On Sun, Nov 26, 2023 at 6:09 PM Alexei Starovoitov <alexei.starovoitov@xxxxxxxxx> wrote: > > On Thu, Nov 23, 2023 at 3:40 PM Song Liu <song@xxxxxxxxxx> wrote: > > > > +static const char expected_value[] = "hello"; > > +char value[32]; > > + > > +SEC("lsm.s/file_open") > > +int BPF_PROG(test_file_open, struct file *f) > > +{ > > + struct bpf_dynptr value_ptr; > > + __u32 pid; > > + int ret; > > + > > + pid = bpf_get_current_pid_tgid() >> 32; > > + if (pid != monitored_pid) > > + return 0; > > + > > + bpf_dynptr_from_mem(value, sizeof(value), 0, &value_ptr); > > + > > + ret = bpf_get_file_xattr(f, "user.kfuncs", &value_ptr); > > + if (ret != sizeof(expected_value)) > > + return 0; > > + if (bpf_strncmp(value, ret, expected_value)) > > Hmm. It doesn't work like: > if (bpf_strncmp(value, ret, "hello")) This also works. I used expected_value because there is a size check above. We can also make do something like if (ret != sizeof("hello")) return 0; if (bpf_strncmp(value, ret, "hello")) return 0; Both of the two work. Thanks, Song