		return err
60
	}
61

62
	return spec.LoadAndAssign(obj, opts)
63
}
64

65
// execsnoopWithCwdSpecs contains maps and programs before they are loaded into the kernel.
66
//
67
// It can be passed ebpf.CollectionSpec.Assign.
68
type execsnoopWithCwdSpecs struct {
69
	execsnoopWithCwdProgramSpecs
70
	execsnoopWithCwdMapSpecs
71
}
72

73
// execsnoopWithCwdSpecs contains programs before they are loaded into the kernel.
74
//
75
// It can be passed ebpf.CollectionSpec.Assign.
76
type execsnoopWithCwdProgramSpecs struct {
77
	IgExecveE *ebpf.ProgramSpec `ebpf:"ig_execve_e"`
78
	IgExecveX *ebpf.ProgramSpec `ebpf:"ig_execve_x"`
79
}
80

81
// execsnoopWithCwdMapSpecs contains maps before they are loaded into the kernel.
82
//
83
// It can be passed ebpf.CollectionSpec.Assign.
84
type execsnoopWithCwdMapSpecs struct {
85
	Bufs                 *ebpf.MapSpec `ebpf:"bufs"`
86
	Events               *ebpf.MapSpec `ebpf:"events"`
87
	Execs                *ebpf.MapSpec `ebpf:"execs"`
88
	GadgetMntnsFilterMap *ebpf.MapSpec `ebpf:"gadget_mntns_filter_map"`
89
	PidByTgid            *ebpf.MapSpec `ebpf:"pid_by_tgid"`
90
}
91

92
// execsnoopWithCwdObjects contains all objects after they have been loaded into the kernel.
93
//
94
// It can be passed to loadExecsnoopWithCwdObjects or ebpf.CollectionSpec.LoadAndAssign.
95
type execsnoopWithCwdObjects struct {
96
	execsnoopWithCwdPrograms
97
	execsnoopWithCwdMaps
98
}
99

100
func (o *execsnoopWithCwdObjects) Close() error {
101
	return _ExecsnoopWithCwdClose(
102
		&o.execsnoopWithCwdPrograms,
103
		&o.execsnoopWithCwdMaps,
104
	)
105
}
106

107
// execsnoopWithCwdMaps contains all maps after they have been loaded into the kernel.
108
//
109
// It can be passed to loadExecsnoopWithCwdObjects or ebpf.CollectionSpec.LoadAndAssign.
110
type execsnoopWithCwdMaps struct {
111
	Bufs                 *ebpf.Map `ebpf:"bufs"`
112
	Events               *ebpf.Map `ebpf:"events"`
113
	Execs                *ebpf.Map `ebpf:"execs"`
114
	GadgetMntnsFilterMap *ebpf.Map `ebpf:"gadget_mntns_filter_map"`
115
	PidByTgid            *ebpf.Map `ebpf:"pid_by_tgid"`
116
}
117

118
func (m *execsnoopWithCwdMaps) Close() error {
119
	return _ExecsnoopWithCwdClose(
120
		m.Bufs,
121
		m.Events,
122
		m.Execs,
123
		m.GadgetMntnsFilterMap,
124
		m.PidByTgid,
125
	)
126
}
127

128
// execsnoopWithCwdPrograms contains all programs after they have been loaded into the kernel.
129
//
130
// It can be passed to loadExecsnoopWithCwdObjects or ebpf.CollectionSpec.LoadAndAssign.
131
type execsnoopWithCwdPrograms struct {
132
	IgExecveE *ebpf.Program `ebpf:"ig_execve_e"`
133
	IgExecveX *ebpf.Program `ebpf:"ig_execve_x"`
134
}
135

136
func (p *execsnoopWithCwdPrograms) Close() error {
137
	return _ExecsnoopWithCwdClose(
138
		p.IgExecveE,
139
		p.IgExecveX,
140
	)
141
}
142

143
func _ExecsnoopWithCwdClose(closers ...io.Closer) error {
144
	for _, closer := range closers {
145
		if err := closer.Close(); err != nil {
146
			return err
147
		}
148
	}
149
	return nil
150
}
151

152
// Do not access this directly.
153
//
154
//go:embed execsnoopwithcwd_bpfel.o
155
var _ExecsnoopWithCwdBytes []byte
156