github.com/inspektor-gadget/inspektor-gadget@v0.28.1/pkg/gadgets/trace/exec/tracer/execsnoop_bpfel.go (about)

     1  // Code generated by bpf2go; DO NOT EDIT.
     2  //go:build 386 || amd64 || arm || arm64 || loong64 || mips64le || mipsle || ppc64le || riscv64
     3  
     4  package tracer
     5  
     6  import (
     7  	"bytes"
     8  	_ "embed"
     9  	"fmt"
    10  	"io"
    11  
    12  	"github.com/cilium/ebpf"
    13  )
    14  
    15  type execsnoopEvent struct {
    16  	MntnsId    uint64
    17  	Timestamp  uint64
    18  	Pid        uint32
    19  	Ppid       uint32
    20  	Uid        uint32
    21  	Gid        uint32
    22  	Loginuid   uint32
    23  	Sessionid  uint32
    24  	Retval     int32
    25  	ArgsCount  int32
    26  	UpperLayer bool
    27  	_          [3]byte
    28  	ArgsSize   uint32
    29  	Comm       [16]uint8
    30  	Pcomm      [16]uint8
    31  	Args       [7680]uint8
    32  }
    33  
    34  // loadExecsnoop returns the embedded CollectionSpec for execsnoop.
    35  func loadExecsnoop() (*ebpf.CollectionSpec, error) {
    36  	reader := bytes.NewReader(_ExecsnoopBytes)
    37  	spec, err := ebpf.LoadCollectionSpecFromReader(reader)
    38  	if err != nil {
    39  		return nil, fmt.Errorf("can't load execsnoop: %w", err)
    40  	}
    41  
    42  	return spec, err
    43  }
    44  
    45  // loadExecsnoopObjects loads execsnoop and converts it into a struct.
    46  //
    47  // The following types are suitable as obj argument:
    48  //
    49  //	*execsnoopObjects
    50  //	*execsnoopPrograms
    51  //	*execsnoopMaps
    52  //
    53  // See ebpf.CollectionSpec.LoadAndAssign documentation for details.
    54  func loadExecsnoopObjects(obj interface{}, opts *ebpf.CollectionOptions) error {
    55  	spec, err := loadExecsnoop()
    56  	if err != nil {
    57  		return err
    58  	}
    59  
    60  	return spec.LoadAndAssign(obj, opts)
    61  }
    62  
    63  // execsnoopSpecs contains maps and programs before they are loaded into the kernel.
    64  //
    65  // It can be passed ebpf.CollectionSpec.Assign.
    66  type execsnoopSpecs struct {
    67  	execsnoopProgramSpecs
    68  	execsnoopMapSpecs
    69  }
    70  
    71  // execsnoopSpecs contains programs before they are loaded into the kernel.
    72  //
    73  // It can be passed ebpf.CollectionSpec.Assign.
    74  type execsnoopProgramSpecs struct {
    75  	IgExecveE *ebpf.ProgramSpec `ebpf:"ig_execve_e"`
    76  	IgExecveX *ebpf.ProgramSpec `ebpf:"ig_execve_x"`
    77  }
    78  
    79  // execsnoopMapSpecs contains maps before they are loaded into the kernel.
    80  //
    81  // It can be passed ebpf.CollectionSpec.Assign.
    82  type execsnoopMapSpecs struct {
    83  	Events               *ebpf.MapSpec `ebpf:"events"`
    84  	Execs                *ebpf.MapSpec `ebpf:"execs"`
    85  	GadgetMntnsFilterMap *ebpf.MapSpec `ebpf:"gadget_mntns_filter_map"`
    86  	PidByTgid            *ebpf.MapSpec `ebpf:"pid_by_tgid"`
    87  }
    88  
    89  // execsnoopObjects contains all objects after they have been loaded into the kernel.
    90  //
    91  // It can be passed to loadExecsnoopObjects or ebpf.CollectionSpec.LoadAndAssign.
    92  type execsnoopObjects struct {
    93  	execsnoopPrograms
    94  	execsnoopMaps
    95  }
    96  
    97  func (o *execsnoopObjects) Close() error {
    98  	return _ExecsnoopClose(
    99  		&o.execsnoopPrograms,
   100  		&o.execsnoopMaps,
   101  	)
   102  }
   103  
   104  // execsnoopMaps contains all maps after they have been loaded into the kernel.
   105  //
   106  // It can be passed to loadExecsnoopObjects or ebpf.CollectionSpec.LoadAndAssign.
   107  type execsnoopMaps struct {
   108  	Events               *ebpf.Map `ebpf:"events"`
   109  	Execs                *ebpf.Map `ebpf:"execs"`
   110  	GadgetMntnsFilterMap *ebpf.Map `ebpf:"gadget_mntns_filter_map"`
   111  	PidByTgid            *ebpf.Map `ebpf:"pid_by_tgid"`
   112  }
   113  
   114  func (m *execsnoopMaps) Close() error {
   115  	return _ExecsnoopClose(
   116  		m.Events,
   117  		m.Execs,
   118  		m.GadgetMntnsFilterMap,
   119  		m.PidByTgid,
   120  	)
   121  }
   122  
   123  // execsnoopPrograms contains all programs after they have been loaded into the kernel.
   124  //
   125  // It can be passed to loadExecsnoopObjects or ebpf.CollectionSpec.LoadAndAssign.
   126  type execsnoopPrograms struct {
   127  	IgExecveE *ebpf.Program `ebpf:"ig_execve_e"`
   128  	IgExecveX *ebpf.Program `ebpf:"ig_execve_x"`
   129  }
   130  
   131  func (p *execsnoopPrograms) Close() error {
   132  	return _ExecsnoopClose(
   133  		p.IgExecveE,
   134  		p.IgExecveX,
   135  	)
   136  }
   137  
   138  func _ExecsnoopClose(closers ...io.Closer) error {
   139  	for _, closer := range closers {
   140  		if err := closer.Close(); err != nil {
   141  			return err
   142  		}
   143  	}
   144  	return nil
   145  }
   146  
   147  // Do not access this directly.
   148  //
   149  //go:embed execsnoop_bpfel.o
   150  var _ExecsnoopBytes []byte