From 72b1debf71bd55598950b5b1d09863ae3d821444 Mon Sep 17 00:00:00 2001 From: Kornilios Kourtis Date: Tue, 23 Jul 2024 20:33:47 +0200 Subject: [PATCH] bpf: check the bitset in match_binaries This commit adds a check in match_binaries that uses the bitset that is tracked from parent to children, allowing to track children of a given binary. Signed-off-by: Kornilios Kourtis --- bpf/process/types/basic.h | 2 ++ 1 file changed, 2 insertions(+) diff --git a/bpf/process/types/basic.h b/bpf/process/types/basic.h index 4d84734abe4..60bd6913925 100644 --- a/bpf/process/types/basic.h +++ b/bpf/process/types/basic.h @@ -1578,6 +1578,8 @@ FUNC_INLINE int match_binaries(__u32 selidx) switch (selector_options->op) { case op_filter_in: + if (current->bin.mb_bitset & (1UL<mbset_id)) + return 1; case op_filter_notin: path_map = map_lookup_elem(&tg_mb_paths, &selidx); if (!path_map)