bpf: track processes by cgrpid

Signed-off-by: Djalal Harouni <tixxdz@gmail.com>
cilium · Oct 14, 2024 · 7dafb65 · 7dafb65
1 parent d8ce450
commit 7dafb65
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/bpf/lib/process.h b/bpf/lib/process.h
@@ -335,6 +335,7 @@ struct execve_map_value {
 	struct msg_execve_key pkey;
 	__u32 flags;
 	__u32 nspid;
+	__u64 cgrpid;
 	struct msg_ns ns;
 	struct msg_capabilities caps;
 	struct binary bin;

diff --git a/pkg/sensors/exec/execvemap/execve.go b/pkg/sensors/exec/execvemap/execve.go
@@ -16,6 +16,7 @@ type ExecveValue struct {
 	Parent       processapi.MsgExecveKey    `align:"pkey"`
 	Flags        uint32                     `align:"flags"`
 	Nspid        uint32                     `align:"nspid"`
+	CgrpId       uint64                     `align:"cgrpid"`
 	Namespaces   processapi.MsgNamespaces   `align:"ns"`
 	Capabilities processapi.MsgCapabilities `align:"caps"`
 	Binary       processapi.Binary          `align:"bin"`