Add TestLinuxBinprmExtractPath

Signed-off-by: David Windsor <dawindso@cisco.com>
cilium · Jan 30, 2024 · c62c8cc · c62c8cc
1 parent 66ccaed
commit c62c8cc
Showing 1 changed file with 8 additions and 4 deletions.
diff --git a/bpf/process/types/basic.h b/bpf/process/types/basic.h
@@ -2398,11 +2398,15 @@ read_call_arg(void *ctx, struct msg_generic_kprobe *e, int index, int type,
 	}
 		// fallthrough to file_ty
 	case linux_binprm_type: {
-                struct linux_binprm *bprm = (struct linux_binprm *)arg;
-                arg = (unsigned long)_(&bprm->file);
+		struct linux_binprm *bprm = (struct linux_binprm *)arg;
+		struct file *file;
+
+		arg = (unsigned long)_(&bprm->file);
+		probe_read(&file, sizeof(file), (const void *)arg);
+		arg = (unsigned long)file;
 
-                // fallthrough to file_ty
-        }
+		// fallthrough to file_ty
+	}
 	case file_ty: {
 		struct file *file;
 		probe_read(&file, sizeof(file), &arg);