KFunc bpf_path_d_path

v6.12

This function resolve the path name for the supplied path.

Definition

Resolve the path name for the supplied path and store it in buf. This BPF kfunc is the safer variant of the legacy bpf_d_path helper and should be used in place of bpf_d_path whenever possible. It enforces KF_TRUSTED_ARGS semantics, meaning that the supplied path must itself hold a valid reference, or else the BPF program will be outright rejected by the BPF verifier.

This BPF kfunc may only be called from BPF LSM programs.

Parameters

path: path to resolve the pathname for

buf: buffer to return the resolved path name in

buf__sz: length of the supplied buffer

Returns

A positive integer corresponding to the length of the resolved path name in buf, including the NULL termination character. On error, a negative integer is returned.

Signature

int bpf_path_d_path(const struct path *path, char *buf, size_t buf__sz)

Usage

bpf_path_d_path resolves kernel struct path (dentry+ mount) into a full pathname. It's most commonly paired with bpf_get_task_exe_file() or bpf_get_file_xattr() style kfuncs: those return a struct file *, and bpf_path_d_path is then called on &file->f_path to get the actual path string.

Program types

The following program types can make use of this kfunc:

• BPF_PROG_TYPE_LSM
• BPF_PROG_TYPE_PERF_EVENT v6.12 -
• BPF_PROG_TYPE_TRACEPOINT v6.12 -
• BPF_PROG_TYPE_TRACING

Example

SEC("lsm/task_kill")
int BPF_PROG(log_kill_target, struct task_struct *p,
             struct kernel_siginfo *info, int sig,
             const struct cred *cred)
{
    struct file *exe_file;
    char path_buf[128];
    int ret;

    exe_file = bpf_get_task_exe_file(p);
    if (!exe_file)
        return 0;

    ret = bpf_path_d_path(&exe_file->f_path, path_buf,
                  sizeof(path_buf));
    if (ret > 0)
        bpf_printk("kill target exe: %s\n", path_buf);

    bpf_put_file(exe_file);
    return 0;
}