1// SPDX-License-Identifier: GPL-2.0
 2/*
 3 * Hook into 'openat' syscall entry tracepoint
 4 *
 5 * Test it with:
 6 *
 7 * perf trace -e tools/perf/examples/bpf/sys_enter_openat.c cat /etc/passwd > /dev/null
 8 *
 9 * It'll catch some openat syscalls related to the dynamic linked and
10 * the last one should be the one for '/etc/passwd'.
11 *
12 * The syscall_enter_openat_args can be used to get the syscall fields
13 * and use them for filtering calls, i.e. use in expressions for
14 * the return value.
15 */
16
17#include <bpf.h>
18
19struct syscall_enter_openat_args {
20	unsigned long long unused;
21	long		   syscall_nr;
22	long		   dfd;
23	char		   *filename_ptr;
24	long		   flags;
25	long		   mode;
26};
27
28int syscall_enter(openat)(struct syscall_enter_openat_args *args)
29{
30	return 1;
31}
32
33license(GPL);