On Thu, Nov 23, 2023 at 3:40 PM Song Liu <song@xxxxxxxxxx> wrote:
>
> +static const char expected_value[] = "hello";
> +char value[32];
> +
> +SEC("lsm.s/file_open")
> +int BPF_PROG(test_file_open, struct file *f)
> +{
> + struct bpf_dynptr value_ptr;
> + __u32 pid;
> + int ret;
> +
> + pid = bpf_get_current_pid_tgid() >> 32;
> + if (pid != monitored_pid)
> + return 0;
> +
> + bpf_dynptr_from_mem(value, sizeof(value), 0, &value_ptr);
> +
> + ret = bpf_get_file_xattr(f, "user.kfuncs", &value_ptr);
> + if (ret != sizeof(expected_value))
> + return 0;
> + if (bpf_strncmp(value, ret, expected_value))
Hmm. It doesn't work like:
if (bpf_strncmp(value, ret, "hello"))
?
